aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRandy Dunlap <rdunlap@infradead.org>2018-01-27 21:49:08 -0500
committerJonathan Corbet <corbet@lwn.net>2018-02-01 14:50:01 -0500
commit54e36a2dc554685463af54b4ac97a5ec022bd09c (patch)
tree0f08063bfe581ea0c94cb60adbdddf5ee3d54467
parent9124bb8760c16bc7689dd26a5ab98a231765309f (diff)
Documentation/admin-guide: fixes for thunderbolt.rst
Edits for grammar, punctuation, and a doubled-up word. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Andreas Noever <andreas.noever@gmail.com> Cc: Michael Jamet <michael.jamet@intel.com> Cc: Mika Westerberg <mika.westerberg@linux.intel.com> Cc: Yehezkel Bernat <yehezkel.bernat@intel.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
-rw-r--r--Documentation/admin-guide/thunderbolt.rst66
1 files changed, 33 insertions, 33 deletions
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst
index 9b55952039a6..9948ec36a204 100644
--- a/Documentation/admin-guide/thunderbolt.rst
+++ b/Documentation/admin-guide/thunderbolt.rst
@@ -3,13 +3,13 @@
3============= 3=============
4The interface presented here is not meant for end users. Instead there 4The interface presented here is not meant for end users. Instead there
5should be a userspace tool that handles all the low-level details, keeps 5should be a userspace tool that handles all the low-level details, keeps
6database of the authorized devices and prompts user for new connections. 6a database of the authorized devices and prompts users for new connections.
7 7
8More details about the sysfs interface for Thunderbolt devices can be 8More details about the sysfs interface for Thunderbolt devices can be
9found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``. 9found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``.
10 10
11Those users who just want to connect any device without any sort of 11Those users who just want to connect any device without any sort of
12manual work, can add following line to 12manual work can add following line to
13``/etc/udev/rules.d/99-local.rules``:: 13``/etc/udev/rules.d/99-local.rules``::
14 14
15 ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1" 15 ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1"
@@ -20,7 +20,7 @@ vulnerable to DMA attacks.
20 20
21Security levels and how to use them 21Security levels and how to use them
22----------------------------------- 22-----------------------------------
23Starting from Intel Falcon Ridge Thunderbolt controller there are 4 23Starting with Intel Falcon Ridge Thunderbolt controller there are 4
24security levels available. The reason for these is the fact that the 24security levels available. The reason for these is the fact that the
25connected devices can be DMA masters and thus read contents of the host 25connected devices can be DMA masters and thus read contents of the host
26memory without CPU and OS knowing about it. There are ways to prevent 26memory without CPU and OS knowing about it. There are ways to prevent
@@ -37,14 +37,14 @@ The security levels are as follows:
37 user 37 user
38 User is asked whether the device is allowed to be connected. 38 User is asked whether the device is allowed to be connected.
39 Based on the device identification information available through 39 Based on the device identification information available through
40 ``/sys/bus/thunderbolt/devices``. user then can do the decision. 40 ``/sys/bus/thunderbolt/devices``, the user then can make the decision.
41 In BIOS settings this is typically called *Unique ID*. 41 In BIOS settings this is typically called *Unique ID*.
42 42
43 secure 43 secure
44 User is asked whether the device is allowed to be connected. In 44 User is asked whether the device is allowed to be connected. In
45 addition to UUID the device (if it supports secure connect) is sent 45 addition to UUID the device (if it supports secure connect) is sent
46 a challenge that should match the expected one based on a random key 46 a challenge that should match the expected one based on a random key
47 written to ``key`` sysfs attribute. In BIOS settings this is 47 written to the ``key`` sysfs attribute. In BIOS settings this is
48 typically called *One time saved key*. 48 typically called *One time saved key*.
49 49
50 dponly 50 dponly
@@ -78,7 +78,7 @@ When a device is plugged in it will appear in sysfs as follows::
78 /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff 78 /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff
79 79
80The ``authorized`` attribute reads 0 which means no PCIe tunnels are 80The ``authorized`` attribute reads 0 which means no PCIe tunnels are
81created yet. The user can authorize the device by simply:: 81created yet. The user can authorize the device by simply entering::
82 82
83 # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized 83 # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized
84 84
@@ -86,7 +86,7 @@ This will create the PCIe tunnels and the device is now connected.
