1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * Think LMI BIOS configuration driver 4 * 5 * Copyright(C) 2019-2021 Lenovo 6 * 7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi 8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com> 9 * Distributed under the GPL-2.0 license 10 */ 11 12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14#include <linux/acpi.h> 15#include <linux/errno.h> 16#include <linux/fs.h> 17#include <linux/mutex.h> 18#include <linux/string.h> 19#include <linux/types.h> 20#include <linux/dmi.h> 21#include <linux/wmi.h> 22#include "firmware_attributes_class.h" 23#include "think-lmi.h" 24 25static bool debug_support; 26module_param(debug_support, bool, 0444); 27MODULE_PARM_DESC(debug_support, "Enable debug command support"); 28 29/* 30 * Name: BiosSetting 31 * Description: Get item name and settings for current LMI instance. 32 * Type: Query 33 * Returns: "Item,Value" 34 * Example: "WakeOnLAN,Enable" 35 */ 36#define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7" 37 38/* 39 * Name: SetBiosSetting 40 * Description: Change the BIOS setting to the desired value using the SetBiosSetting 41 * class. To save the settings, use the SaveBiosSetting class. 42 * BIOS settings and values are case sensitive. 43 * After making changes to the BIOS settings, you must reboot the computer 44 * before the changes will take effect. 45 * Type: Method 46 * Arguments: "Item,Value,Password,Encoding,KbdLang;" 47 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;" 48 */ 49#define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1" 50 51/* 52 * Name: SaveBiosSettings 53 * Description: Save any pending changes in settings. 54 * Type: Method 55 * Arguments: "Password,Encoding,KbdLang;" 56 * Example: "pa55w0rd,ascii,us;" 57 */ 58#define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3" 59 60/* 61 * Name: BiosPasswordSettings 62 * Description: Return BIOS Password settings 63 * Type: Query 64 * Returns: PasswordMode, PasswordState, MinLength, MaxLength, 65 * SupportedEncoding, SupportedKeyboard 66 */ 67#define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246" 68 69/* 70 * Name: SetBiosPassword 71 * Description: Change a specific password. 72 * - BIOS settings cannot be changed at the same boot as power-on 73 * passwords (POP) and hard disk passwords (HDP). If you want to change 74 * BIOS settings and POP or HDP, you must reboot the system after changing 75 * one of them. 76 * - A password cannot be set using this method when one does not already 77 * exist. Passwords can only be updated or cleared. 78 * Type: Method 79 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;" 80 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;” 81 */ 82#define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7" 83 84/* 85 * Name: GetBiosSelections 86 * Description: Return a list of valid settings for a given item. 87 * Type: Method 88 * Arguments: "Item" 89 * Returns: "Value1,Value2,Value3,..." 90 * Example: 91 * -> "FlashOverLAN" 92 * <- "Enabled,Disabled" 93 */ 94#define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B" 95 96/* 97 * Name: DebugCmd 98 * Description: Debug entry method for entering debug commands to the BIOS 99 */ 100#define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1" 101 102/* 103 * Name: OpcodeIF 104 * Description: Opcode interface which provides the ability to set multiple 105 * parameters and then trigger an action with a final command. 106 * This is particularly useful for simplifying setting passwords. 107 * With this support comes the ability to set System, HDD and NVMe 108 * passwords. 109 * This is currently available on ThinkCenter and ThinkStations platforms 110 */ 111#define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836" 112 113/* 114 * Name: SetBiosCert 115 * Description: Install BIOS certificate. 116 * Type: Method 117 * Arguments: "Certificate,Password" 118 * You must reboot the computer before the changes will take effect. 119 */ 120#define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE" 121 122/* 123 * Name: UpdateBiosCert 124 * Description: Update BIOS certificate. 125 * Type: Method 126 * Format: "Certificate,Signature" 127 * You must reboot the computer before the changes will take effect. 128 */ 129#define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE" 130 131/* 132 * Name: ClearBiosCert 133 * Description: Uninstall BIOS certificate. 134 * Type: Method 135 * Format: "Serial,Signature" 136 * You must reboot the computer before the changes will take effect. 137 */ 138#define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890" 139/* 140 * Name: CertToPassword 141 * Description: Switch from certificate to password authentication. 142 * Type: Method 143 * Format: "Password,Signature" 144 * You must reboot the computer before the changes will take effect. 145 */ 146#define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D" 147 148/* 149 * Name: SetBiosSettingCert 150 * Description: Set attribute using certificate authentication. 151 * Type: Method 152 * Format: "Item,Value,Signature" 153 */ 154#define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003" 155 156/* 157 * Name: SaveBiosSettingCert 158 * Description: Save any pending changes in settings. 