1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Think LMI BIOS configuration driver 4 * 5 * Copyright(C) 2019-2021 Lenovo 6 * 7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi 8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com> 9 * Distributed under the GPL-2.0 license 10 */ 11 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14 #include <linux/acpi.h> 15 #include <linux/errno.h> 16 #include <linux/fs.h> 17 #include <linux/mutex.h> 18 #include <linux/string.h> 19 #include <linux/types.h> 20 #include <linux/dmi.h> 21 #include <linux/wmi.h> 22 #include "firmware_attributes_class.h" 23 #include "think-lmi.h" 24 25 static bool debug_support; 26 module_param(debug_support, bool, 0444); 27 MODULE_PARM_DESC(debug_support, "Enable debug command support"); 28 29 /* 30 * Name: BiosSetting 31 * Description: Get item name and settings for current LMI instance. 32 * Type: Query 33 * Returns: "Item,Value" 34 * Example: "WakeOnLAN,Enable" 35 */ 36 #define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7" 37 38 /* 39 * Name: SetBiosSetting 40 * Description: Change the BIOS setting to the desired value using the SetBiosSetting 41 * class. To save the settings, use the SaveBiosSetting class. 42 * BIOS settings and values are case sensitive. 43 * After making changes to the BIOS settings, you must reboot the computer 44 * before the changes will take effect. 45 * Type: Method 46 * Arguments: "Item,Value,Password,Encoding,KbdLang;" 47 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;" 48 */ 49 #define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1" 50 51 /* 52 * Name: SaveBiosSettings 53 * Description: Save any pending changes in settings. 54 * Type: Method 55 * Arguments: "Password,Encoding,KbdLang;" 56 * Example: "pa55w0rd,ascii,us;" 57 */ 58 #define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3" 59 60 /* 61 * Name: BiosPasswordSettings 62 * Description: Return BIOS Password settings 63 * Type: Query 64 * Returns: PasswordMode, PasswordState, MinLength, MaxLength, 65 * SupportedEncoding, SupportedKeyboard 66 */ 67 #define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246" 68 69 /* 70 * Name: SetBiosPassword 71 * Description: Change a specific password. 72 * - BIOS settings cannot be changed at the same boot as power-on 73 * passwords (POP) and hard disk passwords (HDP). If you want to change 74 * BIOS settings and POP or HDP, you must reboot the system after changing 75 * one of them. 76 * - A password cannot be set using this method when one does not already 77 * exist. Passwords can only be updated or cleared. 78 * Type: Method 79 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;" 80 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;” 81 */ 82 #define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7" 83 84 /* 85 * Name: GetBiosSelections 86 * Description: Return a list of valid settings for a given item. 87 * Type: Method 88 * Arguments: "Item" 89 * Returns: "Value1,Value2,Value3,..." 90 * Example: 91 * -> "FlashOverLAN" 92 * <- "Enabled,Disabled" 93 */ 94 #define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B" 95 96 /* 97 * Name: DebugCmd 98 * Description: Debug entry method for entering debug commands to the BIOS 99 */ 100 #define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1" 101 102 /* 103 * Name: OpcodeIF 104 * Description: Opcode interface which provides the ability to set multiple 105 * parameters and then trigger an action with a final command. 106 * This is particularly useful for simplifying setting passwords. 107 * With this support comes the ability to set System, HDD and NVMe 108 * passwords. 109 * This is currently available on ThinkCenter and ThinkStations platforms 110 */ 111 #define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836" 112 113 /* 114 * Name: SetBiosCert 115 * Description: Install BIOS certificate. 116 * Type: Method 117 * Arguments: "Certificate,Password" 118 * You must reboot the computer before the changes will take effect. 119 */ 120 #define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE" 121 122 /* 123 * Name: UpdateBiosCert 124 * Description: Update BIOS certificate. 125 * Type: Method 126 * Format: "Certificate,Signature" 127 * You must reboot the computer before the changes will take effect. 128 */ 129 #define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE" 130 131 /* 132 * Name: ClearBiosCert 133 * Description: Uninstall BIOS certificate. 