Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1739235

RE: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI

Show all headers | View raw

> -----Original Message-----
> From: Pali Rohár [mailto:pali.rohar@gmail.com]
> Sent: Monday, September 25, 2017 12:49 PM
> To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> Cc: dvhart@infradead.org; linux-kernel@vger.kernel.org; platform-driver-
> x86@vger.kernel.org; quasisec@google.com
> Subject: Re: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI
> 
> On Monday 25 September 2017 16:32:52 Mario.Limonciello@dell.com wrote:
> > Hi Pali,
> >
> > > -----Original Message-----
> > > From: Pali Rohár [mailto:pali.rohar@gmail.com]
> > > Sent: Monday, September 25, 2017 12:14 PM
> > > To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> > > Cc: dvhart@infradead.org; LKML <linux-kernel@vger.kernel.org>; platform-
> driver-
> > > x86@vger.kernel.org; quasisec@google.com
> > > Subject: Re: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI
> > >
> > > On Thursday 21 September 2017 08:57:05 Mario Limonciello wrote:
> > > > The existing way that the dell-smbios helper module and associated
> > > > other drivers (dell-laptop, dell-wmi) communicate with the platform
> > > > really isn't secure.  It requires creating a buffer in physical
> > > > DMA32 memory space and passing that to the platform via SMM.
> > > >
> > > > Since the platform got a physical memory pointer, you've just got
> > > > to trust that the platform has only modified (and accessed) memory
> > > > within that buffer.
> > >
> > > And what is the problem? The whole memory management is done by kernel
> > > itself, so you already need to trust it.
> >
> > There's a lot of ifs, but it's not that crazy of a scenario.
> >
> > The problem is that if a malicious payload was delivered to the platform
> > and exercised a vulnerability in the platform code that payload could
> > potentially modify memory that it wasn't intended to modify and the OS
> > would not be aware as operating in SMM.
> >
> > >
> > > > Dell Platform designers recognize this security risk and offer a
> > > > safer way to communicate with the platform over ACPI.  This is
> > > > in turn exposed via a WMI interface to the OS.
> > >
> > > Hm... I cannot understand how some proprietary ACPI bytecode interpreted
> > > by kernel can be safer as kernel code itself.
> > >
> >
> > Inherently ACPI can only operate on operation regions and not physical memory.
> > Data passed into ACPI needs to be copied to an operation region for any ACPI
> > calls to use it.
> 
> But operation regions access is implemented by ACPI interpreter, which
> is again kernel code.

So isn't that making my point?
* Kernel can control operation region accessibility.  SMM can't operate outside
of this region.
* Direct SMI gives platform access to everything < 4G, kernel can't control this.

> 
> > Furthermore you can decompile the ASL and audit, you can't do this with direct
> > SMI/SMM.
> >
> > > Can you describe more details about this security risk?
> > >
> > > > When communicating over WMI-ACPI the communication doesn't occur
> > > > with physical memory pointers.  When the ASL is invoked, the fixed
> > > > length ACPI buffer is copied to a small operating region.  The ASL
> > > > will invoke the SMI, and SMM will only have access to this operating
> > > > region.  When the ASL returns the buffer is copied back for the OS
> > > > to process.
> > >
> > > If problem is in current kernel implementation, then it can be fixed.
> > >
> > >
> > > I'm not against using new WMI communication, but I cannot understand how
> > > kernel code itself is less safer as some other code which is interpreted
> > > by kernel. It does not make sense for me.
> > >
> >
> > Well we're talking hypotheticals here in the way things work.
> > There aren't necessarily problems with the current implementation.
> 
> Ok.
> 
> > Also, I didn't already mention this explicitly but I've alluded it to it;
> > Dell is deprecating that interface.  I can't say when, but it will stop working
> > on some new hardware at some point.
> >
> > That's the other reason why I'm pushing for the new communication path
> > now.
> 
> Ok, as I wrote I'm not against new communication method and specially
> now, when you confirmed that in future new machines would not support
> "old" method...
> 
> ... but old communication method should stay there for older machines. I
> do not think it would be hard to have both implementations in kernel and
> choosing that which is supported on current machine.

