Linux 5.12 To Support USB4 "Security Level 5" To Disable PCIe Tunneling

The USB4 / Thunderbolt changes slated for the upcoming Linux 5.12 merge window have been queued into the USB-next tree.

Queued into USB-next yesterday were the Thunderbolt changes from Intel for the next kernel window, which also include the latest USB4 work as part of it. One of the new security options with Linux 5.12 is supporting USB4's Security Level 5 (SL5). With this new security level, PCIe tunneling is disabled. This higher security level to disable PCI Express tunneling is normally a BIOS configuration option with supported USB4 hardware. This "nopcie" option is also being enforced when in the DisplayPort-only "dponly" mode.

The Linux kernel already supports Thunderbolt / USB4 security settings to require user approval to authorize new devices, automatically tunnel DisplayPort and USB only, USB only, and other authorization mechanisms to fend off potentially rogue devices attached to the system. Details on the latest Thunderbolt/USB4 security controls on Linux exposed via sysfs can be found via the newest documentation.

The Thunderbolt updates for Linux 5.12 also include support for ACPI 6.4's USB4 _OSC, support for disabling the XDomain protocol, and other minor changes.