134 * Type: Method 135 * Format: "Serial,Signature" 136 * You must reboot the computer before the changes will take effect. 137 */ 138 #define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890" 139 /* 140 * Name: CertToPassword 141 * Description: Switch from certificate to password authentication. 142 * Type: Method 143 * Format: "Password,Signature" 144 * You must reboot the computer before the changes will take effect. 145 */ 146 #define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D" 147 148 /* 149 * Name: SetBiosSettingCert 150 * Description: Set attribute using certificate authentication. 151 * Type: Method 152 * Format: "Item,Value,Signature" 153 */ 154 #define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003" 155 156 /* 157 * Name: SaveBiosSettingCert 158 * Description: Save any pending changes in settings. 159 * Type: Method 160 * Format: "Signature" 161 */ 162 #define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551" 163 164 /* 165 * Name: CertThumbprint 166 * Description: Display Certificate thumbprints 167 * Type: Query 168 * Returns: MD5, SHA1 & SHA256 thumbprints 169 */ 170 #define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4" 171 172 #define TLMI_POP_PWD BIT(0) /* Supervisor */ 173 #define TLMI_PAP_PWD BIT(1) /* Power-on */ 174 #define TLMI_HDD_PWD BIT(2) /* HDD/NVME */ 175 #define TLMI_SMP_PWD BIT(6) /* System Management */ 176 #define TLMI_CERT BIT(7) /* Certificate Based */ 177 178 #define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj) 179 #define to_tlmi_attr_setting(kobj) container_of(kobj, struct tlmi_attr_setting, kobj) 180 181 static const struct tlmi_err_codes tlmi_errs[] = { 182 {"Success", 0}, 183 {"Not Supported", -EOPNOTSUPP}, 184 {"Invalid Parameter", -EINVAL}, 185 {"Access Denied", -EACCES}, 186 {"System Busy", -EBUSY}, 187 }; 188 189 static const char * const encoding_options[] = { 190 [TLMI_ENCODING_ASCII] = "ascii", 191 [TLMI_ENCODING_SCANCODE] = "scancode", 192 }; 193 static const char * const level_options[] = { 194 [TLMI_LEVEL_USER] = "user", 195 [TLMI_LEVEL_MASTER] = "master", 196 }; 197 static struct think_lmi tlmi_priv; 198 static struct class *fw_attr_class; 199 static DEFINE_MUTEX(tlmi_mutex); 200 201 /* ------ Utility functions ------------*/ 202 /* Strip out CR if one is present */ 203 static void strip_cr(char *str) 204 { 205 char *p = strchrnul(str, '\n'); 206 *p = '\0'; 207 } 208 209 /* Convert BIOS WMI error string to suitable error code */ 210 static int tlmi_errstr_to_err(const char *errstr) 211 { 212 int i; 213 214 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) { 215 if (!strcmp(tlmi_errs[i].err_str, errstr)) 216 return tlmi_errs[i].err_code; 217 } 218 return -EPERM; 219 } 220 221 /* Extract error string from WMI return buffer */ 222 static int tlmi_extract_error(const struct acpi_buffer *output) 223 { 224 const union acpi_object *obj; 225 226 obj = output->pointer; 227 if (!obj) 228 return -ENOMEM; 229 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 230 return -EIO; 231 232 return tlmi_errstr_to_err(obj->string.pointer); 233 } 234 235 /* Utility function to execute WMI call to BIOS */ 236 static int tlmi_simple_call(const char *guid, const char *arg) 237 { 238 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 239 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 240 acpi_status status; 241 int i, err; 242 243 /* 244 * Duplicated call required to match BIOS workaround for behavior 245 * seen when WMI accessed via scripting on other OS. 246 */ 247 for (i = 0; i < 2; i++) { 248 /* (re)initialize output buffer to default state */ 249 output.length = ACPI_ALLOCATE_BUFFER; 250 output.pointer = NULL; 251 252 status = wmi_evaluate_method(guid, 0, 0, &input, &output); 253 if (ACPI_FAILURE(status)) { 254 kfree(output.pointer); 255 return -EIO; 256 } 257 err = tlmi_extract_error(&output); 258 kfree(output.pointer); 259 if (err) 260 return err; 261 } 262 return 0; 263 } 264 265 /* Extract output string from WMI return buffer */ 266 static int tlmi_extract_output_string(const struct acpi_buffer *output, 267 char **string) 268 { 269 const union acpi_object *obj; 270 char *s; 271 272 obj = output->pointer; 273 if (!obj) 274 return -ENOMEM; 275 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 276 return -EIO; 277 278 s = kstrdup(obj->string.pointer, GFP_KERNEL); 279 if (!s) 280 return -ENOMEM; 