159 * Type: Method 160 * Format: "Signature" 161 */ 162#define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551" 163 164/* 165 * Name: CertThumbprint 166 * Description: Display Certificate thumbprints 167 * Type: Query 168 * Returns: MD5, SHA1 & SHA256 thumbprints 169 */ 170#define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4" 171 172#define TLMI_POP_PWD BIT(0) /* Supervisor */ 173#define TLMI_PAP_PWD BIT(1) /* Power-on */ 174#define TLMI_HDD_PWD BIT(2) /* HDD/NVME */ 175#define TLMI_SMP_PWD BIT(6) /* System Management */ 176#define TLMI_CERT BIT(7) /* Certificate Based */ 177 178#define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj) 179#define to_tlmi_attr_setting(kobj) container_of(kobj, struct tlmi_attr_setting, kobj) 180 181static const struct tlmi_err_codes tlmi_errs[] = { 182 {"Success", 0}, 183 {"Not Supported", -EOPNOTSUPP}, 184 {"Invalid Parameter", -EINVAL}, 185 {"Access Denied", -EACCES}, 186 {"System Busy", -EBUSY}, 187}; 188 189static const char * const encoding_options[] = { 190 [TLMI_ENCODING_ASCII] = "ascii", 191 [TLMI_ENCODING_SCANCODE] = "scancode", 192}; 193static const char * const level_options[] = { 194 [TLMI_LEVEL_USER] = "user", 195 [TLMI_LEVEL_MASTER] = "master", 196}; 197static struct think_lmi tlmi_priv; 198static struct class *fw_attr_class; 199static DEFINE_MUTEX(tlmi_mutex); 200 201/* ------ Utility functions ------------*/ 202/* Strip out CR if one is present */ 203static void strip_cr(char *str) 204{ 205 char *p = strchrnul(str, '\n'); 206 *p = '\0'; 207} 208 209/* Convert BIOS WMI error string to suitable error code */ 210static int tlmi_errstr_to_err(const char *errstr) 211{ 212 int i; 213 214 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) { 215 if (!strcmp(tlmi_errs[i].err_str, errstr)) 216 return tlmi_errs[i].err_code; 217 } 218 return -EPERM; 219} 220 221/* Extract error string from WMI return buffer */ 222static int tlmi_extract_error(const struct acpi_buffer *output) 223{ 224 const union acpi_object *obj; 225 226 obj = output->pointer; 227 if (!obj) 228 return -ENOMEM; 229 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 230 return -EIO; 231 232 return tlmi_errstr_to_err(obj->string.pointer); 233} 234 235/* Utility function to execute WMI call to BIOS */ 236static int tlmi_simple_call(const char *guid, const char *arg) 237{ 238 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 239 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 240 acpi_status status; 241 int i, err; 242 243 /* 244 * Duplicated call required to match BIOS workaround for behavior 245 * seen when WMI accessed via scripting on other OS. 246 */ 247 for (i = 0; i < 2; i++) { 248 /* (re)initialize output buffer to default state */ 249 output.length = ACPI_ALLOCATE_BUFFER; 250 output.pointer = NULL; 251 252 status = wmi_evaluate_method(guid, 0, 0, &input, &output); 253 if (ACPI_FAILURE(status)) { 254 kfree(output.pointer); 255 return -EIO; 256 } 257 err = tlmi_extract_error(&output); 258 kfree(output.pointer); 259 if (err) 260 return err; 261 } 262 return 0; 263} 264 265/* Extract output string from WMI return buffer */ 266static int tlmi_extract_output_string(const struct acpi_buffer *output, 267 char **string) 268{ 269 const union acpi_object *obj; 270 char *s; 271 272 obj = output->pointer; 273 if (!obj) 274 return -ENOMEM; 275 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 276 return -EIO; 277 278 s = kstrdup(obj->string.pointer, GFP_KERNEL); 279 if (!s) 280 return -ENOMEM; 281 *string = s; 282 return 0; 283} 284 285/* ------ Core interface functions ------------*/ 286 287/* Get password settings from BIOS */ 288static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg) 289{ 290 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 291 const union acpi_object *obj; 292 acpi_status status; 293 int copy_size; 294 295 if (!tlmi_priv.can_get_password_settings) 296 return -EOPNOTSUPP; 297 298 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0, 299 &output); 300 if (ACPI_FAILURE(status)) 301 return -EIO; 302 303 obj = output.pointer; 304 if (!obj) 305 return -ENOMEM; 306 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) { 307 kfree(obj); 308 return -EIO; 309 } 310 /* 311 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad. 312 * To make the driver compatible on different brands, we permit it to get 313 * the data in below case. 314 * Settings must have at minimum the core fields available 315 */ 316 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) { 317 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length); 318 kfree(obj); 319 return -EIO; 320 } 321 322 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg)); 323 324 memcpy(pwdcfg, obj->buffer.pointer, copy_size); 325 kfree(obj); 326 327 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE)) 328 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1; 329 return 0; 330} 331 332static int tlmi_save_bios_settings(const char *password) 333{ 334 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID, 335 password); 336} 337 338static int tlmi_opcode_setting(char *setting, const char *value) 339{ 340 char *opcode_str; 341 int ret; 342 343 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value); 344 if (!opcode_str) 345 return -ENOMEM; 346 347 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str); 348 kfree(opcode_str); 349 return ret; 350} 351 352static int tlmi_setting(int item, char **value, const char *guid_string) 353{ 354 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 355 acpi_status status; 356 int ret; 357 358 status = wmi_query_block(guid_string, item, &output); 359 if (ACPI_FAILURE(status)) { 360 kfree(output.pointer); 361 return -EIO; 362 } 363 364 ret = tlmi_extract_output_string(&output, value); 365 kfree(output.pointer); 366 return ret; 367} 368 369static int tlmi_get_bios_selections(const char *item, char **value) 370{ 371 const struct acpi_buffer input = { strlen(item), (char *)item }; 372 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 373 acpi_status status; 374 int ret; 375 376 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID, 377 0, 0, &input, &output); 378 379 if (ACPI_FAILURE(status)) { 380 kfree(output.pointer); 381 return -EIO; 382 } 383 384 ret = tlmi_extract_output_string(&output, value); 385 kfree(output.pointer); 386 return ret; 387} 388 389/* ---- Authentication sysfs --------------------------------------------------------- */ 390static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr, 391 char *buf) 392{ 393 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 394 395 return sysfs_emit(buf, "%d\n", setting->valid); 396} 397 398static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled); 399 400static ssize_t current_password_store(struct kobject *kobj, 401 struct