Dom0 does not need Thunderbolt drivers

[DemiMarie]

Qubes OS version:

R4.0

Affected component(s):

Dom0 Kernel

---

Steps to reproduce the behavior:

Run find /lib/modules/4.14.18-1.pvops.qubes.x86_64/kernel/drivers/thunderbolt

Expected behavior:

No output or an error that the directory does not exist

Actual behavior:

Lots of output

General notes:

Dom0 does not need Thunderbolt drivers, and they increase attack surface in the event of a misconfiguration. That said, what VM are Thunderbolt devices currently assigned to?

---

Related issues:

[andrewdavidwong]

That said, what VM are Thunderbolt devices currently assigned to?

AFAIK, none: #2454

[andrewdavidwong]

That said, what VM are Thunderbolt devices currently assigned to?

AFAIK, none: #2454

[dylangerdaly]

I'm currently using my TB3 port on my XPS 13 to run my Display and Keyboard, will this mean I can no longer use an External Display in 4.1?

Many laptops are increasingly dropping Display IO for TB3.

I could be wrong in that Thunderbolt has nothing to do with Display?

[dylangerdaly]

I'm currently using my TB3 port on my XPS 13 to run my Display and Keyboard, will this mean I can no longer use an External Display in 4.1?

Many laptops are increasingly dropping Display IO for TB3.

I could be wrong in that Thunderbolt has nothing to do with Display?

[marmarek]

Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there?

[marmarek]

Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there?

[DemiMarie]

I, personally, would like to be able to run an external GPU over Thunderbolt and assign it to a VM. That means ensuring that the DMA engine in the Thunderbolt port can only access the memory assigned to the corresponding VM. On Jun 14, 2018 11:02 AM, "Marek Marczykowski-Górecki" < notifications@github.com> wrote: Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618 <#2618>). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB5XfIb1Fv2ti5utKBQggk_RmEgKYks5t8nr0gaJpZM4TLq9u> .

[DemiMarie]

I, personally, would like to be able to run an external GPU over Thunderbolt and assign it to a VM. That means ensuring that the DMA engine in the Thunderbolt port can only access the memory assigned to the corresponding VM. On Jun 14, 2018 11:02 AM, "Marek Marczykowski-Górecki" < notifications@github.com> wrote: Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618 <#2618>). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB5XfIb1Fv2ti5utKBQggk_RmEgKYks5t8nr0gaJpZM4TLq9u> .

[DemiMarie]

Yikes. Thunderbolt is vulnerable to a rDMA attack, as well as code execution during boot via option ROMs. We need to turn on UEFI Secure Boot for Qubes (which whitelists option ROMs, either by hash or by signing key), and ensure that the Thunderbird port is disabled until Qubes can configure the IOMMU to sandbox it.

…

On Thu, Jun 14, 2018, 9:45 PM Demi Obenour ***@***.***> wrote: I, personally, would like to be able to run an external GPU over Thunderbolt and assign it to a VM. That means ensuring that the DMA engine in the Thunderbolt port can only access the memory assigned to the corresponding VM. On Jun 14, 2018 11:02 AM, "Marek Marczykowski-Górecki" < ***@***.***> wrote: Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618 <#2618>). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB5XfIb1Fv2ti5utKBQggk_RmEgKYks5t8nr0gaJpZM4TLq9u> .

[DemiMarie]

Yikes. Thunderbolt is vulnerable to a rDMA attack, as well as code execution during boot via option ROMs. We need to turn on UEFI Secure Boot for Qubes (which whitelists option ROMs, either by hash or by signing key), and ensure that the Thunderbird port is disabled until Qubes can configure the IOMMU to sandbox it.

…

On Thu, Jun 14, 2018, 9:45 PM Demi Obenour ***@***.***> wrote: I, personally, would like to be able to run an external GPU over Thunderbolt and assign it to a VM. That means ensuring that the DMA engine in the Thunderbolt port can only access the memory assigned to the corresponding VM. On Jun 14, 2018 11:02 AM, "Marek Marczykowski-Górecki" < ***@***.***> wrote: Display over Thunderbolt is a tricky question but not because of its drivers shipped in dom0 or not, but because in 4.1 we plan to move the whole GUI handling out of dom0 (#2618 <#2618>). I wonder what that means in context of thunderbolt ports - would some additional device needs to be assigned there? What about non-display devices plugged there? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB5XfIb1Fv2ti5utKBQggk_RmEgKYks5t8nr0gaJpZM4TLq9u> .

[dylangerdaly]

@marmarek Ah this being sys-gpu or whatever it ends up being called, yeah I think TB3 for Display would be a requirement yeah? It's turning into the defacto standard for display, at least on newer laptops.