281 *string = s; 282 return 0; 283 } 284 285 /* ------ Core interface functions ------------*/ 286 287 /* Get password settings from BIOS */ 288 static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg) 289 { 290 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 291 const union acpi_object *obj; 292 acpi_status status; 293 int copy_size; 294 295 if (!tlmi_priv.can_get_password_settings) 296 return -EOPNOTSUPP; 297 298 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0, 299 &output); 300 if (ACPI_FAILURE(status)) 301 return -EIO; 302 303 obj = output.pointer; 304 if (!obj) 305 return -ENOMEM; 306 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) { 307 kfree(obj); 308 return -EIO; 309 } 310 /* 311 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad. 312 * To make the driver compatible on different brands, we permit it to get 313 * the data in below case. 314 * Settings must have at minimum the core fields available 315 */ 316 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) { 317 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length); 318 kfree(obj); 319 return -EIO; 320 } 321 322 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg)); 323 324 memcpy(pwdcfg, obj->buffer.pointer, copy_size); 325 kfree(obj); 326 327 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE)) 328 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1; 329 return 0; 330 } 331 332 static int tlmi_save_bios_settings(const char *password) 333 { 334 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID, 335 password); 336 } 337 338 static int tlmi_opcode_setting(char *setting, const char *value) 339 { 340 char *opcode_str; 341 int ret; 342 343 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value); 344 if (!opcode_str) 345 return -ENOMEM; 346 347 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str); 348 kfree(opcode_str); 349 return ret; 350 } 351 352 static int tlmi_setting(int item, char **value, const char *guid_string) 353 { 354 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 355 acpi_status status; 356 int ret; 357 358 status = wmi_query_block(guid_string, item, &output); 359 if (ACPI_FAILURE(status)) { 360 kfree(output.pointer); 361 return -EIO; 362 } 363 364 ret = tlmi_extract_output_string(&output, value); 365 kfree(output.pointer); 366 return ret; 367 } 368 369 static int tlmi_get_bios_selections(const char *item, char **value) 370 { 371 const struct acpi_buffer input = { strlen(item), (char *)item }; 372 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 373 acpi_status status; 374 int ret; 375 376 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID, 377 0, 0, &input, &output); 378 379 if (ACPI_FAILURE(status)) { 380 kfree(output.pointer); 381 return -EIO; 382 } 383 384 ret = tlmi_extract_output_string(&output, value); 385 kfree(output.pointer); 386 return ret; 387 } 388 389 /* ---- Authentication sysfs --------------------------------------------------------- */ 390 static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr, 391 char *buf) 392 { 393 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 394 395 return sysfs_emit(buf, "%d\n", setting->valid); 396 } 397 398 static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled); 399 400 static ssize_t current_password_store(struct kobject *kobj, 401 struct kobj_attribute *attr, 402 const char *buf, size_t count) 403 { 404 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 405 size_t pwdlen; 406 407 pwdlen = strlen(buf); 408 /* pwdlen == 0 is allowed to clear the password */ 409 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) 410 return -EINVAL; 411 412 strscpy(setting->password, buf, setting->maxlen); 413 /* Strip out CR if one is present, setting password won't work if it is present */ 414 strip_cr(setting->password); 415 return count; 416 } 417 418 static struct kobj_attribute auth_current_password = __ATTR_WO(current_password); 419 420 static ssize_t new_password_store(struct kobject *kobj, 421 struct kobj_attribute *attr, 422 const char *buf, size_t count) 423 { 424 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 425 char *auth_str, *new_pwd; 426 size_t pwdlen; 427 int ret; 428 429 if (!capable(CAP_SYS_ADMIN)) 430 return -EPERM; 431 432 if (!tlmi_priv.can_set_bios_password) 433 return -EOPNOTSUPP; 434 435 new_pwd = kstrdup(buf, GFP_KERNEL); 436 if (!new_pwd) 437 return -ENOMEM; 438 439 /* Strip out CR if one is