kobj_attribute *attr, 402 const char *buf, size_t count) 403{ 404 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 405 size_t pwdlen; 406 407 pwdlen = strlen(buf); 408 /* pwdlen == 0 is allowed to clear the password */ 409 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) 410 return -EINVAL; 411 412 strscpy(setting->password, buf, setting->maxlen); 413 /* Strip out CR if one is present, setting password won't work if it is present */ 414 strip_cr(setting->password); 415 return count; 416} 417 418static struct kobj_attribute auth_current_password = __ATTR_WO(current_password); 419 420static ssize_t new_password_store(struct kobject *kobj, 421 struct kobj_attribute *attr, 422 const char *buf, size_t count) 423{ 424 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 425 char *auth_str, *new_pwd; 426 size_t pwdlen; 427 int ret; 428 429 if (!capable(CAP_SYS_ADMIN)) 430 return -EPERM; 431 432 if (!tlmi_priv.can_set_bios_password) 433 return -EOPNOTSUPP; 434 435 new_pwd = kstrdup(buf, GFP_KERNEL); 436 if (!new_pwd) 437 return -ENOMEM; 438 439 /* Strip out CR if one is present, setting password won't work if it is present */ 440 strip_cr(new_pwd); 441 442 /* Use lock in case multiple WMI operations needed */ 443 mutex_lock(&tlmi_mutex); 444 445 pwdlen = strlen(new_pwd); 446 /* pwdlen == 0 is allowed to clear the password */ 447 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) { 448 ret = -EINVAL; 449 goto out; 450 } 451 452 /* If opcode support is present use that interface */ 453 if (tlmi_priv.opcode_support) { 454 char pwd_type[8]; 455 456 /* Special handling required for HDD and NVMe passwords */ 457 if (setting == tlmi_priv.pwd_hdd) { 458 if (setting->level == TLMI_LEVEL_USER) 459 sprintf(pwd_type, "uhdp%d", setting->index); 460 else 461 sprintf(pwd_type, "mhdp%d", setting->index); 462 } else if (setting == tlmi_priv.pwd_nvme) { 463 if (setting->level == TLMI_LEVEL_USER) 464 sprintf(pwd_type, "udrp%d", setting->index); 465 else 466 sprintf(pwd_type, "adrp%d", setting->index); 467 } else { 468 sprintf(pwd_type, "%s", setting->pwd_type); 469 } 470 471 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type); 472 if (ret) 473 goto out; 474 475 if (tlmi_priv.pwd_admin->valid) { 476 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 477 tlmi_priv.pwd_admin->password); 478 if (ret) 479 goto out; 480 } 481 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password); 482 if (ret) 483 goto out; 484 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd); 485 if (ret) 486 goto out; 487 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;"); 488 } else { 489 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */ 490 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;", 491 setting->pwd_type, setting->password, new_pwd, 492 encoding_options[setting->encoding], setting->kbdlang); 493 if (!auth_str) { 494 ret = -ENOMEM; 495 goto out; 496 } 497 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str); 498 kfree(auth_str); 499 } 500out: 501 mutex_unlock(&tlmi_mutex); 502 kfree(new_pwd); 503 return ret ?: count; 504} 505 506static struct kobj_attribute auth_new_password = __ATTR_WO(new_password); 507 508static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 509 char *buf) 510{ 511 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 512 513 return sysfs_emit(buf, "%d\n", setting->minlen); 514} 515 516static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length); 517 518static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 519 char *buf) 520{ 521 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 522 523 return sysfs_emit(buf, "%d\n", setting->maxlen); 524} 525static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length); 526 527static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr, 528 char *buf) 529{ 530 return sysfs_emit(buf, "password\n"); 531} 532static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism); 533 534static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr, 535 char *buf) 536{ 537 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 538 539 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]); 540} 541 542static ssize_t encoding_store(struct kobject *kobj, 543 struct kobj_attribute *attr, 544 const char *buf, size_t count) 545{ 546 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 547 int i; 548 549 /* Scan for a matching profile */ 550 i = sysfs_match_string(encoding_options, buf); 551 if (i < 0) 552 return -EINVAL; 553 554 setting->encoding = i; 555 return count; 556} 557 558static struct kobj_attribute auth_encoding = __ATTR_RW(encoding); 559 560static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr, 561 char *buf) 562{ 563 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 564 565 return sysfs_emit(buf, "%s\n", setting->kbdlang); 566} 567 568static ssize_t kbdlang_store(struct kobject *kobj, 569 struct kobj_attribute *attr, 570 const char *buf, size_t count) 571{ 572 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 573 int length; 574 575 /* Calculate length till '\n' or terminating 0 */ 576 length = strchrnul(buf, '\n') - buf; 577 if (!length || length >= TLMI_LANG_MAXLEN) 578 return -EINVAL; 579 580 memcpy(setting->kbdlang, buf, length); 581 setting->kbdlang[length] = '\0'; 582 return count; 583} 584 585static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang); 586 587static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr, 588 char *buf) 589{ 590 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 591 592 return sysfs_emit(buf, "%s\n", setting->role); 593} 594static struct kobj_attribute auth_role = __ATTR_RO(role); 595 596static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr, 597 char *buf) 598{ 599 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 600 601 return sysfs_emit(buf, "%d\n", setting->index); 602} 603 604static ssize_t index_store(struct kobject *kobj, 605 struct kobj_attribute *attr, 606 const char *buf, size_t count) 607{ 608 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 