diff options
Diffstat (limited to 'Documentation/admin-guide/thunderbolt.rst')
| -rw-r--r-- | Documentation/admin-guide/thunderbolt.rst | 66 |
1 files changed, 33 insertions, 33 deletions
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst index 9b55952039a6..9948ec36a204 100644 --- a/Documentation/admin-guide/thunderbolt.rst +++ b/Documentation/admin-guide/thunderbolt.rst | |||
| @@ -3,13 +3,13 @@ | |||
| 3 | ============= | 3 | ============= |
| 4 | The interface presented here is not meant for end users. Instead there | 4 | The interface presented here is not meant for end users. Instead there |
| 5 | should be a userspace tool that handles all the low-level details, keeps | 5 | should be a userspace tool that handles all the low-level details, keeps |
| 6 | database of the authorized devices and prompts user for new connections. | 6 | a database of the authorized devices and prompts users for new connections. |
| 7 | 7 | ||
| 8 | More details about the sysfs interface for Thunderbolt devices can be | 8 | More details about the sysfs interface for Thunderbolt devices can be |
| 9 | found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``. | 9 | found in ``Documentation/ABI/testing/sysfs-bus-thunderbolt``. |
| 10 | 10 | ||
| 11 | Those users who just want to connect any device without any sort of | 11 | Those users who just want to connect any device without any sort of |
| 12 | manual work, can add following line to | 12 | manual work can add following line to |
| 13 | ``/etc/udev/rules.d/99-local.rules``:: | 13 | ``/etc/udev/rules.d/99-local.rules``:: |
| 14 | 14 | ||
| 15 | ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1" | 15 | ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1" |
| @@ -20,7 +20,7 @@ vulnerable to DMA attacks. | |||
| 20 | 20 | ||
| 21 | Security levels and how to use them | 21 | Security levels and how to use them |
| 22 | ----------------------------------- | 22 | ----------------------------------- |
| 23 | Starting from Intel Falcon Ridge Thunderbolt controller there are 4 | 23 | Starting with Intel Falcon Ridge Thunderbolt controller there are 4 |
| 24 | security levels available. The reason for these is the fact that the | 24 | security levels available. The reason for these is the fact that the |
| 25 | connected devices can be DMA masters and thus read contents of the host | 25 | connected devices can be DMA masters and thus read contents of the host |
| 26 | memory without CPU and OS knowing about it. There are ways to prevent | 26 | memory without CPU and OS knowing about it. There are ways to prevent |
| @@ -37,14 +37,14 @@ The security levels are as follows: | |||
| 37 | user | 37 | user |
| 38 | User is asked whether the device is allowed to be connected. | 38 | User is asked whether the device is allowed to be connected. |
| 39 | Based on the device identification information available through | 39 | Based on the device identification information available through |
| 40 | ``/sys/bus/thunderbolt/devices``. user then can do the decision. | 40 | ``/sys/bus/thunderbolt/devices``, the user then can make the decision. |
| 41 | In BIOS settings this is typically called *Unique ID*. | 41 | In BIOS settings this is typically called *Unique ID*. |
| 42 | 42 | ||
| 43 | secure | 43 | secure |
| 44 | User is asked whether the device is allowed to be connected. In | 44 | User is asked whether the device is allowed to be connected. In |
| 45 | addition to UUID the device (if it supports secure connect) is sent | 45 | addition to UUID the device (if it supports secure connect) is sent |
| 46 | a challenge that should match the expected one based on a random key | 46 | a challenge that should match the expected one based on a random key |
| 47 | written to ``key`` sysfs attribute. In BIOS settings this is | 47 | written to the ``key`` sysfs attribute. In BIOS settings this is |
| 48 | typically called *One time saved key*. | 48 | typically called *One time saved key*. |
| 49 | 49 | ||
| 50 | dponly | 50 | dponly |
| @@ -78,7 +78,7 @@ When a device is plugged in it will appear in sysfs as follows:: | |||