present, setting password won't work if it is present */ 440 strip_cr(new_pwd); 441 442 /* Use lock in case multiple WMI operations needed */ 443 mutex_lock(&tlmi_mutex); 444 445 pwdlen = strlen(new_pwd); 446 /* pwdlen == 0 is allowed to clear the password */ 447 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) { 448 ret = -EINVAL; 449 goto out; 450 } 451 452 /* If opcode support is present use that interface */ 453 if (tlmi_priv.opcode_support) { 454 char pwd_type[8]; 455 456 /* Special handling required for HDD and NVMe passwords */ 457 if (setting == tlmi_priv.pwd_hdd) { 458 if (setting->level == TLMI_LEVEL_USER) 459 sprintf(pwd_type, "uhdp%d", setting->index); 460 else 461 sprintf(pwd_type, "mhdp%d", setting->index); 462 } else if (setting == tlmi_priv.pwd_nvme) { 463 if (setting->level == TLMI_LEVEL_USER) 464 sprintf(pwd_type, "unvp%d", setting->index); 465 else 466 sprintf(pwd_type, "mnvp%d", setting->index); 467 } else { 468 sprintf(pwd_type, "%s", setting->pwd_type); 469 } 470 471 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type); 472 if (ret) 473 goto out; 474 475 if (tlmi_priv.pwd_admin->valid) { 476 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 477 tlmi_priv.pwd_admin->password); 478 if (ret) 479 goto out; 480 } 481 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password); 482 if (ret) 483 goto out; 484 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd); 485 if (ret) 486 goto out; 487 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;"); 488 } else { 489 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */ 490 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;", 491 setting->pwd_type, setting->password, new_pwd, 492 encoding_options[setting->encoding], setting->kbdlang); 493 if (!auth_str) { 494 ret = -ENOMEM; 495 goto out; 496 } 497 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str); 498 kfree(auth_str); 499 } 500 out: 501 mutex_unlock(&tlmi_mutex); 502 kfree(new_pwd); 503 return ret ?: count; 504 } 505 506 static struct kobj_attribute auth_new_password = __ATTR_WO(new_password); 507 508 static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 509 char *buf) 510 { 511 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 512 513 return sysfs_emit(buf, "%d\n", setting->minlen); 514 } 515 516 static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length); 517 518 static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 519 char *buf) 520 { 521 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 522 523 return sysfs_emit(buf, "%d\n", setting->maxlen); 524 } 525 static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length); 526 527 static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr, 528 char *buf) 529 { 530 return sysfs_emit(buf, "password\n"); 531 } 532 static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism); 533 534 static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr, 535 char *buf) 536 { 537 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 538 539 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]); 540 } 541 542 static ssize_t encoding_store(struct kobject *kobj, 543 struct kobj_attribute *attr, 544 const char *buf, size_t count) 545 { 546 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 547 int i; 548 549 /* Scan for a matching profile */ 550 i = sysfs_match_string(encoding_options, buf); 551 if (i < 0) 552 return -EINVAL; 553 554 setting->encoding = i; 555 return count; 556 } 557 558 static struct kobj_attribute auth_encoding = __ATTR_RW(encoding); 559 560 static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr, 561 char *buf) 562 { 563 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 564 565 return sysfs_emit(buf, "%s\n", setting->kbdlang); 566 } 567 568 static ssize_t kbdlang_store(struct kobject *kobj, 569 struct kobj_attribute *attr, 570 const char *buf, size_t count) 571 { 572 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 573 int length; 574 575 /* Calculate length till '\n' or terminating 0 */ 576 length = strchrnul(buf, '\n') - buf; 577 if (!length || length >= TLMI_LANG_MAXLEN) 578 return -EINVAL; 579 580 memcpy(setting->kbdlang, buf, length); 581 setting->kbdlang[length] = '\0'; 582 return count; 583 } 584 585 static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang); 586 587 static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr, 588 char *buf) 589 { 590 