609 int err, val; 610 611 err = kstrtoint(buf, 10, &val); 612 if (err < 0) 613 return err; 614 615 if (val < 0 || val > TLMI_INDEX_MAX) 616 return -EINVAL; 617 618 setting->index = val; 619 return count; 620} 621 622static struct kobj_attribute auth_index = __ATTR_RW(index); 623 624static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr, 625 char *buf) 626{ 627 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 628 629 return sysfs_emit(buf, "%s\n", level_options[setting->level]); 630} 631 632static ssize_t level_store(struct kobject *kobj, 633 struct kobj_attribute *attr, 634 const char *buf, size_t count) 635{ 636 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 637 int i; 638 639 /* Scan for a matching profile */ 640 i = sysfs_match_string(level_options, buf); 641 if (i < 0) 642 return -EINVAL; 643 644 setting->level = i; 645 return count; 646} 647 648static struct kobj_attribute auth_level = __ATTR_RW(level); 649 650static ssize_t cert_thumbprint(char *buf, const char *arg, int count) 651{ 652 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 653 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 654 const union acpi_object *obj; 655 acpi_status status; 656 657 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output); 658 if (ACPI_FAILURE(status)) { 659 kfree(output.pointer); 660 return -EIO; 661 } 662 obj = output.pointer; 663 if (!obj) 664 return -ENOMEM; 665 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) { 666 kfree(output.pointer); 667 return -EIO; 668 } 669 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer); 670 kfree(output.pointer); 671 672 return count; 673} 674 675static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr, 676 char *buf) 677{ 678 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 679 int count = 0; 680 681 if (!tlmi_priv.certificate_support || !setting->cert_installed) 682 return -EOPNOTSUPP; 683 684 count += cert_thumbprint(buf, "Md5", count); 685 count += cert_thumbprint(buf, "Sha1", count); 686 count += cert_thumbprint(buf, "Sha256", count); 687 return count; 688} 689 690static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint); 691 692static ssize_t cert_to_password_store(struct kobject *kobj, 693 struct kobj_attribute *attr, 694 const char *buf, size_t count) 695{ 696 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 697 char *auth_str, *passwd; 698 int ret; 699 700 if (!capable(CAP_SYS_ADMIN)) 701 return -EPERM; 702 703 if (!tlmi_priv.certificate_support) 704 return -EOPNOTSUPP; 705 706 if (!setting->cert_installed) 707 return -EINVAL; 708 709 if (!setting->signature || !setting->signature[0]) 710 return -EACCES; 711 712 passwd = kstrdup(buf, GFP_KERNEL); 713 if (!passwd) 714 return -ENOMEM; 715 716 /* Strip out CR if one is present */ 717 strip_cr(passwd); 718 719 /* Format: 'Password,Signature' */ 720 auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature); 721 if (!auth_str) { 722 kfree_sensitive(passwd); 723 return -ENOMEM; 724 } 725 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str); 726 kfree(auth_str); 727 kfree_sensitive(passwd); 728 729 return ret ?: count; 730} 731 732static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password); 733 734static ssize_t certificate_store(struct kobject *kobj, 735 struct kobj_attribute *attr, 736 const char *buf, size_t count) 737{ 738 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 739 char *auth_str, *new_cert; 740 char *guid; 741 int ret; 742 743 if (!capable(CAP_SYS_ADMIN)) 744 return -EPERM; 745 746 if (!tlmi_priv.certificate_support) 747 return -EOPNOTSUPP; 748 749 /* If empty then clear installed certificate */ 750 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */ 751 /* Check that signature is set */ 752 if (!setting->signature || !setting->signature[0]) 753 return -EACCES; 754 755 /* Format: 'serial#, signature' */ 756 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 757 dmi_get_system_info(DMI_PRODUCT_SERIAL), 758 setting->signature); 759 if (!auth_str) 760 return -ENOMEM; 761 762 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str); 763 kfree(auth_str); 764 765 return ret ?: count; 766 } 767 768 new_cert = kstrdup(buf, GFP_KERNEL); 769 if (!new_cert) 770 return -ENOMEM; 771 /* Strip out CR if one is present */ 772 strip_cr(new_cert); 773 774 if (setting->cert_installed) { 775 /* Certificate is installed so this is an update */ 776 if (!setting->signature || !setting->signature[0]) { 777 kfree(new_cert); 778 return -EACCES; 779 } 780 guid = LENOVO_UPDATE_BIOS_CERT_GUID; 781 /* Format: 'Certificate,Signature' */ 782 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 783 new_cert, setting->signature); 784 } else { 785 /* This is a fresh install */ 786 if (!setting->valid || !setting->password[0]) { 787 kfree(new_cert); 788 return -EACCES; 789 } 790 guid = LENOVO_SET_BIOS_CERT_GUID; 791 /* Format: 'Certificate,Admin-password' */ 792 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 793 new_cert, setting->password); 794 } 795 kfree(new_cert); 796 if (!auth_str) 797 return -ENOMEM; 798 799 ret = tlmi_simple_call(guid, auth_str); 800 kfree(auth_str); 801 802 return ret ?: count; 803} 804 805static struct kobj_attribute auth_certificate = __ATTR_WO(certificate); 806 807static ssize_t signature_store(struct kobject *kobj, 808 struct kobj_attribute *attr, 809 const char *buf, size_t count) 810{ 811 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 812 char *new_signature; 813 814 if (!capable(CAP_SYS_ADMIN)) 815 return -EPERM; 816 817 if (!tlmi_priv.certificate_support) 818 return -EOPNOTSUPP; 819 820 new_signature = kstrdup(buf, GFP_KERNEL); 821 if (!new_signature) 822 return -ENOMEM; 823 824 /* Strip out CR if one is present */ 825 strip_cr(new_signature); 826 827 /* Free any previous signature */ 828 kfree(setting->signature); 829 setting->signature = new_signature; 830 831 return count; 832} 833 834static struct kobj_attribute auth_signature = __ATTR_WO(signature); 835 836static ssize_t save_signature_store(struct