From: <Mario.Limonciello@dell.com>
To: <luto@kernel.org>
CC: <dvhart@infradead.org>, <kernel@kempniu.pl>, <rjw@rjwysocki.net>,
        <len.brown@intel.com>, <pali.rohar@gmail.com>,
        <corentin.chary@gmail.com>, <andriy.shevchenko@linux.intel.com>,
        <linux-kernel@vger.kernel.org>, <platform-driver-x86@vger.kernel.org>,
        <linux-pm@vger.kernel.org>
Subject: RE: RFC: WMI Enhancements
Thread-Topic: RFC: WMI Enhancements
Thread-Index: AQHSs+HFfWGz3Na/pUazu2XvXvLesqHDPEIAgACGNAD//7EgQIAAVeQA//+siQCAAGaUgP//tIPwAArEfwAACnGroA==
Date: Thu, 13 Apr 2017 17:49:49 +0000
Message-ID: <aa3f1a45fa424c96a387082a8c79042b@ausx13mpc120.AMER.DELL.COM>
References: <20170412230854.GA11963@fury>
 <20170413073228.GB1462@ozzy.nask.waw.pl>
 <CALCETrXkx2QqDtKmajywpvtxqCXzrQ3nuW0aOeY6+Uxa-LOXiQ@mail.gmail.com>
 <dffeb42986e84887b2556987925dbf31@ausx13mpc120.AMER.DELL.COM>
 <CALCETrX8W7Zi2NTAm4kJFbW14HVSYanYQ5sGo78FTgitcWfwAw@mail.gmail.com>
 <0d4e6c4562fb4b85ad4c368ae73dbe06@ausx13mpc120.AMER.DELL.COM>
 <20170413170619.GF2064@fury>
 <b729acdb12d046d3a27c754ff02482d6@ausx13mpc120.AMER.DELL.COM>
 <CALCETrXDzGvRe2t4jfz8ZjYsduHmK94Ks3N5qwwRcY_qXE30jQ@mail.gmail.com>
In-Reply-To: <CALCETrXDzGvRe2t4jfz8ZjYsduHmK94Ks3N5qwwRcY_qXE30jQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Content-Transfer-Encoding: 8bit
Content-Length: 2463
Lines: 51

> -----Original Message-----
> From: Andy Lutomirski [mailto:luto@kernel.org]
> Sent: Thursday, April 13, 2017 12:44 PM
> To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> Cc: Darren Hart <dvhart@infradead.org>; Andrew Lutomirski <luto@kernel.org>;
> Michał Kępień <kernel@kempniu.pl>; Rafael J. Wysocki <rjw@rjwysocki.net>; Len
> Brown <len.brown@intel.com>; Pali Rohár <pali.rohar@gmail.com>; Corentin
> Chary <corentin.chary@gmail.com>; Andy Shevchenko
> <andriy.shevchenko@linux.intel.com>; linux-kernel@vger.kernel.org; platform-
> driver-x86@vger.kernel.org; linux-pm@vger.kernel.org
> Subject: Re: RFC: WMI Enhancements
> 
> On Thu, Apr 13, 2017 at 10:39 AM,  <Mario.Limonciello@dell.com> wrote:
> >> -----Original Message-----
> >> From: Darren Hart [mailto:dvhart@infradead.org]
> >> Sent: Thursday, April 13, 2017 12:06 PM
> >> To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> >> Cc: luto@kernel.org; kernel@kempniu.pl; rjw@rjwysocki.net;
> >> len.brown@intel.com; pali.rohar@gmail.com; corentin.chary@gmail.com;
> >> andriy.shevchenko@linux.intel.com; linux-kernel@vger.kernel.org; platform-
> >> driver-x86@vger.kernel.org; linux-pm@vger.kernel.org
> >> Subject: Re: RFC: WMI Enhancements
> >>
> 
> > Well the "most" interesting to me is the SMBIOS calling interface on the
> > regular Dell GUID (WMBA IIRC).  That's what is used to manipulate keyboard
> > LED timeouts in dell-laptop (although through direct SMI today).
> >
> > It's also what is used for other SMBIOS calls like changing random BIOS settings
> > that shouldn't be generically exposed in sysfs but should be controlled by
> > manageability tools.
> >
> > Example: turning on/off legacy option ROM or changing legacy boot order.
> >
> 
> IIUC we basically can't expose the SMI--based interface to this entry
> point to userspace because of its use of physical addressing.  It is
> reasonably safe to expose the WMI version?  (IOW should be expect that
> it doesn't enable kernel-mode or SMM code execution?)

The SMI based entry is already exposed using dcdbas.

The WMI version when executing a call that would be run as a SMI 
will copy the buffer to an area of memory that the BIOS has already 
been marked reserved to execute the SMI and copy the result out.

> 
> TBH, I've occasionally considered writing a driver to expose SMM code
> execution on systems with a known reliable exploit :)

On Dell HW?  I'm sure our security folks would be very interested in this.