The WMI interface has been around for at least 10 years.  I think the number
of machines still running on the older implementation only is very small.

There is however a bit that will set the availability of this interface.  I'll rework
my patches to offer both WMI and legacy SMI approach based upon that
presence of the bit.

> 
> > > > This method of communication should also deprecate the usage of the
> > > > dcdbas kernel module and software dependent upon it's interface.
> > > > Instead offer a syfs interface for communicating with this ASL
> > > > method to allow userspace to use instead.
> > > >
> > > > To faciliate that needs for userspace and kernel space this patch
> > > > series introduces a generic way for WMI drivers to be able to
> > > > create character devices through the WMI bus when desired.
> > > > Requiring WMI drivers to explictly ask for this functionality will
> > > > act as an effective vendor whitelist.
> > >
> > > --
> > > Pali Rohár
> > > pali.rohar@gmail.com
> 
> --
> Pali Rohár
> pali.rohar@gmail.com

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 00/12] Introduce support for Dell SMBIOS over WMI Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
  [PATCH 08/12] platform/x86: wmi: Cleanup exit routine in reverse order of init Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
  [PATCH 02/12] platform/x86: dell-wmi: Don't match on descriptor GUID modalias Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
    Re: [PATCH 02/12] platform/x86: dell-wmi: Don't match on descriptor  GUID modalias Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:10 +0200
  [PATCH 04/12] platform/x86: dell-smbios: Switch to a WMI-ACPI interface Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
    Re: [PATCH 04/12] platform/x86: dell-smbios: Switch to a WMI-ACPI  interface Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:30 +0200
      RE: [PATCH 04/12] platform/x86: dell-smbios: Switch to a WMI-ACPI  interface <Mario.Limonciello@dell.com> - 2017-09-25 21:30 +0200
  [PATCH 12/12] platform/x86: Kconfig: Change the default settings for dell-wmi-smbios Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
  [PATCH 01/12] platform/x86: dell-wmi: label driver as handling notifications Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
    Re: [PATCH 01/12] platform/x86: dell-wmi: label driver as handling  notifications Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:10 +0200
      RE: [PATCH 01/12] platform/x86: dell-wmi: label driver as handling  notifications <Mario.Limonciello@dell.com> - 2017-09-25 22:20 +0200
  [PATCH 10/12] platform/x86: wmi: destroy on cleanup rather than unregister Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
  [PATCH 07/12] platform/x86: dell-wmi-smbios: Use Dell WMI descriptor check Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
    Re: [PATCH 07/12] platform/x86: dell-wmi-smbios: Use Dell WMI  descriptor check Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-09-21 18:50 +0200
      RE: [PATCH 07/12] platform/x86: dell-wmi-smbios: Use Dell WMI  descriptor check <Mario.Limonciello@dell.com> - 2017-09-21 23:00 +0200
  [PATCH 09/12] platform/x86: wmi: create character devices when requested by drivers Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:00 +0200
    Re: [PATCH 09/12] platform/x86: wmi: create character devices when  requested by drivers Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-09-21 18:50 +0200
      RE: [PATCH 09/12] platform/x86: wmi: create character devices when  requested by drivers <Mario.Limonciello@dell.com> - 2017-09-21 21:30 +0200
  [PATCH 03/12] platform/x86: dell-smbios: Add pr_fmt definition to driver Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:10 +0200
    Re: [PATCH 03/12] platform/x86: dell-smbios: Add pr_fmt definition to driver Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-09-21 18:30 +0200
    Re: [PATCH 03/12] platform/x86: dell-smbios: Add pr_fmt definition  to driver Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:10 +0200
  [PATCH 05/12] platform/x86: dell-smbios: rename to dell-wmi-smbios Mario Limonciello <mario.limonciello@dell.com> - 2017-09-21 16:10 +0200
  Re: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:20 +0200
    RE: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI <Mario.Limonciello@dell.com> - 2017-09-25 18:40 +0200
      Re: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI Pali Rohár <pali.rohar@gmail.com> - 2017-09-25 18:50 +0200
        RE: [PATCH 00/12] Introduce support for Dell SMBIOS over WMI <Mario.Limonciello@dell.com> - 2017-09-25 21:30 +0200

csiph-web