kobject *kobj, 837 struct kobj_attribute *attr, 838 const char *buf, size_t count) 839{ 840 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 841 char *new_signature; 842 843 if (!capable(CAP_SYS_ADMIN)) 844 return -EPERM; 845 846 if (!tlmi_priv.certificate_support) 847 return -EOPNOTSUPP; 848 849 new_signature = kstrdup(buf, GFP_KERNEL); 850 if (!new_signature) 851 return -ENOMEM; 852 853 /* Strip out CR if one is present */ 854 strip_cr(new_signature); 855 856 /* Free any previous signature */ 857 kfree(setting->save_signature); 858 setting->save_signature = new_signature; 859 860 return count; 861} 862 863static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature); 864 865static umode_t auth_attr_is_visible(struct kobject *kobj, 866 struct attribute *attr, int n) 867{ 868 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 869 870 /* We only want to display level and index settings on HDD/NVMe */ 871 if (attr == &auth_index.attr || attr == &auth_level.attr) { 872 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme)) 873 return attr->mode; 874 return 0; 875 } 876 877 /* We only display certificates on Admin account, if supported */ 878 if (attr == &auth_certificate.attr || 879 attr == &auth_signature.attr || 880 attr == &auth_save_signature.attr || 881 attr == &auth_cert_thumb.attr || 882 attr == &auth_cert_to_password.attr) { 883 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support) 884 return attr->mode; 885 return 0; 886 } 887 888 /* Don't display un-needed settings if opcode available */ 889 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) && 890 tlmi_priv.opcode_support) 891 return 0; 892 893 return attr->mode; 894} 895 896static struct attribute *auth_attrs[] = { 897 &auth_is_pass_set.attr, 898 &auth_min_pass_length.attr, 899 &auth_max_pass_length.attr, 900 &auth_current_password.attr, 901 &auth_new_password.attr, 902 &auth_role.attr, 903 &auth_mechanism.attr, 904 &auth_encoding.attr, 905 &auth_kbdlang.attr, 906 &auth_index.attr, 907 &auth_level.attr, 908 &auth_certificate.attr, 909 &auth_signature.attr, 910 &auth_save_signature.attr, 911 &auth_cert_thumb.attr, 912 &auth_cert_to_password.attr, 913 NULL 914}; 915 916static const struct attribute_group auth_attr_group = { 917 .is_visible = auth_attr_is_visible, 918 .attrs = auth_attrs, 919}; 920 921/* ---- Attributes sysfs --------------------------------------------------------- */ 922static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr, 923 char *buf) 924{ 925 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 926 927 return sysfs_emit(buf, "%s\n", setting->display_name); 928} 929 930static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 931{ 932 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 933 char *item, *value, *p; 934 int ret; 935 936 ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID); 937 if (ret) 938 return ret; 939 940 /* validate and split from `item,value` -> `value` */ 941 value = strpbrk(item, ","); 942 if (!value || value == item || !strlen(value + 1)) 943 ret = -EINVAL; 944 else { 945 /* On Workstations remove the Options part after the value */ 946 p = strchrnul(value, ';'); 947 *p = '\0'; 948 ret = sysfs_emit(buf, "%s\n", value + 1); 949 } 950 kfree(item); 951 952 return ret; 953} 954 955static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 956{ 957 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 958 959 return sysfs_emit(buf, "%s\n", setting->possible_values); 960} 961 962static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, 963 char *buf) 964{ 965 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 966 967 if (setting->possible_values) { 968 /* Figure out what setting type is as BIOS does not return this */ 969 if (strchr(setting->possible_values, ';')) 970 return sysfs_emit(buf, "enumeration\n"); 971 } 972 /* Anything else is going to be a string */ 973 return sysfs_emit(buf, "string\n"); 974} 975 976static ssize_t current_value_store(struct kobject *kobj, 977 struct kobj_attribute *attr, 978 const char *buf, size_t count) 979{ 980 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 981 char *set_str = NULL, *new_setting = NULL; 982 char *auth_str = NULL; 983 int ret; 984 985 if (!tlmi_priv.can_set_bios_settings) 986 return -EOPNOTSUPP; 987 988 new_setting = kstrdup(buf, GFP_KERNEL); 989 if (!new_setting) 990 return -ENOMEM; 991 992 /* Strip out CR if one is present */ 993 strip_cr(new_setting); 994 995 /* Use lock in case multiple WMI operations needed */ 996 mutex_lock(&tlmi_mutex); 997 998 /* Check if certificate authentication is enabled and active */ 999 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) { 1000 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) { 1001 ret = -EINVAL; 1002 goto out; 1003 } 1004 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 1005 new_setting, tlmi_priv.pwd_admin->signature); 1006 if (!set_str) { 1007 ret = -ENOMEM; 1008 goto out; 1009 } 1010 1011 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str); 1012 if (ret) 1013 goto out; 1014 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID, 1015 tlmi_priv.pwd_admin->save_signature); 1016 if (ret) 1017 goto out; 1018 } else if (tlmi_priv.opcode_support) { 1019 /* 1020 * If opcode support is present use that interface. 1021 * Note - this sets the variable and then the password as separate 1022 * WMI calls. Function tlmi_save_bios_settings will error if the 1023 * password is incorrect. 