@DemiMarie I plan on doing the exact same thing for Fallout 76 (Windows HVM -- eGPU), Also it's my understanding Qubes isn't signing Kernel Releases / xen.efi because they don't trust the hardware (UEFI Firmware). But I do believe something is better than nothing, but also could offer false sense of Security?

[dylangerdaly]

@marmarek Ah this being sys-gpu or whatever it ends up being called, yeah I think TB3 for Display would be a requirement yeah? It's turning into the defacto standard for display, at least on newer laptops.

@DemiMarie I plan on doing the exact same thing for Fallout 76 (Windows HVM -- eGPU), Also it's my understanding Qubes isn't signing Kernel Releases / xen.efi because they don't trust the hardware (UEFI Firmware). But I do believe something is better than nothing, but also could offer false sense of Security?

[marmarek]

But I do believe something is better than nothing, but also could offer false sense of Security?

See this message and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security.

[marmarek]

But I do believe something is better than nothing, but also could offer false sense of Security?

See this message and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security.

[DemiMarie]

Does the initramfs need to be dynamically generated? Could there be a universal initramfs that just includes everything that could possibly be needed?

…

On Fri, Jun 15, 2018, 7:36 AM Marek Marczykowski-Górecki < ***@***.***> wrote: But I do believe something is better than nothing, but also could offer false sense of Security? See this message <https://groups.google.com/d/msgid/qubes-users/20180606094649.GH20125%40mail-itl> and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB72Sdh6m4hQQpAKwaJIP2DR_8o6Yks5t85xSgaJpZM4TLq9u> .

[DemiMarie]

Does the initramfs need to be dynamically generated? Could there be a universal initramfs that just includes everything that could possibly be needed?

…

On Fri, Jun 15, 2018, 7:36 AM Marek Marczykowski-Górecki < ***@***.***> wrote: But I do believe something is better than nothing, but also could offer false sense of Security? See this message <https://groups.google.com/d/msgid/qubes-users/20180606094649.GH20125%40mail-itl> and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB72Sdh6m4hQQpAKwaJIP2DR_8o6Yks5t85xSgaJpZM4TLq9u> .

[DemiMarie]

Also, secure boot *does* solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU. Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several.

…

On Fri, Jun 15, 2018, 7:36 AM Marek Marczykowski-Górecki < ***@***.***> wrote: But I do believe something is better than nothing, but also could offer false sense of Security? See this message <https://groups.google.com/d/msgid/qubes-users/20180606094649.GH20125%40mail-itl> and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB72Sdh6m4hQQpAKwaJIP2DR_8o6Yks5t85xSgaJpZM4TLq9u> .

[DemiMarie]

Also, secure boot *does* solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU. Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several.

…

On Fri, Jun 15, 2018, 7:36 AM Marek Marczykowski-Górecki < ***@***.***> wrote: But I do believe something is better than nothing, but also could offer false sense of Security? See this message <https://groups.google.com/d/msgid/qubes-users/20180606094649.GH20125%40mail-itl> and its thread. Signing just Xen/Kernel isn't enough for meaningful boot security. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB72Sdh6m4hQQpAKwaJIP2DR_8o6Yks5t85xSgaJpZM4TLq9u> .

[marmarek]

Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several.

I don't know. And really isn't a place for such discussion, better use qubes-devel maling list.

Also, secure boot does solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU.

Many BIOSes also have option to disable them until OS approve particular device, independently of Secure Boot.

[marmarek]

Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several.

I don't know. And really isn't a place for such discussion, better use qubes-devel maling list.

Also, secure boot does solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU.

Many BIOSes also have option to disable them until OS approve particular device, independently of Secure Boot.

[DemiMarie]

Good to know!!

…

On Sat, Jun 16, 2018, 7:07 PM Marek Marczykowski-Górecki < ***@***.***> wrote: Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several. I don't know. And really isn't a place for such discussion, better use qubes-devel maling list. Also, secure boot *does* solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU. Many BIOSes also have option to disable them until OS approve particular device, independently of Secure Boot. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB9EcGkRTcFDnkNQagsUwMtbZRNizks5t9Y-1gaJpZM4TLq9u> .

[DemiMarie]

Good to know!!

…

On Sat, Jun 16, 2018, 7:07 PM Marek Marczykowski-Górecki < ***@***.***> wrote: Another thought: could Thunderbolt be emulated over multiple USB 3 ports? Most systems have several. I don't know. And really isn't a place for such discussion, better use qubes-devel maling list. Also, secure boot *does* solve the problem I mentioned earlier (Thunderbolt option-ROM attacks). If the Thunderbolt port’s DMA engine is disabled until the OS takes control, we are safe, as we can use the IOMMU to sandbox the GPU. Many BIOSes also have option to disable them until OS approve particular device, independently of Secure Boot. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGGWB9EcGkRTcFDnkNQagsUwMtbZRNizks5t9Y-1gaJpZM4TLq9u> .