CONTENTS

• Background
• Potential Problem
• Cause
• Mitigation / Correction
• Conclusion
  
  

   PRELIMINARY REMARKS

           The detail described in this document only affects Thunderbolt(TM) technologies.
           If you are using USB Type-C only connectivity then the information and procedures that follow will have little impact on your environment

       APPLICABLE MODELS

• Notebooks using Thunderbolt(TM) 3 or Thunderbolt(TM) 4 technology on WhiskeyLake platform or newer, such as Portege / Tecra X30-F, X30-G, X30W-J, X40-F, X40-G , X50-F or X50-G series.

       AFFECTED CUSTOMERS

• Only those wishing to use Thunderbolt(TM) LAN in either a PXE Boot environment or domain login by Thunderbolt(TM) LAN in a hot-desk environment

   BACKGROUND

With the introduction of Thunderbolt(TM) technology modern PCs now benefit from a level of extensibility that was not available to the previous generations. Such benefits include,
but are not limited to, a new class of external peripherals such as LAN connections, graphics cards and other PCI devices, all of which can be hot-plugged and accessed
in the same way as traditional USB devices we are all familiar with.
Historically the PCI bus was always internal to the system, i.e. a connector on a system board, but with the advent of Thunderbolt(TM) technology this PCI interface is effectively
available as an external connection. This instant benefit of usability and speed brings with it a concern over security: the PCI bus provides and requires Direct memory Addressing (DMA)
and with ports on the outside that are easily available the host PC becomes susceptible to "drive-by" DMA attacks.

As the Thunderbolt(TM) controller is a PCIe device and has Direct Memory Access (DMA) IO (via PCIe), this exposes the PCIe protocol externally through USB-C ports for a range of usages.
This can potentially allow access to system memory from a physical IO device that is being connected and utilising the PCIe protocol. In order to mitigate potential malicious access
to system memory from an external PCIe device, there is security protection employed with Thunderbolt(TM) 3 that prevents unauthorized Thunderbolt(TM) PCIe-based devices from
connecting without user authorization. For instance, this will prevent unauthorized access when the system is locked.
Microsoft and Intel collaboratively developed the hardware security solution , which offers Kernel DMA protection in line with specifications for Thunderbolt(TM) that offers protection against drive-by DMA attacks.

"A peripheral that is incompatible with DMA-remapping will be blocked from starting if the peripheral was plugged in before an authorised user logs in, or while the screen is locked.
Once the system is unlocked, the peripheral driver will be started by the OS and the peripheral will continue to perform normally until the system is rebooted, or the peripheral is unplugged.
The peripheral will continue to function normally if the user locks the screen or logs out of the system."

More details on this can be found via the Microsoft documentation site at https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt 

   POTENTIAL PROBLEM

Thunderbolt(TM) technology provides a connectivity port that offers PCI bus access and with it DMA access. The security procedures implemented by Intel and Microsoft, while securing the system,
have some "knock-on" effects to usability:

1. PXE Boot: PXE, or network, booting may not be possible with the BIOS defaults recommended by Intel and Microsoft. This is because at the early stage of booting the LAN connectivity via
   Thunderbolt(TM) may not be available. This can have an impact during OS deployment.
   
2. Thunderbolt(TM) device load/access: When in use booting to the OS sees no available LAN connection at the Windows Login screen when connected to a new or different Thunderbolt(TM) dock.
   The LAN connection only becomes available once the user has provided their Windows credentials and logged into the OS itself.

   CAUSE

   MITIGATION / CORRECTION

 ISSUE 1: PXE Boot

   Devices exceeding the requirements for enhanced hardware security will need to be degraded to standard / enhanced hardware security level.
   If you find PXE booting to not function then this may require the disabling of DMAr protection. The process to achieve this is as follows:

   Recommend process:

      Please download and use the Intel LAN driver for Toshiba Thunderbolt(TM) 3 Dock, which support DMAr function [ download location: https://emea.dynabook.com/support/drivers/laptops/ ]

   Alternative process:

1. Speak with your Dynabook representative and request a special BIOS.
2. Once obtained install the special BIOS to each device.
3. Make the necessary BIOS settings changes as recommended by your Dynabook representative.  

ISSUE 2: Thunderbolt Device Load/access

   On the newer platforms that attain Modern Standby and SL3 support it has been found that disabling "Native Thunderbolt support with RTD3" causes the notebook to fail
   to enter Modern Standby and power consumption to always remain adversely high. Compatibility and stability issues can also be seen with
   Thunderbolt(TM) devices resulting in a yellow bang error in Device Manager.

   This leaves the only mitigation steps to be either:

   a.) At each new connected Thunderbolt(TM) device or dock respond to the prompt in the OS regarding allowing the device to connect.
          This connection setting (if set to "always connect") will be remembered for each and every subsequent boot, with the host PC building up its own whitelist of accepted devices, or:
   b.) For device domain logon utilise either WiFi solutions, a USB LAN, or a LAN via a USB Type-C dock.

   CONCLUSION