1024 */ 1025 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1026 new_setting); 1027 if (!set_str) { 1028 ret = -ENOMEM; 1029 goto out; 1030 } 1031 1032 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1033 if (ret) 1034 goto out; 1035 1036 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1037 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 1038 tlmi_priv.pwd_admin->password); 1039 if (ret) 1040 goto out; 1041 } 1042 1043 ret = tlmi_save_bios_settings(""); 1044 } else { /* old non-opcode based authentication method (deprecated) */ 1045 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1046 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1047 tlmi_priv.pwd_admin->password, 1048 encoding_options[tlmi_priv.pwd_admin->encoding], 1049 tlmi_priv.pwd_admin->kbdlang); 1050 if (!auth_str) { 1051 ret = -ENOMEM; 1052 goto out; 1053 } 1054 } 1055 1056 if (auth_str) 1057 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 1058 new_setting, auth_str); 1059 else 1060 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1061 new_setting); 1062 if (!set_str) { 1063 ret = -ENOMEM; 1064 goto out; 1065 } 1066 1067 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1068 if (ret) 1069 goto out; 1070 1071 if (auth_str) 1072 ret = tlmi_save_bios_settings(auth_str); 1073 else 1074 ret = tlmi_save_bios_settings(""); 1075 } 1076 if (!ret && !tlmi_priv.pending_changes) { 1077 tlmi_priv.pending_changes = true; 1078 /* let userland know it may need to check reboot pending again */ 1079 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1080 } 1081out: 1082 mutex_unlock(&tlmi_mutex); 1083 kfree(auth_str); 1084 kfree(set_str); 1085 kfree(new_setting); 1086 return ret ?: count; 1087} 1088 1089static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name); 1090 1091static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values); 1092 1093static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600); 1094 1095static struct kobj_attribute attr_type = __ATTR_RO(type); 1096 1097static umode_t attr_is_visible(struct kobject *kobj, 1098 struct attribute *attr, int n) 1099{ 1100 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1101 1102 /* We don't want to display possible_values attributes if not available */ 1103 if ((attr == &attr_possible_values.attr) && (!setting->possible_values)) 1104 return 0; 1105 1106 return attr->mode; 1107} 1108 1109static struct attribute *tlmi_attrs[] = { 1110 &attr_displ_name.attr, 1111 &attr_current_val.attr, 1112 &attr_possible_values.attr, 1113 &attr_type.attr, 1114 NULL 1115}; 1116 1117static const struct attribute_group tlmi_attr_group = { 1118 .is_visible = attr_is_visible, 1119 .attrs = tlmi_attrs, 1120}; 1121 1122static void tlmi_attr_setting_release(struct kobject *kobj) 1123{ 1124 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1125 1126 kfree(setting->possible_values); 1127 kfree(setting); 1128} 1129 1130static void tlmi_pwd_setting_release(struct kobject *kobj) 1131{ 1132 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 1133 1134 kfree(setting); 1135} 1136 1137static const struct kobj_type tlmi_attr_setting_ktype = { 1138 .release = &tlmi_attr_setting_release, 1139 .sysfs_ops = &kobj_sysfs_ops, 1140}; 1141 1142static const struct kobj_type tlmi_pwd_setting_ktype = { 1143 .release = &tlmi_pwd_setting_release, 1144 .sysfs_ops = &kobj_sysfs_ops, 1145}; 1146 1147static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr, 1148 char *buf) 1149{ 1150 return sprintf(buf, "%d\n", tlmi_priv.pending_changes); 1151} 1152 1153static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot); 1154 1155/* ---- Debug interface--------------------------------------------------------- */ 1156static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr, 1157 const char *buf, size_t count) 1158{ 1159 char *set_str = NULL, *new_setting = NULL; 1160 char *auth_str = NULL; 1161 int ret; 1162 1163 if (!tlmi_priv.can_debug_cmd) 1164 return -EOPNOTSUPP; 1165 1166 new_setting = kstrdup(buf, GFP_KERNEL); 1167 if (!new_setting) 1168 return -ENOMEM; 1169 1170 /* Strip out CR if one is present */ 1171 strip_cr(new_setting); 1172 1173 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1174 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1175 tlmi_priv.pwd_admin->password, 1176 encoding_options[tlmi_priv.pwd_admin->encoding], 1177 tlmi_priv.pwd_admin->kbdlang); 1178 if (!auth_str) { 1179 ret = -ENOMEM; 1180 goto out; 1181 } 1182 } 1183 1184 if (auth_str) 1185 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str); 1186 else 1187 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting); 1188 if (!set_str) { 1189 ret = -ENOMEM; 1190 goto out; 1191 } 1192 1193 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str); 1194 if (ret) 1195 goto out; 1196 1197 if (!ret && !tlmi_priv.pending_changes) { 1198 tlmi_priv.pending_changes = true; 1199 /* let userland know it may need to check reboot pending again */ 1200 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1201 } 1202out: 1203 kfree(auth_str); 1204 kfree(set_str); 1205 kfree(new_setting); 1206 return ret ?: count; 1207} 1208 1209static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd); 1210 1211/* ---- Initialisation --------------------------------------------------------- */ 1212static void tlmi_release_attr(void) 1213{ 1214 int i; 1215 1216 /* Attribute structures */ 1217 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1218 if (tlmi_priv.setting[i]) { 1219 sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1220 kobject_put(&tlmi_priv.setting[i]->kobj); 1221 } 1222 } 1223 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1224 if (tlmi_priv.can_debug_cmd && debug_support) 1225 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1226 1227 kset_unregister(tlmi_priv.attribute_kset); 1228 1229 /* Free up any saved signatures */ 1230 kfree(tlmi_priv.pwd_admin->signature); 1231 kfree(tlmi_priv.pwd_admin->save_signature); 1232 1233 /* Authentication structures */ 1234 sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1235 kobject_put(&tlmi_priv.pwd_admin->kobj); 1236 sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1237 kobject_put(&tlmi_priv.pwd_power->kobj); 1238 1239 if (tlmi_priv.opcode_support) { 1240 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1241 kobject_put(&tlmi_priv.pwd_system->kobj); 1242 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1243 kobject_put(&tlmi_priv.pwd_hdd->kobj); 1244 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1245 kobject_put(&tlmi_priv.pwd_nvme->kobj); 1246 } 1247 1248 kset_unregister(tlmi_priv.authentication_kset); 