linux-kernel - Re: [PATCH v3 00/36] thunderbolt: Software connection manager improvements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 1 Apr 2019 06:31:11 +0200
From:   Lukas Wunner <lukas@...ner.de>
To:     Mika Westerberg <mika.westerberg@...ux.intel.com>
Cc:     Mario.Limonciello@...l.com, linux-kernel@...r.kernel.org,
        michael.jamet@...el.com, YehezkelShB@...il.com,
        andreas.noever@...il.com, andriy.shevchenko@...ux.intel.com,
        ckellner@...hat.com
Subject: Re: [PATCH v3 00/36] thunderbolt: Software connection manager
 improvements

On Thu, Mar 28, 2019 at 06:56:21PM +0200, Mika Westerberg wrote:
> On Thu, Mar 28, 2019 at 03:17:57PM +0000, Mario.Limonciello@...l.com wrote:
> > > From: Mika Westerberg <mika.westerberg@...ux.intel.com>
> > > Sent: Thursday, March 28, 2019 7:36 AM
> > >   * Do not automatically create PCIe tunnels. Instead we implement "user"
> > >     security level in the software connection manager as well taking
> > >     advantage of the existing sysfs interfaces. This allows user to disable
> > >     PCIe tunneling completely or implement different white listing
> > >     policies. Major distros include bolt system daemon that takes care of
> > >     this.
> > 
> > This is a bit unfortunate.  Is this because of IOMMU limitations in working
> > with devices down the chain?
> 
> No, it just makes it possible to do things such as "disable all PCIe
> tunneling", like the master switch we have in GNOME UI.

It appears to be a change in behavior though as PCIe tunnels are
currently established automatically on Macs which don't use ICM.
The change might be considered breaking userspace, not sure.

Also on macOS it's just plug and play without any need to configure
whitelists or anything.

Thanks,

Lukas