diff options
author | Randy Dunlap <rdunlap@infradead.org> | 2018-01-27 21:49:08 -0500 |
---|---|---|
committer | Jonathan Corbet <corbet@lwn.net> | 2018-02-01 14:50:01 -0500 |
commit | 54e36a2dc554685463af54b4ac97a5ec022bd09c (patch) | |
tree | 0f08063bfe581ea0c94cb60adbdddf5ee3d54467 | |
parent | 9124bb8760c16bc7689dd26a5ab98a231765309f (diff) |
Documentation/admin-guide: fixes for thunderbolt.rst
Edits for grammar, punctuation, and a doubled-up word.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Andreas Noever <andreas.noever@gmail.com>
Cc: Michael Jamet <michael.jamet@intel.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Yehezkel Bernat <yehezkel.bernat@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
-rw-r--r-- | Documentation/admin-guide/thunderbolt.rst | 66 |
1 files changed, 33 insertions, 33 deletions
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst index 9b55952039a6..9948ec36a204 100644 --- a/Documentation/admin-guide/thunderbolt.rst +++ b/Documentation/admin-guide/thunderbolt.rst | |||
@@ -3,13 +3,13 @@ | |||
3 | ============= | 3 | ============= |
4 | The interface presented here is not meant for end users. Instead there | 4 | The interface presented here is not meant for end users. Instead there |
5 | should be a userspace tool that handles all the low-level details, keeps | 5 | should be a userspace tool that handles all the low-level details, keeps |
6 | database of the authorized devices and prompts user for new connections. | 6 | a database of the authorized devices and prompts users for new connections. |
7 | 7 | ||
8 | More details about the sysfs interface for Thunderbolt devices can be | 8 | More details about the sysfs interface for Thunderbolt devices can be |
9 | found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``. | 9 | found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``. |
10 | 10 | ||
11 | Those users who just want to connect any device without any sort of | 11 | Those users who just want to connect any device without any sort of |
12 | manual work, can add following line to | 12 | manual work can add following line to |
13 | ``/etc/udev/rules.d/99-local.rules``:: | 13 | ``/etc/udev/rules.d/99-local.rules``:: |
14 | 14 | ||
15 | ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1" | 15 | ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1" |
@@ -20,7 +20,7 @@ vulnerable to DMA attacks. | |||
20 | 20 | ||
21 | Security levels and how to use them | 21 | Security levels and how to use them |
22 | ----------------------------------- | 22 | ----------------------------------- |
23 | Starting from Intel Falcon Ridge Thunderbolt controller there are 4 | 23 | Starting with Intel Falcon Ridge Thunderbolt controller there are 4 |
24 | security levels available. The reason for these is the fact that the | 24 | security levels available. The reason for these is the fact that the |
25 | connected devices can be DMA masters and thus read contents of the host | 25 | connected devices can be DMA masters and thus read contents of the host |
26 | memory without CPU and OS knowing about it. There are ways to prevent | 26 | memory without CPU and OS knowing about it. There are ways to prevent |
@@ -37,14 +37,14 @@ The security levels are as follows: | |||
37 | user | 37 | user |
38 | User is asked whether the device is allowed to be connected. | 38 | User is asked whether the device is allowed to be connected. |
39 | Based on the device identification information available through | 39 | Based on the device identification information available through |
40 | ``/sys/bus/thunderbolt/devices``. user then can do the decision. | 40 | ``/sys/bus/thunderbolt/devices``, the user then can make the decision. |
41 | In BIOS settings this is typically called *Unique ID*. | 41 | In BIOS settings this is typically called *Unique ID*. |
42 | 42 | ||
43 | secure | 43 | secure |
44 | User is asked whether the device is allowed to be connected. In | 44 | User is asked whether the device is allowed to be connected. In |
45 | addition to UUID the device (if it supports secure connect) is sent | 45 | addition to UUID the device (if it supports secure connect) is sent |
46 | a challenge that should match the expected one based on a random key | 46 | a challenge that should match the expected one based on a random key |
47 | written to ``key`` sysfs attribute. In BIOS settings this is | 47 | written to the ``key`` sysfs attribute. In BIOS settings this is |
48 | typically called *One time saved key*. | 48 | typically called *One time saved key*. |
49 | 49 | ||
50 | dponly | 50 | dponly |
@@ -78,7 +78,7 @@ When a device is plugged in it will appear in sysfs as follows:: | |||
78 | /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff | 78 | /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff |
79 | 79 | ||
80 | The ``authorized`` attribute reads 0 which means no PCIe tunnels are | 80 | The ``authorized`` attribute reads 0 which means no PCIe tunnels are |
81 | created yet. The user can authorize the device by simply:: | 81 | created yet. The user can authorize the device by simply entering:: |
82 | 82 | ||
83 | # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized | 83 | # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized |
84 | 84 | ||
@@ -86,7 +86,7 @@ This will create the PCIe tunnels and the device is now connected. | |||
86 | 86 | ||
87 | If the device supports secure connect, and the domain security level is | 87 | If the device supports secure connect, and the domain security level is |
