All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 00/24] Thunderbolt security levels and NVM firmware upgrade
@ 2017-05-18 14:38 Mika Westerberg
  2017-05-18 14:38 ` [PATCH 01/24] thunderbolt: Use const buffer pointer in write operations Mika Westerberg
                   ` (25 more replies)
  0 siblings, 26 replies; 106+ messages in thread
From: Mika Westerberg @ 2017-05-18 14:38 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Andreas Noever, Michael Jamet, Yehezkel Bernat, Lukas Wunner,
	Amir Levy, Andy Lutomirski, Mario.Limonciello, Jared.Dominguez,
	Andy Shevchenko, Mika Westerberg, linux-kernel

Hi all,

This patch series adds support for Thunderbolt security levels, which were
first introduced in Intel Falcon Ridge Thunderbolt controller, to prevent
DMA attacks when PCIe is tunneled over Thunderbolt fabric. This is needed
if there is no IOMMU available for various reasons.

Most PCs out there having Falcon Ridge or newer have security level set to
"user" which means that user authorization is needed before PCIe tunnel is
creaded (the PCIe device appears). This effectively means that without
driver support the user needs to configure security level from BIOS to
"none" to get Thunderbolt devices connected. With these patches the user
can authorize devices using sysfs attributes like:

  # echo 1 > /sys/bus/thunderbolt/devices/0-1/authorized

In addition these patches add support for upgrading NVM firmware running on
a host or device by running something like:

  # dd if=KYK_TBT_FW_0018.bin of=/sys/bus/thunderbolt/devices/0-0/nvm_non_active0/nvmem
  # echo 1 > /sys/bus/thunderbolt/devices/0-0/nvm_authenticate

This is documented with more details in patch [23/24].

This series is based on Amir's networking patches [1] but instead of
splitting the functionality between kernel driver and userspace daemon, we
take advantage of Linux driver core by converting the existing driver to
expose a Linux bus (domain) and devices (switches). Notifications to the
userspace about plugged/unplugged devices is handled by standard uevents
when a device is added to/removed from the Thunderbolt bus.

Since thunderbolt device identification and authorization can be done
directly through sysfs attributes there is no need for userspace daemon.
However, there still should be an application that promps user for unknown
devices and allows selecting between "single connect" and "connect always"
keeping this information in a database or similar persistent storage. This
patch series only provides mechanism for userspace applications to achieve
that.

Where Internal Connection Manager (ICM) firmware is available and usable,
we use it in the driver. This also includes newer Apple Macbooks with
Alpine Ridge. For older Macbooks the driver works as before but in addition
the Thunderbolt bus is available there as well (including possibility to
upgrade NVM firmware of connected devices).

We are also in works of porting Amir's networking driver to work on top of
the new Thunderbolt bus pretty much the same way firewire networking is
currently done. In addition this makes is possible to introduce other
protocols like a char device that allows userspace directly to communicate
accross Thunderbolt domains.

Note for Macs the Linux native PCIe hotplug support does not work well with
the Thunderbolt PCIe topologies where there is need to put all available
resources to the PCIe downstream port where the PCIe chain is extended.
This is something we need to fix. In the mean time is a way to work it
around by passing "pci=hpbussize=10,hpmemsize=2M" or so to the kernel
command line.

These patches use uuid_be from uuid.h but I've learned that there is a work
to remove the type completely in favor of new uuid_t [2]. I'm not sure what
to do regarding that because those patches are not yet in the mainline.

[1] https://lkml.org/lkml/2016/11/9/341
[2] http://git.infradead.org/users/hch/vfs.git/shortlog/refs/heads/uuid-types

Mika Westerberg (24):
  thunderbolt: Use const buffer pointer in write operations
  thunderbolt: Do not try to read UID if DROM offset is read as 0
  thunderbolt: Do not warn about newer DROM versions
  thunderbolt: Add MSI-X support
  thunderbolt: Rework capability handling
  thunderbolt: Introduce thunderbolt bus and connection manager
  thunderbolt: Convert switch to a device
  thunderbolt: Fail switch adding operation if reading DROM fails
  thunderbolt: Do not fail if DROM data CRC32 is invalid
  thunderbolt: Read vendor and device name from DROM
  thunderbolt: Move control channel messages to tb_msgs.h
  thunderbolt: Expose get_route() to other files
  thunderbolt: Expose make_header() to other files
  thunderbolt: Let the connection manager handle all notifications
  thunderbolt: Rework control channel to be more reliable
  thunderbolt: Add Thunderbolt 3 PCI IDs
  thunderbolt: Add support for NHI mailbox
  thunderbolt: Store Thunderbolt generation in the switch structure
  thunderbolt: Add support for DMA configuration based mailbox
  thunderbolt: Do not touch the hardware if the NHI is gone on resume
  thunderbolt: Add support for Internal Connection Manager (ICM)
  thunderbolt: Add support for host and device NVM firmware upgrade
  thunderbolt: Add documentation how Thunderbolt bus can be used
  MAINTAINERS: Add maintainers for Thunderbolt driver