1249} 1250 1251static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name) 1252{ 1253 struct kobject *duplicate; 1254 1255 if (!strcmp(name, "Reserved")) 1256 return -EINVAL; 1257 1258 duplicate = kset_find_obj(attribute_kset, name); 1259 if (duplicate) { 1260 pr_debug("Duplicate attribute name found - %s\n", name); 1261 /* kset_find_obj() returns a reference */ 1262 kobject_put(duplicate); 1263 return -EBUSY; 1264 } 1265 1266 return 0; 1267} 1268 1269static int tlmi_sysfs_init(void) 1270{ 1271 int i, ret; 1272 1273 ret = fw_attributes_class_get(&fw_attr_class); 1274 if (ret) 1275 return ret; 1276 1277 tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), 1278 NULL, "%s", "thinklmi"); 1279 if (IS_ERR(tlmi_priv.class_dev)) { 1280 ret = PTR_ERR(tlmi_priv.class_dev); 1281 goto fail_class_created; 1282 } 1283 1284 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL, 1285 &tlmi_priv.class_dev->kobj); 1286 if (!tlmi_priv.attribute_kset) { 1287 ret = -ENOMEM; 1288 goto fail_device_created; 1289 } 1290 1291 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1292 /* Check if index is a valid setting - skip if it isn't */ 1293 if (!tlmi_priv.setting[i]) 1294 continue; 1295 1296 /* check for duplicate or reserved values */ 1297 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset, 1298 tlmi_priv.setting[i]->display_name) < 0) { 1299 kfree(tlmi_priv.setting[i]->possible_values); 1300 kfree(tlmi_priv.setting[i]); 1301 tlmi_priv.setting[i] = NULL; 1302 continue; 1303 } 1304 1305 /* Build attribute */ 1306 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; 1307 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, 1308 "%s", tlmi_priv.setting[i]->display_name); 1309 if (ret) 1310 goto fail_create_attr; 1311 1312 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1313 if (ret) 1314 goto fail_create_attr; 1315 } 1316 1317 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1318 if (ret) 1319 goto fail_create_attr; 1320 1321 if (tlmi_priv.can_debug_cmd && debug_support) { 1322 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1323 if (ret) 1324 goto fail_create_attr; 1325 } 1326 1327 /* Create authentication entries */ 1328 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, 1329 &tlmi_priv.class_dev->kobj); 1330 if (!tlmi_priv.authentication_kset) { 1331 ret = -ENOMEM; 1332 goto fail_create_attr; 1333 } 1334 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; 1335 ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); 1336 if (ret) 1337 goto fail_create_attr; 1338 1339 ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1340 if (ret) 1341 goto fail_create_attr; 1342 1343 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; 1344 ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); 1345 if (ret) 1346 goto fail_create_attr; 1347 1348 ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1349 if (ret) 1350 goto fail_create_attr; 1351 1352 if (tlmi_priv.opcode_support) { 1353 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; 1354 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); 1355 if (ret) 1356 goto fail_create_attr; 1357 1358 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1359 if (ret) 1360 goto fail_create_attr; 1361 1362 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; 1363 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); 1364 if (ret) 1365 goto fail_create_attr; 1366 1367 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1368 if (ret) 1369 goto fail_create_attr; 1370 1371 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; 1372 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); 1373 if (ret) 1374 goto fail_create_attr; 1375 1376 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1377 if (ret) 1378 goto fail_create_attr; 1379 } 1380 1381 return ret; 1382 1383fail_create_attr: 1384 tlmi_release_attr(); 1385fail_device_created: 1386 device_destroy(fw_attr_class, MKDEV(0, 0)); 1387fail_class_created: 1388 fw_attributes_class_put(); 1389 return ret; 1390} 1391 1392/* ---- Base Driver -------------------------------------------------------- */ 1393static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type, 1394 const char *pwd_role) 1395{ 1396 struct tlmi_pwd_setting *new_pwd; 1397 1398 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL); 1399 if (!new_pwd) 1400 return NULL; 1401 1402 strscpy(new_pwd->kbdlang, "us", TLMI_LANG_MAXLEN); 1403 new_pwd->encoding = TLMI_ENCODING_ASCII; 1404 new_pwd->pwd_type = pwd_type; 1405 new_pwd->role = pwd_role; 1406 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length; 1407 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; 1408 new_pwd->index = 0; 1409 1410 kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); 1411 1412 return new_pwd; 1413} 1414 1415static int tlmi_analyze(void) 1416{ 1417 int i, ret; 1418 1419 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) && 1420 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID)) 1421 tlmi_priv.can_set_bios_settings = true; 1422 1423 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID)) 1424 tlmi_priv.can_get_bios_selections = true; 1425 1426 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID)) 1427 tlmi_priv.can_set_bios_password = true; 1428 1429 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID)) 1430 tlmi_priv.can_get_password_settings = true; 1431 1432 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID)) 1433 tlmi_priv.can_debug_cmd = true; 1434 1435 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID)) 1436 tlmi_priv.opcode_support = true; 1437 1438 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) && 1439 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) && 1440 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID)) 1441 tlmi_priv.certificate_support = true; 1442 1443 /* 1444 * Try to find the number of valid settings of this machine 1445 * and use it to create sysfs attributes. 