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 591 592 return sysfs_emit(buf, "%s\n", setting->role); 593 } 594 static struct kobj_attribute auth_role = __ATTR_RO(role); 595 596 static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr, 597 char *buf) 598 { 599 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 600 601 return sysfs_emit(buf, "%d\n", setting->index); 602 } 603 604 static ssize_t index_store(struct kobject *kobj, 605 struct kobj_attribute *attr, 606 const char *buf, size_t count) 607 { 608 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 609 int err, val; 610 611 err = kstrtoint(buf, 10, &val); 612 if (err < 0) 613 return err; 614 615 if (val < 0 || val > TLMI_INDEX_MAX) 616 return -EINVAL; 617 618 setting->index = val; 619 return count; 620 } 621 622 static struct kobj_attribute auth_index = __ATTR_RW(index); 623 624 static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr, 625 char *buf) 626 { 627 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 628 629 return sysfs_emit(buf, "%s\n", level_options[setting->level]); 630 } 631 632 static ssize_t level_store(struct kobject *kobj, 633 struct kobj_attribute *attr, 634 const char *buf, size_t count) 635 { 636 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 637 int i; 638 639 /* Scan for a matching profile */ 640 i = sysfs_match_string(level_options, buf); 641 if (i < 0) 642 return -EINVAL; 643 644 setting->level = i; 645 return count; 646 } 647 648 static struct kobj_attribute auth_level = __ATTR_RW(level); 649 650 static ssize_t cert_thumbprint(char *buf, const char *arg, int count) 651 { 652 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 653 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 654 const union acpi_object *obj; 655 acpi_status status; 656 657 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output); 658 if (ACPI_FAILURE(status)) { 659 kfree(output.pointer); 660 return -EIO; 661 } 662 obj = output.pointer; 663 if (!obj) 664 return -ENOMEM; 665 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) { 666 kfree(output.pointer); 667 return -EIO; 668 } 669 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer); 670 kfree(output.pointer); 671 672 return count; 673 } 674 675 static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr, 676 char *buf) 677 { 678 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 679 int count = 0; 680 681 if (!tlmi_priv.certificate_support || !setting->cert_installed) 682 return -EOPNOTSUPP; 683 684 count += cert_thumbprint(buf, "Md5", count); 685 count += cert_thumbprint(buf, "Sha1", count); 686 count += cert_thumbprint(buf, "Sha256", count); 687 return count; 688 } 689 690 static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint); 691 692 static ssize_t cert_to_password_store(struct kobject *kobj, 693 struct kobj_attribute *attr, 694 const char *buf, size_t count) 695 { 696 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 697 char *auth_str, *passwd; 698 int ret; 699 700 if (!capable(CAP_SYS_ADMIN)) 701 return -EPERM; 702 703 if (!tlmi_priv.certificate_support) 704 return -EOPNOTSUPP; 705 706 if (!setting->cert_installed) 707 return -EINVAL; 708 709 if (!setting->signature || !setting->signature[0]) 710 return -EACCES; 711 712 passwd = kstrdup(buf, GFP_KERNEL); 713 if (!passwd) 714 return -ENOMEM; 715 716 /* Strip out CR if one is present */ 717 strip_cr(passwd); 718 719 /* Format: 'Password,Signature' */ 720 auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature); 721 if (!auth_str) { 722 kfree(passwd); 723 return -ENOMEM; 724 } 725 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str); 726 kfree(auth_str); 727 kfree(passwd); 728 729 return ret ?: count; 730 } 731 732 static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password); 733 734 static ssize_t certificate_store(struct kobject *kobj, 735 struct kobj_attribute *attr, 736 const char *buf, size_t count) 737 { 738 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 739 char *auth_str, *new_cert; 740 char *guid; 741 int ret; 742 743 if (!capable(CAP_SYS_ADMIN)) 744 return -EPERM; 745 746 if (!tlmi_priv.certificate_support) 747 return -EOPNOTSUPP; 748 749 /* If empty then clear installed certificate */ 750 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */ 751 /* Check that signature is set */ 752 if (!setting->signature || !setting->signature[0]) 753 return -EACCES; 754 755 /* Format: 'serial#, signature' */ 