linux-kernel - Re: USB devices on Dell TB16 dock stop working after resuming

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Nov 2019 19:39:06 +0200
From:   Mika Westerberg <mika.westerberg@...ux.intel.com>
To:     Mario.Limonciello@...l.com
Cc:     pmenzel@...gen.mpg.de, andreas.noever@...il.com,
        michael.jamet@...el.com, YehezkelShB@...il.com, ck@...om.net,
        linux-kernel@...r.kernel.org, anthony.wong@...onical.com
Subject: Re: USB devices on Dell TB16 dock stop working after resuming

On Wed, Nov 20, 2019 at 05:06:39PM +0000, Mario.Limonciello@...l.com wrote:
> 
> > > Yeah it might be useful to enumerate all the BIOS settings that are selected
> > > related to Thunderbolt.  Some of them are a bit confusing.
> > 
> > BTW, I played a bit with 9380 and it looks like there is no option to
> > enable Preboot ACL which means that if you have TBT security enabled
> > (user or secure) the Dock PCIe side is not functional during boot, only
> > once the OS has booted up. That's fine unless you want to enter BIOS
> > menu from the keyboard you have connected to the TB16 dock (probably not
> > too common use case anyway).
> 
> Eh?  On 9380 in front of me:
> System Configuration -> Thunderbolt (TM) Adapter Configuration
> 
> There is a checkbox for "Enable Thunderbolt (and PCIe behind TBT) Pre-boot
> modules".  It's not checked by default, but that should turn on pre-boot ACL
> stuff.  That's the thing that Paul probably needs checked too.

Ah, it's that one :) I found it as well but did not realize it is the
Preboot ACL support. The "modules" at the end got me confused.

Yes, Paul that you need to enable if you want the devices behind the
dock to work before OS gets control.

> But I mean this is generally an unsafe (but convenient) option, it means that you
> throw out security pre-boot, and all someone needs to do is turn off your machine,
> plug in a malicious device, turn it on and then they have malicious device all the way
> into OS.

Yup.