86 86
87If the device supports secure connect, and the domain security level is 87If the device supports secure connect, and the domain security level is
88set to ``secure``, it has an additional attribute ``key`` which can hold 88set to ``secure``, it has an additional attribute ``key`` which can hold
89a random 32 byte value used for authorization and challenging the device in 89a random 32-byte value used for authorization and challenging the device in
90future connects:: 90future connects::
91 91
92 /sys/bus/thunderbolt/devices/0-3/authorized - 0 92 /sys/bus/thunderbolt/devices/0-3/authorized - 0
@@ -99,12 +99,12 @@ future connects::
99 99
100Notice the key is empty by default. 100Notice the key is empty by default.
101 101
102If the user does not want to use secure connect it can just ``echo 1`` 102If the user does not want to use secure connect they can just ``echo 1``
103to the ``authorized`` attribute and the PCIe tunnels will be created in 103to the ``authorized`` attribute and the PCIe tunnels will be created in
104the same way than in ``user`` security level. 104the same way as in the ``user`` security level.
105 105
106If the user wants to use secure connect, the first time the device is 106If the user wants to use secure connect, the first time the device is
107plugged a key needs to be created and send to the device:: 107plugged a key needs to be created and sent to the device::
108 108
109 # key=$(openssl rand -hex 32) 109 # key=$(openssl rand -hex 32)
110 # echo $key > /sys/bus/thunderbolt/devices/0-3/key 110 # echo $key > /sys/bus/thunderbolt/devices/0-3/key
@@ -121,27 +121,27 @@ device using the same key::
121 121
122If the challenge the device returns back matches the one we expect based 122If the challenge the device returns back matches the one we expect based
123on the key, the device is connected and the PCIe tunnels are created. 123on the key, the device is connected and the PCIe tunnels are created.
124However, if the challenge failed no tunnels are created and error is 124However, if the challenge fails no tunnels are created and error is
125returned to the user. 125returned to the user.
126 126
127If the user still wants to connect the device it can either approve 127If the user still wants to connect the device they can either approve
128the device without a key or write new key and write 1 to the 128the device without a key or write a new key and write 1 to the
129``authorized`` file to get the new key stored on the device NVM. 129``authorized`` file to get the new key stored on the device NVM.
130 130
131Upgrading NVM on Thunderbolt device or host 131Upgrading NVM on Thunderbolt device or host
132------------------------------------------- 132-------------------------------------------
133Since most of the functionality is handled in a firmware running on a 133Since most of the functionality is handled in firmware running on a
134host controller or a device, it is important that the firmware can be 134host controller or a device, it is important that the firmware can be
135upgraded to the latest where possible bugs in it have been fixed. 135upgraded to the latest where possible bugs in it have been fixed.
136Typically OEMs provide this firmware from their support site. 136Typically OEMs provide this firmware from their support site.
137 137
138There is also a central site which has links where to download firmwares 138There is also a central site which has links where to download firmware
139for some machines: 139for some machines:
140 140
141 `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_ 141 `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_
142 142
143Before you upgrade firmware on a device or host, please make sure it is 143Before you upgrade firmware on a device or host, please make sure it is a
144the suitable. Failing to do that may render the device (or host) in a 144suitable upgrade. Failing to do that may render the device (or host) in a
145state where it cannot be used properly anymore without special tools! 145state where it cannot be used properly anymore without special tools!
146 146
147Host NVM upgrade on Apple Macs is not supported. 147Host NVM upgrade on Apple Macs is not supported.
@@ -151,7 +151,7 @@ Thunderbolt device so that the host controller appears. It does not
151matter which device is connected (unless you are upgrading NVM on a 151matter which device is connected (unless you are upgrading NVM on a
152device - then you need to connect that particular device). 152device - then you need to connect that particular device).
153 153
154Note OEM-specific method to power the controller up ("force power") may 154Note an OEM-specific method to power the controller up ("force power") may
155be available for your system in which case there is no need to plug in a 155be available for your system in which case there is no need to plug in a
156Thunderbolt device. 156Thunderbolt device.
157 157
@@ -171,7 +171,7 @@ it comes back the driver notices it and initiates a full power cycle.
171After a while the host controller appears again and this time it should 171After a while the host controller appears again and this time it should
172be fully functional. 172be fully functional.