756 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 757 dmi_get_system_info(DMI_PRODUCT_SERIAL), 758 setting->signature); 759 if (!auth_str) 760 return -ENOMEM; 761 762 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str); 763 kfree(auth_str); 764 765 return ret ?: count; 766 } 767 768 new_cert = kstrdup(buf, GFP_KERNEL); 769 if (!new_cert) 770 return -ENOMEM; 771 /* Strip out CR if one is present */ 772 strip_cr(new_cert); 773 774 if (setting->cert_installed) { 775 /* Certificate is installed so this is an update */ 776 if (!setting->signature || !setting->signature[0]) { 777 kfree(new_cert); 778 return -EACCES; 779 } 780 guid = LENOVO_UPDATE_BIOS_CERT_GUID; 781 /* Format: 'Certificate,Signature' */ 782 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 783 new_cert, setting->signature); 784 } else { 785 /* This is a fresh install */ 786 if (!setting->valid || !setting->password[0]) { 787 kfree(new_cert); 788 return -EACCES; 789 } 790 guid = LENOVO_SET_BIOS_CERT_GUID; 791 /* Format: 'Certificate,Admin-password' */ 792 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 793 new_cert, setting->password); 794 } 795 kfree(new_cert); 796 if (!auth_str) 797 return -ENOMEM; 798 799 ret = tlmi_simple_call(guid, auth_str); 800 kfree(auth_str); 801 802 return ret ?: count; 803 } 804 805 static struct kobj_attribute auth_certificate = __ATTR_WO(certificate); 806 807 static ssize_t signature_store(struct kobject *kobj, 808 struct kobj_attribute *attr, 809 const char *buf, size_t count) 810 { 811 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 812 char *new_signature; 813 814 if (!capable(CAP_SYS_ADMIN)) 815 return -EPERM; 816 817 if (!tlmi_priv.certificate_support) 818 return -EOPNOTSUPP; 819 820 new_signature = kstrdup(buf, GFP_KERNEL); 821 if (!new_signature) 822 return -ENOMEM; 823 824 /* Strip out CR if one is present */ 825 strip_cr(new_signature); 826 827 /* Free any previous signature */ 828 kfree(setting->signature); 829 setting->signature = new_signature; 830 831 return count; 832 } 833 834 static struct kobj_attribute auth_signature = __ATTR_WO(signature); 835 836 static ssize_t save_signature_store(struct kobject *kobj, 837 struct kobj_attribute *attr, 838 const char *buf, size_t count) 839 { 840 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 841 char *new_signature; 842 843 if (!capable(CAP_SYS_ADMIN)) 844 return -EPERM; 845 846 if (!tlmi_priv.certificate_support) 847 return -EOPNOTSUPP; 848 849 new_signature = kstrdup(buf, GFP_KERNEL); 850 if (!new_signature) 851 return -ENOMEM; 852 853 /* Strip out CR if one is present */ 854 strip_cr(new_signature); 855 856 /* Free any previous signature */ 857 kfree(setting->save_signature); 858 setting->save_signature = new_signature; 859 860 return count; 861 } 862 863 static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature); 864 865 static umode_t auth_attr_is_visible(struct kobject *kobj, 866 struct attribute *attr, int n) 867 { 868 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 869 870 /* We only want to display level and index settings on HDD/NVMe */ 871 if (attr == &auth_index.attr || attr == &auth_level.attr) { 872 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme)) 873 return attr->mode; 874 return 0; 875 } 876 877 /* We only display certificates on Admin account, if supported */ 878 if (attr == &auth_certificate.attr || 879 attr == &auth_signature.attr || 880 attr == &auth_save_signature.attr || 881 attr == &auth_cert_thumb.attr || 882 attr == &auth_cert_to_password.attr) { 883 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support) 884 return attr->mode; 885 return 0; 886 } 887 888 return attr->mode; 889 } 890 891 static struct attribute *auth_attrs[] = { 892 &auth_is_pass_set.attr, 893 &auth_min_pass_length.attr, 894 &auth_max_pass_length.attr, 895 &auth_current_password.attr, 896 &auth_new_password.attr, 897 &auth_role.attr, 898 &auth_mechanism.attr, 899 &auth_encoding.attr, 900 &auth_kbdlang.attr, 901 &auth_index.attr, 902 &auth_level.attr, 903 &auth_certificate.attr, 904 &auth_signature.attr, 905 &auth_save_signature.attr, 906 &auth_cert_thumb.attr, 907 &auth_cert_to_password.attr, 908 NULL 909 }; 910 911 static const struct attribute_group auth_attr_group = { 912 .is_visible = auth_attr_is_visible, 913 .attrs = auth_attrs, 914 }; 915 916 /* ---- Attributes sysfs --------------------------------------------------------- */ 