1446 */ 1447 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1448 struct tlmi_attr_setting *setting; 1449 char *item = NULL; 1450 char *p; 1451 1452 tlmi_priv.setting[i] = NULL; 1453 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID); 1454 if (ret) 1455 break; 1456 if (!item) 1457 break; 1458 if (!*item) { 1459 kfree(item); 1460 continue; 1461 } 1462 1463 /* It is not allowed to have '/' for file name. Convert it into '\'. */ 1464 strreplace(item, '/', '\\'); 1465 1466 /* Remove the value part */ 1467 p = strchrnul(item, ','); 1468 *p = '\0'; 1469 1470 /* Create a setting entry */ 1471 setting = kzalloc(sizeof(*setting), GFP_KERNEL); 1472 if (!setting) { 1473 ret = -ENOMEM; 1474 kfree(item); 1475 goto fail_clear_attr; 1476 } 1477 setting->index = i; 1478 strscpy(setting->display_name, item, TLMI_SETTINGS_MAXLEN); 1479 /* If BIOS selections supported, load those */ 1480 if (tlmi_priv.can_get_bios_selections) { 1481 ret = tlmi_get_bios_selections(setting->display_name, 1482 &setting->possible_values); 1483 if (ret || !setting->possible_values) 1484 pr_info("Error retrieving possible values for %d : %s\n", 1485 i, setting->display_name); 1486 } else { 1487 /* 1488 * Older Thinkstations don't support the bios_selections API. 1489 * Instead they store this as a [Optional:Option1,Option2] section of the 1490 * name string. 1491 * Try and pull that out if it's available. 1492 */ 1493 char *optitem, *optstart, *optend; 1494 1495 if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) { 1496 optstart = strstr(optitem, "[Optional:"); 1497 if (optstart) { 1498 optstart += strlen("[Optional:"); 1499 optend = strstr(optstart, "]"); 1500 if (optend) 1501 setting->possible_values = 1502 kstrndup(optstart, optend - optstart, 1503 GFP_KERNEL); 1504 } 1505 kfree(optitem); 1506 } 1507 } 1508 /* 1509 * firmware-attributes requires that possible_values are separated by ';' but 1510 * Lenovo FW uses ','. Replace appropriately. 1511 */ 1512 if (setting->possible_values) 1513 strreplace(setting->possible_values, ',', ';'); 1514 1515 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); 1516 tlmi_priv.setting[i] = setting; 1517 kfree(item); 1518 } 1519 1520 /* Create password setting structure */ 1521 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg); 1522 if (ret) 1523 goto fail_clear_attr; 1524 1525 /* All failures below boil down to kmalloc failures */ 1526 ret = -ENOMEM; 1527 1528 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin"); 1529 if (!tlmi_priv.pwd_admin) 1530 goto fail_clear_attr; 1531 1532 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD) 1533 tlmi_priv.pwd_admin->valid = true; 1534 1535 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on"); 1536 if (!tlmi_priv.pwd_power) 1537 goto fail_clear_attr; 1538 1539 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD) 1540 tlmi_priv.pwd_power->valid = true; 1541 1542 if (tlmi_priv.opcode_support) { 1543 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system"); 1544 if (!tlmi_priv.pwd_system) 1545 goto fail_clear_attr; 1546 1547 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD) 1548 tlmi_priv.pwd_system->valid = true; 1549 1550 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd"); 1551 if (!tlmi_priv.pwd_hdd) 1552 goto fail_clear_attr; 1553 1554 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme"); 1555 if (!tlmi_priv.pwd_nvme) 1556 goto fail_clear_attr; 1557 1558 /* Set default hdd/nvme index to 1 as there is no device 0 */ 1559 tlmi_priv.pwd_hdd->index = 1; 1560 tlmi_priv.pwd_nvme->index = 1; 1561 1562 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) { 1563 /* Check if PWD is configured and set index to first drive found */ 1564 if (tlmi_priv.pwdcfg.ext.hdd_user_password || 1565 tlmi_priv.pwdcfg.ext.hdd_master_password) { 1566 tlmi_priv.pwd_hdd->valid = true; 1567 if (tlmi_priv.pwdcfg.ext.hdd_master_password) 1568 tlmi_priv.pwd_hdd->index = 1569 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1; 1570 else 1571 tlmi_priv.pwd_hdd->index = 1572 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1; 1573 } 1574 if (tlmi_priv.pwdcfg.ext.nvme_user_password || 1575 tlmi_priv.pwdcfg.ext.nvme_master_password) { 1576 tlmi_priv.pwd_nvme->valid = true; 1577 if (tlmi_priv.pwdcfg.ext.nvme_master_password) 1578 tlmi_priv.pwd_nvme->index = 1579 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1; 1580 else 1581 tlmi_priv.pwd_nvme->index = 1582 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1; 1583 } 1584 } 1585 } 1586 1587 if (tlmi_priv.certificate_support && 1588 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT)) 1589 tlmi_priv.pwd_admin->cert_installed = true; 1590 1591 return 0; 1592 1593fail_clear_attr: 1594 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1595 if (tlmi_priv.setting[i]) { 1596 kfree(tlmi_priv.setting[i]->possible_values); 1597 kfree(tlmi_priv.setting[i]); 1598 } 1599 } 1600 kfree(tlmi_priv.pwd_admin); 1601 kfree(tlmi_priv.pwd_power); 1602 kfree(tlmi_priv.pwd_system); 1603 kfree(tlmi_priv.pwd_hdd); 1604 kfree(tlmi_priv.pwd_nvme); 1605 return ret; 1606} 1607 1608static void tlmi_remove(struct wmi_device *wdev) 1609{ 1610 tlmi_release_attr(); 1611 device_destroy(fw_attr_class, MKDEV(0, 0)); 1612 fw_attributes_class_put(); 1613} 1614 1615static int tlmi_probe(struct wmi_device *wdev, const void *context) 1616{ 1617 int ret; 1618 1619 ret = tlmi_analyze(); 1620 if (ret) 1621 return ret; 1622 1623 return tlmi_sysfs_init(); 1624} 1625 1626static const struct wmi_device_id tlmi_id_table[] = { 1627 { .guid_string = LENOVO_BIOS_SETTING_GUID }, 1628 { } 1629}; 1630MODULE_DEVICE_TABLE(wmi, tlmi_id_table); 1631 1632static struct wmi_driver tlmi_driver = { 1633 .driver = { 1634 .name = "think-lmi", 1635 }, 1636 .id_table = tlmi_id_table, 1637 .probe = tlmi_probe, 1638 .remove = tlmi_remove, 1639}; 1640 1641MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>"); 1642MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>"); 1643MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>"); 1644MODULE_DESCRIPTION("ThinkLMI Driver"); 1645MODULE_LICENSE("GPL"); 1646 1647module_wmi_driver(tlmi_driver); 1648