| 78 | /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff | 78 | /sys/bus/thunderbolt/devices/0-1/unique_id - e0376f00-0300-0100-ffff-ffffffffffff |
| 79 | 79 | ||
| 80 | The ``authorized`` attribute reads 0 which means no PCIe tunnels are | 80 | The ``authorized`` attribute reads 0 which means no PCIe tunnels are |
| 81 | created yet. The user can authorize the device by simply:: | 81 | created yet. The user can authorize the device by simply entering:: |
| 82 | 82 | ||
| 83 | # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized | 83 | # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized |
| 84 | 84 | ||
| @@ -86,7 +86,7 @@ This will create the PCIe tunnels and the device is now connected. | |||
| 86 | 86 | ||
| 87 | If the device supports secure connect, and the domain security level is | 87 | If the device supports secure connect, and the domain security level is |
| 88 | set to ``secure``, it has an additional attribute ``key`` which can hold | 88 | set to ``secure``, it has an additional attribute ``key`` which can hold |
| 89 | a random 32 byte value used for authorization and challenging the device in | 89 | a random 32-byte value used for authorization and challenging the device in |
| 90 | future connects:: | 90 | future connects:: |
| 91 | 91 | ||
| 92 | /sys/bus/thunderbolt/devices/0-3/authorized - 0 | 92 | /sys/bus/thunderbolt/devices/0-3/authorized - 0 |
| @@ -99,12 +99,12 @@ future connects:: | |||
| 99 | 99 | ||
| 100 | Notice the key is empty by default. | 100 | Notice the key is empty by default. |
| 101 | 101 | ||
| 102 | If the user does not want to use secure connect it can just ``echo 1`` | 102 | If the user does not want to use secure connect they can just ``echo 1`` |
| 103 | to the ``authorized`` attribute and the PCIe tunnels will be created in | 103 | to the ``authorized`` attribute and the PCIe tunnels will be created in |
| 104 | the same way than in ``user`` security level. | 104 | the same way as in the ``user`` security level. |
| 105 | 105 | ||
| 106 | If the user wants to use secure connect, the first time the device is | 106 | If the user wants to use secure connect, the first time the device is |
| 107 | plugged a key needs to be created and send to the device:: | 107 | plugged a key needs to be created and sent to the device:: |
| 108 | 108 | ||
| 109 | # key=$(openssl rand -hex 32) | 109 | # key=$(openssl rand -hex 32) |
| 110 | # echo $key > /sys/bus/thunderbolt/devices/0-3/key | 110 | # echo $key > /sys/bus/thunderbolt/devices/0-3/key |
| @@ -121,27 +121,27 @@ device using the same key:: | |||
| 121 | 121 | ||
| 122 | If the challenge the device returns back matches the one we expect based | 122 | If the challenge the device returns back matches the one we expect based |
| 123 | on the key, the device is connected and the PCIe tunnels are created. | 123 | on the key, the device is connected and the PCIe tunnels are created. |
| 124 | However, if the challenge failed no tunnels are created and error is | 124 | However, if the challenge fails no tunnels are created and error is |
| 125 | returned to the user. | 125 | returned to the user. |
| 126 | 126 | ||
| 127 | If the user still wants to connect the device it can either approve | 127 | If the user still wants to connect the device they can either approve |
| 128 | the device without a key or write new key and write 1 to the | 128 | the device without a key or write a new key and write 1 to the |
| 129 | ``authorized`` file to get the new key stored on the device NVM. | 129 | ``authorized`` file to get the new key stored on the device NVM. |
| 130 | 130 | ||
| 131 | Upgrading NVM on Thunderbolt device or host | 131 | Upgrading NVM on Thunderbolt device or host |
| 132 | ------------------------------------------- | 132 | ------------------------------------------- |
| 133 | Since most of the functionality is handled in a firmware running on a | 133 | Since most of the functionality is handled in firmware running on a |
| 134 | host controller or a device, it is important that the firmware can be | 134 | host controller or a device, it is important that the firmware can be |