88 | set to ``secure``, it has an additional attribute ``key`` which can hold | 88 | set to ``secure``, it has an additional attribute ``key`` which can hold |
89 | a random 32 byte value used for authorization and challenging the device in | 89 | a random 32-byte value used for authorization and challenging the device in |
90 | future connects:: | 90 | future connects:: |
91 | 91 | ||
92 | /sys/bus/thunderbolt/devices/0-3/authorized - 0 | 92 | /sys/bus/thunderbolt/devices/0-3/authorized - 0 |
@@ -99,12 +99,12 @@ future connects:: | |||
99 | 99 | ||
100 | Notice the key is empty by default. | 100 | Notice the key is empty by default. |
101 | 101 | ||
102 | If the user does not want to use secure connect it can just ``echo 1`` | 102 | If the user does not want to use secure connect they can just ``echo 1`` |
103 | to the ``authorized`` attribute and the PCIe tunnels will be created in | 103 | to the ``authorized`` attribute and the PCIe tunnels will be created in |
104 | the same way than in ``user`` security level. | 104 | the same way as in the ``user`` security level. |
105 | 105 | ||
106 | If the user wants to use secure connect, the first time the device is | 106 | If the user wants to use secure connect, the first time the device is |
107 | plugged a key needs to be created and send to the device:: | 107 | plugged a key needs to be created and sent to the device:: |
108 | 108 | ||
109 | # key=$(openssl rand -hex 32) | 109 | # key=$(openssl rand -hex 32) |
110 | # echo $key > /sys/bus/thunderbolt/devices/0-3/key | 110 | # echo $key > /sys/bus/thunderbolt/devices/0-3/key |
@@ -121,27 +121,27 @@ device using the same key:: | |||
121 | 121 | ||
122 | If the challenge the device returns back matches the one we expect based | 122 | If the challenge the device returns back matches the one we expect based |
123 | on the key, the device is connected and the PCIe tunnels are created. | 123 | on the key, the device is connected and the PCIe tunnels are created. |
124 | However, if the challenge failed no tunnels are created and error is | 124 | However, if the challenge fails no tunnels are created and error is |
125 | returned to the user. | 125 | returned to the user. |
126 | 126 | ||
127 | If the user still wants to connect the device it can either approve | 127 | If the user still wants to connect the device they can either approve |
128 | the device without a key or write new key and write 1 to the | 128 | the device without a key or write a new key and write 1 to the |
129 | ``authorized`` file to get the new key stored on the device NVM. | 129 | ``authorized`` file to get the new key stored on the device NVM. |
130 | 130 | ||
131 | Upgrading NVM on Thunderbolt device or host | 131 | Upgrading NVM on Thunderbolt device or host |
132 | ------------------------------------------- | 132 | ------------------------------------------- |
133 | Since most of the functionality is handled in a firmware running on a | 133 | Since most of the functionality is handled in firmware running on a |
134 | host controller or a device, it is important that the firmware can be | 134 | host controller or a device, it is important that the firmware can be |
135 | upgraded to the latest where possible bugs in it have been fixed. | 135 | upgraded to the latest where possible bugs in it have been fixed. |
136 | Typically OEMs provide this firmware from their support site. | 136 | Typically OEMs provide this firmware from their support site. |
137 | 137 | ||
138 | There is also a central site which has links where to download firmwares | 138 | There is also a central site which has links where to download firmware |
139 | for some machines: | 139 | for some machines: |
140 | 140 | ||
141 | `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_ | 141 | `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_ |
142 | 142 | ||
143 | Before you upgrade firmware on a device or host, please make sure it is | 143 | Before you upgrade firmware on a device or host, please make sure it is a |
144 | the suitable. Failing to do that may render the device (or host) in a | 144 | suitable upgrade. Failing to do that may render the device (or host) in a |
145 | state where it cannot be used properly anymore without special tools! | 145 | state where it cannot be used properly anymore without special tools! |
146 | 146 | ||
147 | Host NVM upgrade on Apple Macs is not supported. | 147 | Host NVM upgrade on Apple Macs is not supported. |
@@ -151,7 +151,7 @@ Thunderbolt device so that the host controller appears. It does not | |||
151 | matter which device is connected (unless you are upgrading NVM on a | 151 | matter which device is connected (unless you are upgrading NVM on a |
152 | device - then you need to connect that particular device). | 152 | device - then you need to connect that particular device). |
153 | 153 | ||
154 | Note OEM-specific method to power the controller up ("force power") may | 154 | Note an OEM-specific method to power the controller up ("force power") may |
155 | be available for your system in which case there is no need to plug in a | 155 | be available for your system in which case there is no need to plug in a |
156 | Thunderbolt device. | 156 | Thunderbolt device. |
157 | 157 | ||
@@ -171,7 +171,7 @@ it comes back the driver notices it and initiates a full power cycle. | |||
171 | After a while the host controller appears again and this time it should | 171 | After a while the host controller appears again and this time it should |
172 | be fully functional. | 172 | be fully functional. |