173 173
174We can verify that the new NVM firmware is active by running following 174We can verify that the new NVM firmware is active by running the following
175commands:: 175commands::
176 176
177 # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate 177 # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate
@@ -179,38 +179,38 @@ commands::
179 # cat /sys/bus/thunderbolt/devices/0-0/nvm_version 179 # cat /sys/bus/thunderbolt/devices/0-0/nvm_version
180 18.0 180 18.0
181 181
182If ``nvm_authenticate`` contains anything else than 0x0 it is the error 182If ``nvm_authenticate`` contains anything other than 0x0 it is the error
183code from the last authentication cycle, which means the authentication 183code from the last authentication cycle, which means the authentication
184of the NVM image failed. 184of the NVM image failed.
185 185
186Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN`` 186Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN``
187depends on the order they are registered in the NVMem subsystem. N in 187depend on the order they are registered in the NVMem subsystem. N in
188the name is the identifier added by the NVMem subsystem. 188the name is the identifier added by the NVMem subsystem.
189 189
190Upgrading NVM when host controller is in safe mode 190Upgrading NVM when host controller is in safe mode
191-------------------------------------------------- 191--------------------------------------------------
192If the existing NVM is not properly authenticated (or is missing) the 192If the existing NVM is not properly authenticated (or is missing) the
193host controller goes into safe mode which means that only available 193host controller goes into safe mode which means that the only available
194functionality is flashing new NVM image. When in this mode the reading 194functionality is flashing a new NVM image. When in this mode, reading
195``nvm_version`` fails with ``ENODATA`` and the device identification 195``nvm_version`` fails with ``ENODATA`` and the device identification
196information is missing. 196information is missing.
197 197
198To recover from this mode, one needs to flash a valid NVM image to the 198To recover from this mode, one needs to flash a valid NVM image to the
199host host controller in the same way it is done in the previous chapter. 199host controller in the same way it is done in the previous chapter.
200 200
201Networking over Thunderbolt cable 201Networking over Thunderbolt cable
202--------------------------------- 202---------------------------------
203Thunderbolt technology allows software communication across two hosts 203Thunderbolt technology allows software communication between two hosts
204connected by a Thunderbolt cable. 204connected by a Thunderbolt cable.
205 205
206It is possible to tunnel any kind of traffic over Thunderbolt link but 206It is possible to tunnel any kind of traffic over a Thunderbolt link but
207currently we only support Apple ThunderboltIP protocol. 207currently we only support Apple ThunderboltIP protocol.
208 208
209If the other host is running Windows or macOS only thing you need to 209If the other host is running Windows or macOS, the only thing you need to
210do is to connect Thunderbolt cable between the two hosts, the 210do is to connect a Thunderbolt cable between the two hosts; the
211``thunderbolt-net`` is loaded automatically. If the other host is also 211``thunderbolt-net`` driver is loaded automatically. If the other host is
212Linux you should load ``thunderbolt-net`` manually on one host (it does 212also Linux you should load ``thunderbolt-net`` manually on one host (it
213not matter which one):: 213does not matter which one)::
214 214
215 # modprobe thunderbolt-net 215 # modprobe thunderbolt-net
216 216
@@ -220,12 +220,12 @@ is built-in to the kernel image, there is no need to do anything.
220The driver will create one virtual ethernet interface per Thunderbolt 220The driver will create one virtual ethernet interface per Thunderbolt
221port which are named like ``thunderbolt0`` and so on. From this point 221port which are named like ``thunderbolt0`` and so on. From this point
222you can either use standard userspace tools like ``ifconfig`` to 222you can either use standard userspace tools like ``ifconfig`` to
223configure the interface or let your GUI to handle it automatically. 223configure the interface or let your GUI handle it automatically.
224 224
225Forcing power 225Forcing power
226------------- 226-------------
227Many OEMs include a method that can be used to force the power of a 227Many OEMs include a method that can be used to force the power of a
228thunderbolt controller to an "On" state even if nothing is connected. 228Thunderbolt controller to an "On" state even if nothing is connected.
229If supported by your machine this will be exposed by the WMI bus with 229If supported by your machine this will be exposed by the WMI bus with
230a sysfs attribute called "force_power". 230a sysfs attribute called "force_power".
231 231