| 135 | upgraded to the latest where possible bugs in it have been fixed. | 135 | upgraded to the latest where possible bugs in it have been fixed. |
| 136 | Typically OEMs provide this firmware from their support site. | 136 | Typically OEMs provide this firmware from their support site. |
| 137 | 137 | ||
| 138 | There is also a central site which has links where to download firmwares | 138 | There is also a central site which has links where to download firmware |
| 139 | for some machines: | 139 | for some machines: |
| 140 | 140 | ||
| 141 | `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_ | 141 | `Thunderbolt Updates <https://thunderbolttechnology.net/updates>`_ |
| 142 | 142 | ||
| 143 | Before you upgrade firmware on a device or host, please make sure it is | 143 | Before you upgrade firmware on a device or host, please make sure it is a |
| 144 | the suitable. Failing to do that may render the device (or host) in a | 144 | suitable upgrade. Failing to do that may render the device (or host) in a |
| 145 | state where it cannot be used properly anymore without special tools! | 145 | state where it cannot be used properly anymore without special tools! |
| 146 | 146 | ||
| 147 | Host NVM upgrade on Apple Macs is not supported. | 147 | Host NVM upgrade on Apple Macs is not supported. |
| @@ -151,7 +151,7 @@ Thunderbolt device so that the host controller appears. It does not | |||
| 151 | matter which device is connected (unless you are upgrading NVM on a | 151 | matter which device is connected (unless you are upgrading NVM on a |
| 152 | device - then you need to connect that particular device). | 152 | device - then you need to connect that particular device). |
| 153 | 153 | ||
| 154 | Note OEM-specific method to power the controller up ("force power") may | 154 | Note an OEM-specific method to power the controller up ("force power") may |
| 155 | be available for your system in which case there is no need to plug in a | 155 | be available for your system in which case there is no need to plug in a |
| 156 | Thunderbolt device. | 156 | Thunderbolt device. |
| 157 | 157 | ||
| @@ -171,7 +171,7 @@ it comes back the driver notices it and initiates a full power cycle. | |||
| 171 | After a while the host controller appears again and this time it should | 171 | After a while the host controller appears again and this time it should |
| 172 | be fully functional. | 172 | be fully functional. |
| 173 | 173 | ||
| 174 | We can verify that the new NVM firmware is active by running following | 174 | We can verify that the new NVM firmware is active by running the following |
| 175 | commands:: | 175 | commands:: |
| 176 | 176 | ||
| 177 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate | 177 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_authenticate |
| @@ -179,38 +179,38 @@ commands:: | |||
| 179 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_version | 179 | # cat /sys/bus/thunderbolt/devices/0-0/nvm_version |
| 180 | 18.0 | 180 | 18.0 |
| 181 | 181 | ||
| 182 | If ``nvm_authenticate`` contains anything else than 0x0 it is the error | 182 | If ``nvm_authenticate`` contains anything other than 0x0 it is the error |
| 183 | code from the last authentication cycle, which means the authentication | 183 | code from the last authentication cycle, which means the authentication |
| 184 | of the NVM image failed. | 184 | of the NVM image failed. |
| 185 | 185 | ||
| 186 | Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN`` | 186 | Note names of the NVMem devices ``nvm_activeN`` and ``nvm_non_activeN`` |
| 187 | depends on the order they are registered in the NVMem subsystem. N in | 187 | depend on the order they are registered in the NVMem subsystem. N in |
| 188 | the name is the identifier added by the NVMem subsystem. | 188 | the name is the identifier added by the NVMem subsystem. |
| 189 | 189 | ||
| 190 | Upgrading NVM when host controller is in safe mode | 190 | Upgrading NVM when host controller is in safe mode |