 Documentation/ABI/testing/sysfs-bus-thunderbolt |  108 +++
 Documentation/admin-guide/index.rst             |    1 +
 Documentation/admin-guide/thunderbolt.rst       |  197 ++++
 MAINTAINERS                                     |    3 +
 drivers/thunderbolt/Kconfig                     |   13 +-
 drivers/thunderbolt/Makefile                    |    2 +-
 drivers/thunderbolt/cap.c                       |  169 ++--
 drivers/thunderbolt/ctl.c                       |  655 +++++++++----
 drivers/thunderbolt/ctl.h                       |  105 ++-
 drivers/thunderbolt/dma_port.c                  |  524 +++++++++++
 drivers/thunderbolt/dma_port.h                  |   34 +
 drivers/thunderbolt/domain.c                    |  455 ++++++++++
 drivers/thunderbolt/eeprom.c                    |   84 +-
 drivers/thunderbolt/icm.c                       | 1098 ++++++++++++++++++++++
 drivers/thunderbolt/nhi.c                       |  302 +++++-
 drivers/thunderbolt/nhi.h                       |   91 +-
 drivers/thunderbolt/nhi_regs.h                  |   27 +
 drivers/thunderbolt/switch.c                    | 1109 +++++++++++++++++++++--
 drivers/thunderbolt/tb.c                        |  237 ++---
 drivers/thunderbolt/tb.h                        |  242 ++++-
 drivers/thunderbolt/tb_msgs.h                   |  260 ++++++
 drivers/thunderbolt/tb_regs.h                   |   31 +-
 drivers/thunderbolt/tunnel_pci.c                |   17 +-
 23 files changed, 5213 insertions(+), 551 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-bus-thunderbolt
 create mode 100644 Documentation/admin-guide/thunderbolt.rst
 create mode 100644 drivers/thunderbolt/dma_port.c
 create mode 100644 drivers/thunderbolt/dma_port.h
 create mode 100644 drivers/thunderbolt/domain.c
 create mode 100644 drivers/thunderbolt/icm.c
 create mode 100644 drivers/thunderbolt/tb_msgs.h

-- 
2.11.0

^ permalink raw reply	[flat|nested] 106+ messages in thread

end of thread, other threads:[~2017-08-11 15:14 UTC | newest]