173 | 173 | ||
174 | We can verify that the new NVM firmware is active by running following | 174 | We can verify that the new NVM firmware is active by running the following |
175 | commands:: | 175 | commands:: |
176 | 176 | ||
177 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate | 177 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate |
@@ -179,38 +179,38 @@ commands:: | |||
179 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_version | 179 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_version |
180 | 18.0 | 180 | 18.0 |
181 | 181 | ||
182 | If ``nvm_authenticate`` contains anything else than 0x0 it is the error | 182 | If ``nvm_authenticate`` contains anything other than 0x0 it is the error |
183 | code from the last authentication cycle, which means the authentication | 183 | code from the last authentication cycle, which means the authentication |
184 | of the NVM image failed. | 184 | of the NVM image failed. |
185 | 185 | ||
186 | Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN`` | 186 | Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN`` |
187 | depends on the order they are registered in the NVMem subsystem. N in | 187 | depend on the order they are registered in the NVMem subsystem. N in |
188 | the name is the identifier added by the NVMem subsystem. | 188 | the name is the identifier added by the NVMem subsystem. |
189 | 189 | ||
190 | Upgrading NVM when host controller is in safe mode | 190 | Upgrading NVM when host controller is in safe mode |
191 | -------------------------------------------------- | 191 | -------------------------------------------------- |
192 | If the existing NVM is not properly authenticated (or is missing) the | 192 | If the existing NVM is not properly authenticated (or is missing) the |
193 | host controller goes into safe mode which means that only available | 193 | host controller goes into safe mode which means that the only available |
194 | functionality is flashing new NVM image. When in this mode the reading | 194 | functionality is flashing a new NVM image. When in this mode, reading |
195 | ``nvm_version`` fails with ``ENODATA`` and the device identification | 195 | ``nvm_version`` fails with ``ENODATA`` and the device identification |
196 | information is missing. | 196 | information is missing. |
197 | 197 | ||
198 | To recover from this mode, one needs to flash a valid NVM image to the | 198 | To recover from this mode, one needs to flash a valid NVM image to the |
199 | host host controller in the same way it is done in the previous chapter. | 199 | host controller in the same way it is done in the previous chapter. |
200 | 200 | ||
201 | Networking over Thunderbolt cable | 201 | Networking over Thunderbolt cable |
202 | --------------------------------- | 202 | --------------------------------- |
203 | Thunderbolt technology allows software communication across two hosts | 203 | Thunderbolt technology allows software communication between two hosts |
204 | connected by a Thunderbolt cable. | 204 | connected by a Thunderbolt cable. |
205 | 205 | ||
206 | It is possible to tunnel any kind of traffic over Thunderbolt link but | 206 | It is possible to tunnel any kind of traffic over a Thunderbolt link but |
207 | currently we only support Apple ThunderboltIP protocol. | 207 | currently we only support Apple ThunderboltIP protocol. |
208 | 208 | ||
209 | If the other host is running Windows or macOS only thing you need to | 209 | If the other host is running Windows or macOS, the only thing you need to |
210 | do is to connect Thunderbolt cable between the two hosts, the | 210 | do is to connect a Thunderbolt cable between the two hosts; the |
211 | ``thunderbolt-net`` is loaded automatically. If the other host is also | 211 | ``thunderbolt-net`` driver is loaded automatically. If the other host is |
212 | Linux you should load ``thunderbolt-net`` manually on one host (it does | 212 | also Linux you should load ``thunderbolt-net`` manually on one host (it |
213 | not matter which one):: | 213 | does not matter which one):: |
214 | 214 | ||
215 | # modprobe thunderbolt-net | 215 | # modprobe thunderbolt-net |
216 | 216 | ||
@@ -220,12 +220,12 @@ is built-in to the kernel image, there is no need to do anything. | |||
220 | The driver will create one virtual ethernet interface per Thunderbolt | 220 | The driver will create one virtual ethernet interface per Thunderbolt |
221 | port which are named like ``thunderbolt0`` and so on. From this point | 221 | port which are named like ``thunderbolt0`` and so on. From this point |
222 | you can either use standard userspace tools like ``ifconfig`` to | 222 | you can either use standard userspace tools like ``ifconfig`` to |
223 | configure the interface or let your GUI to handle it automatically. | 223 | configure the interface or let your GUI handle it automatically. |
224 | 224 | ||
225 | Forcing power | 225 | Forcing power |
226 | ------------- | 226 | ------------- |
227 | Many OEMs include a method that can be used to force the power of a | 227 | Many OEMs include a method that can be used to force the power of a |
228 | thunderbolt controller to an "On" state even if nothing is connected. | 228 | Thunderbolt controller to an "On" state even if nothing is connected. |
229 | If supported by your machine this will be exposed by the WMI bus with | 229 | If supported by your machine this will be exposed by the WMI bus with |
230 | a sysfs attribute called "force_power". | 230 | a sysfs attribute called "force_power". |
231 | 231 | ||