| 191 | -------------------------------------------------- | 191 | -------------------------------------------------- |
| 192 | If the existing NVM is not properly authenticated (or is missing) the | 192 | If the existing NVM is not properly authenticated (or is missing) the |
| 193 | host controller goes into safe mode which means that only available | 193 | host controller goes into safe mode which means that the only available |
| 194 | functionality is flashing new NVM image. When in this mode the reading | 194 | functionality is flashing a new NVM image. When in this mode, reading |
| 195 | ``nvm_version`` fails with ``ENODATA`` and the device identification | 195 | ``nvm_version`` fails with ``ENODATA`` and the device identification |
| 196 | information is missing. | 196 | information is missing. |
| 197 | 197 | ||
| 198 | To recover from this mode, one needs to flash a valid NVM image to the | 198 | To recover from this mode, one needs to flash a valid NVM image to the |
| 199 | host host controller in the same way it is done in the previous chapter. | 199 | host controller in the same way it is done in the previous chapter. |
| 200 | 200 | ||
| 201 | Networking over Thunderbolt cable | 201 | Networking over Thunderbolt cable |
| 202 | --------------------------------- | 202 | --------------------------------- |
| 203 | Thunderbolt technology allows software communication across two hosts | 203 | Thunderbolt technology allows software communication between two hosts |
| 204 | connected by a Thunderbolt cable. | 204 | connected by a Thunderbolt cable. |
| 205 | 205 | ||
| 206 | It is possible to tunnel any kind of traffic over Thunderbolt link but | 206 | It is possible to tunnel any kind of traffic over a Thunderbolt link but |
| 207 | currently we only support Apple ThunderboltIP protocol. | 207 | currently we only support Apple ThunderboltIP protocol. |
| 208 | 208 | ||
| 209 | If the other host is running Windows or macOS only thing you need to | 209 | If the other host is running Windows or macOS, the only thing you need to |
| 210 | do is to connect Thunderbolt cable between the two hosts, the | 210 | do is to connect a Thunderbolt cable between the two hosts; the |
| 211 | ``thunderbolt-net`` is loaded automatically. If the other host is also | 211 | ``thunderbolt-net`` driver is loaded automatically. If the other host is |
| 212 | Linux you should load ``thunderbolt-net`` manually on one host (it does | 212 | also Linux you should load ``thunderbolt-net`` manually on one host (it |
| 213 | not matter which one):: | 213 | does not matter which one):: |
| 214 | 214 | ||
| 215 | # modprobe thunderbolt-net | 215 | # modprobe thunderbolt-net |
| 216 | 216 | ||
| @@ -220,12 +220,12 @@ is built-in to the kernel image, there is no need to do anything. | |||
| 220 | The driver will create one virtual ethernet interface per Thunderbolt | 220 | The driver will create one virtual ethernet interface per Thunderbolt |
| 221 | port which are named like ``thunderbolt0`` and so on. From this point | 221 | port which are named like ``thunderbolt0`` and so on. From this point |
| 222 | you can either use standard userspace tools like ``ifconfig`` to | 222 | you can either use standard userspace tools like ``ifconfig`` to |
| 223 | configure the interface or let your GUI to handle it automatically. | 223 | configure the interface or let your GUI handle it automatically. |
| 224 | 224 | ||
| 225 | Forcing power | 225 | Forcing power |
| 226 | ------------- | 226 | ------------- |
| 227 | Many OEMs include a method that can be used to force the power of a | 227 | Many OEMs include a method that can be used to force the power of a |
| 228 | thunderbolt controller to an "On" state even if nothing is connected. | 228 | Thunderbolt controller to an "On" state even if nothing is connected. |
| 229 | If supported by your machine this will be exposed by the WMI bus with | 229 | If supported by your machine this will be exposed by the WMI bus with |
| 230 | a sysfs attribute called "force_power". | 230 | a sysfs attribute called "force_power". |
| 231 | 231 | ||