Thread overview: 106+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-18 14:38 [PATCH 00/24] Thunderbolt security levels and NVM firmware upgrade Mika Westerberg
2017-05-18 14:38 ` [PATCH 01/24] thunderbolt: Use const buffer pointer in write operations Mika Westerberg
2017-05-25 13:19   ` Greg Kroah-Hartman
2017-05-18 14:38 ` [PATCH 02/24] thunderbolt: Do not try to read UID if DROM offset is read as 0 Mika Westerberg
2017-05-21 13:46   ` Andreas Noever
2017-05-22  8:40     ` Mika Westerberg
2017-05-22 18:41       ` Andreas Noever
2017-05-22 20:38         ` Mika Westerberg
2017-05-22 20:57           ` Andreas Noever
2017-05-18 14:38 ` [PATCH 03/24] thunderbolt: Do not warn about newer DROM versions Mika Westerberg
2017-05-18 14:38 ` [PATCH 04/24] thunderbolt: Add MSI-X support Mika Westerberg
2017-05-21 17:51   ` Andreas Noever
2017-05-22  8:52     ` Mika Westerberg
2017-05-22 10:35       ` Bernat, Yehezkel
2017-05-22 11:01         ` Mika Westerberg
2017-05-18 14:38 ` [PATCH 05/24] thunderbolt: Rework capability handling Mika Westerberg
2017-05-18 16:38   ` Andy Shevchenko
2017-05-19  8:12     ` Mika Westerberg
2017-05-19 13:18       ` Andy Shevchenko
2017-05-21 19:09   ` Andreas Noever
2017-05-22  9:45     ` Mika Westerberg
2017-05-22  9:58       ` Levy, Amir (Jer)
2017-05-25  6:13     ` Lukas Wunner
2017-05-18 14:38 ` [PATCH 06/24] thunderbolt: Introduce thunderbolt bus and connection manager Mika Westerberg
2017-05-18 16:43   ` Andy Shevchenko
2017-05-19  8:15     ` Mika Westerberg
2017-05-19 13:16       ` Andy Shevchenko
2017-05-24 10:28   ` Lukas Wunner
2017-05-24 10:39     ` Mika Westerberg
2017-05-25 13:23   ` Greg Kroah-Hartman
2017-05-25 14:42     ` Mika Westerberg
2017-05-18 14:38 ` [PATCH 07/24] thunderbolt: Convert switch to a device Mika Westerberg
2017-05-18 16:49   ` Andy Shevchenko
2017-05-19  8:20     ` Mika Westerberg
2017-05-24 11:09   ` Lukas Wunner
2017-05-24 11:43     ` Mika Westerberg
2017-05-24 13:53       ` Lukas Wunner
2017-05-25  6:57         ` Mika Westerberg
2017-05-18 14:38 ` [PATCH 08/24] thunderbolt: Fail switch adding operation if reading DROM fails Mika Westerberg
2017-05-18 14:38 ` [PATCH 09/24] thunderbolt: Do not fail if DROM data CRC32 is invalid Mika Westerberg
2017-05-18 14:39 ` [PATCH 10/24] thunderbolt: Read vendor and device name from DROM Mika Westerberg
2017-05-18 19:19   ` Andy Shevchenko
2017-05-19  8:22     ` Mika Westerberg
2017-05-19 10:07   ` Lukas Wunner
2017-05-19 10:28     ` Mika Westerberg
2017-05-21  5:31       ` Lukas Wunner
2017-05-21  7:48         ` Mika Westerberg
2017-05-21  9:33           ` Lukas Wunner
2017-05-18 14:39 ` [PATCH 11/24] thunderbolt: Move control channel messages to tb_msgs.h Mika Westerberg
2017-05-18 14:39 ` [PATCH 12/24] thunderbolt: Expose get_route() to other files Mika Westerberg
2017-05-18 14:39 ` [PATCH 13/24] thunderbolt: Expose make_header() " Mika Westerberg
2017-05-18 14:39 ` [PATCH 14/24] thunderbolt: Let the connection manager handle all notifications Mika Westerberg
2017-05-24 14:00   ` Lukas Wunner
2017-05-25  7:02     ` Mika Westerberg
2017-05-18 14:39 ` [PATCH 15/24] thunderbolt: Rework control channel to be more reliable Mika Westerberg
2017-05-25 13:25   ` Greg Kroah-Hartman
2017-05-25 14:35     ` Mika Westerberg
2017-05-18 14:39 ` [PATCH 16/24] thunderbolt: Add Thunderbolt 3 PCI IDs Mika Westerberg
2017-05-18 14:39 ` [PATCH 17/24] thunderbolt: Add support for NHI mailbox Mika Westerberg
2017-05-18 14:39 ` [PATCH 18/24] thunderbolt: Store Thunderbolt generation in the switch structure Mika Westerberg
2017-05-21  4:47   ` Lukas Wunner
2017-05-21  5:29     ` Levy, Amir (Jer)
2017-05-21  5:35       ` Lukas Wunner
2017-05-21  7:40         ` Mika Westerberg
2017-05-21  8:00           ` Mika Westerberg
2017-05-21  8:07             ` Levy, Amir (Jer)
2017-05-21  9:55               ` Bernat, Yehezkel
2017-05-21 10:47                 ` Mika Westerberg
2017-05-21 11:18                   ` Bernat, Yehezkel
2017-05-21 11:47                     ` Mika Westerberg
2017-05-21 10:44               ` Mika Westerberg
2017-05-18 14:39 ` [PATCH 19/24] thunderbolt: Add support for DMA configuration based mailbox Mika Westerberg
2017-05-18 14:39 ` [PATCH 20/24] thunderbolt: Do not touch the hardware if the NHI is gone on resume Mika Westerberg
2017-05-24 14:43   ` Lukas Wunner
2017-05-25  7:10     ` Mika Westerberg
2017-05-18 14:39 ` [PATCH 21/24] thunderbolt: Add support for Internal Connection Manager (ICM) Mika Westerberg
2017-05-18 14:39 ` [PATCH 22/24] thunderbolt: Add support for host and device NVM firmware upgrade Mika Westerberg
2017-05-18 19:35   ` Andy Shevchenko
2017-05-19  8:26     ` Mika Westerberg
2017-05-25 13:28   ` Greg Kroah-Hartman
2017-05-25 14:39     ` Mika Westerberg
2017-05-25 14:57       ` Greg Kroah-Hartman
2017-05-18 14:39 ` [PATCH 23/24] thunderbolt: Add documentation how Thunderbolt bus can be used Mika Westerberg
2017-05-18 14:39 ` [PATCH 24/24] MAINTAINERS: Add maintainers for Thunderbolt driver Mika Westerberg
2017-05-19 16:35 ` [PATCH 00/24] Thunderbolt security levels and NVM firmware upgrade Mario.Limonciello
2017-05-19 17:19   ` Mika Westerberg
2017-05-19 17:54     ` Mario.Limonciello
2017-05-20  8:24       ` Mika Westerberg
2017-05-22 11:37         ` Mika Westerberg
2017-05-22 20:07           ` Mario.Limonciello
2017-05-22 20:10             ` Bernat, Yehezkel
2017-05-22 23:54               ` Mario.Limonciello
2017-05-22 20:48             ` Mika Westerberg
2017-05-23 17:30               ` Mario.Limonciello
2017-05-24 11:11                 ` Mika Westerberg
2017-05-24 19:06                   ` Mario.Limonciello
2017-05-24 19:32                     ` Jamet, Michael
2017-05-25  7:20                       ` mika.westerberg
2017-05-25  8:04                         ` mika.westerberg
2017-05-25 12:03                           ` mika.westerberg
2017-08-11 15:13                             ` mika.westerberg
2017-05-25  7:19                     ` Mika Westerberg
2017-05-19 18:00     ` Mika Westerberg
2017-05-20  9:15   ` Levy, Amir (Jer)
2017-05-21  8:08     ` mika.westerberg
2017-05-23 13:25 ` Andy Shevchenko

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.