917 static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr, 918 char *buf) 919 { 920 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 921 922 return sysfs_emit(buf, "%s\n", setting->display_name); 923 } 924 925 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 926 { 927 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 928 char *item, *value, *p; 929 int ret; 930 931 ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID); 932 if (ret) 933 return ret; 934 935 /* validate and split from `item,value` -> `value` */ 936 value = strpbrk(item, ","); 937 if (!value || value == item || !strlen(value + 1)) 938 ret = -EINVAL; 939 else { 940 /* On Workstations remove the Options part after the value */ 941 p = strchrnul(value, ';'); 942 *p = '\0'; 943 ret = sysfs_emit(buf, "%s\n", value + 1); 944 } 945 kfree(item); 946 947 return ret; 948 } 949 950 static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 951 { 952 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 953 954 return sysfs_emit(buf, "%s\n", setting->possible_values); 955 } 956 957 static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, 958 char *buf) 959 { 960 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 961 962 if (setting->possible_values) { 963 /* Figure out what setting type is as BIOS does not return this */ 964 if (strchr(setting->possible_values, ';')) 965 return sysfs_emit(buf, "enumeration\n"); 966 } 967 /* Anything else is going to be a string */ 968 return sysfs_emit(buf, "string\n"); 969 } 970 971 static ssize_t current_value_store(struct kobject *kobj, 972 struct kobj_attribute *attr, 973 const char *buf, size_t count) 974 { 975 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 976 char *set_str = NULL, *new_setting = NULL; 977 char *auth_str = NULL; 978 int ret; 979 980 if (!tlmi_priv.can_set_bios_settings) 981 return -EOPNOTSUPP; 982 983 new_setting = kstrdup(buf, GFP_KERNEL); 984 if (!new_setting) 985 return -ENOMEM; 986 987 /* Strip out CR if one is present */ 988 strip_cr(new_setting); 989 990 /* Use lock in case multiple WMI operations needed */ 991 mutex_lock(&tlmi_mutex); 992 993 /* Check if certificate authentication is enabled and active */ 994 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) { 995 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) { 996 ret = -EINVAL; 997 goto out; 998 } 999 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 1000 new_setting, tlmi_priv.pwd_admin->signature); 1001 if (!set_str) { 1002 ret = -ENOMEM; 1003 goto out; 1004 } 1005 1006 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str); 1007 if (ret) 1008 goto out; 1009 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID, 1010 tlmi_priv.pwd_admin->save_signature); 1011 if (ret) 1012 goto out; 1013 } else if (tlmi_priv.opcode_support) { 1014 /* 1015 * If opcode support is present use that interface. 1016 * Note - this sets the variable and then the password as separate 1017 * WMI calls. Function tlmi_save_bios_settings will error if the 1018 * password is incorrect. 1019 */ 1020 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1021 new_setting); 1022 if (!set_str) { 1023 ret = -ENOMEM; 1024 goto out; 1025 } 1026 1027 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1028 if (ret) 1029 goto out; 1030 1031 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1032 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 1033 tlmi_priv.pwd_admin->password); 1034 if (ret) 1035 goto out; 1036 } 1037 1038 ret = tlmi_save_bios_settings(""); 1039 } else { /* old non-opcode based authentication method (deprecated) */ 1040 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1041 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1042 tlmi_priv.pwd_admin->password, 1043 encoding_options[tlmi_priv.pwd_admin->encoding], 1044 tlmi_priv.pwd_admin->kbdlang); 1045 if (!auth_str) { 1046 ret = -ENOMEM; 1047 goto out; 1048 } 1049 } 1050 1051 if (auth_str) 1052 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 1053 new_setting, auth_str); 1054 else 1055 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1056 new_setting); 1057 if (!set_str) { 1058 ret = -ENOMEM; 1059 goto out; 1060 } 1061 1062 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1063 if (ret) 1064 goto out; 1065 1066 if (auth_str) 1067 ret = tlmi_save_bios_settings(auth_str); 1068 else 1069 ret = tlmi_save_bios_settings(""); 1070 } 1071 if (!ret && !tlmi_priv.pending_changes) { 1072 tlmi_priv.pending_changes = true; 1073 /* let userland know it may need to check reboot pending again */ 1074 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1075 } 1076 out: 1077 mutex_unlock(&tlmi_mutex); 1078 kfree(auth_str); 1079 kfree(set_str); 1080 kfree(new_setting); 1081 return ret ?: count; 1082 } 1083 1084 static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name); 1085 1086 static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values); 1087 1088 static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600); 1089 1090 static struct kobj_attribute attr_type = __ATTR_RO(type); 1091 1092 static umode_t attr_is_visible(struct kobject *kobj, 1093 struct attribute *attr, int n) 1094 { 1095 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1096 1097 /* We don't want to display possible_values attributes if not available */ 1098 if ((attr == &attr_possible_values.attr) && (!setting->possible_values)) 1099 return 0; 1100 1101 return attr->mode; 1102 } 1103 1104 static struct attribute *tlmi_attrs[] = { 1105 &attr_displ_name.attr, 1106 &attr_current_val.attr, 1107 &attr_possible_values.attr, 1108 &attr_type.attr, 1109 NULL 1110 }; 1111 1112 static const struct attribute_group tlmi_attr_group = { 1113 .is_visible = attr_is_visible, 1114 .attrs = tlmi_attrs, 1115 }; 1116 1117 static void tlmi_attr_setting_release(struct kobject *kobj) 1118 { 1119 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1120 1121 kfree(setting->possible_values); 1122 kfree(setting); 1123 } 1124 1125 static void tlmi_pwd_setting_release(struct kobject *kobj) 1126 { 1127 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 1128 1129 kfree(setting); 1130 } 1131 1132 static const struct kobj_type tlmi_attr_setting_ktype = { 1133 .release = &tlmi_attr_setting_release, 1134 .sysfs_ops = &kobj_sysfs_ops, 1135 }; 1136 1137 static const struct kobj_type tlmi_pwd_setting_ktype = { 1138 .release = &tlmi_pwd_setting_release, 1139 .sysfs_ops = &kobj_sysfs_ops, 1140 }; 1141 1142 static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr, 1143 char *buf) 1144 { 1145 return sprintf(buf, "%d\n", tlmi_priv.pending_changes); 1146 } 1147 1148 static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot); 1149 1150 /* ---- Debug interface--------------------------------------------------------- */ 1151 static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr, 1152 const char *buf, size_t count) 1153 { 1154 char *set_str = NULL, *new_setting = NULL; 1155 char *auth_str = NULL; 1156 int ret; 1157 1158 if (!tlmi_priv.can_debug_cmd) 1159 return -EOPNOTSUPP; 1160 1161 new_setting = kstrdup(buf, GFP_KERNEL); 1162 if (!new_setting) 1163 return -ENOMEM; 1164 1165 /* Strip out CR if one is present */ 1166 strip_cr(new_setting); 1167 1168 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1169 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1170 tlmi_priv.pwd_admin->password, 1171 encoding_options[tlmi_priv.pwd_admin->encoding], 1172 tlmi_priv.pwd_admin->kbdlang); 1173 if (!auth_str) { 1174 ret = -ENOMEM; 1175 goto out; 1176 } 1177 } 1178 1179 if (auth_str) 1180 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str); 1181 else 1182 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting); 1183 if (!set_str) { 1184 ret = -ENOMEM; 1185 goto out; 1186 } 1187 1188 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str); 1189 if (ret) 1190 goto out; 1191 1192 if (!ret && !tlmi_priv.pending_changes) { 1193 tlmi_priv.pending_changes = true; 1194 /* let userland know it may need to check reboot pending again */ 1195 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1196 } 1197 out: 1198 kfree(auth_str); 1199 kfree(set_str); 1200 kfree(new_setting); 1201 return ret ?: count; 1202 } 1203 1204 static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd); 1205 1206 /* ---- Initialisation --------------------------------------------------------- */ 1207 static void tlmi_release_attr(void) 1208 { 1209 int i; 1210 1211 /* Attribute structures */ 1212 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1213 if (tlmi_priv.setting[i]) { 1214 sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1215 kobject_put(&tlmi_priv.setting[i]->kobj); 1216 } 1217 } 1218 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1219 if (tlmi_priv.can_debug_cmd && debug_support) 1220 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1221 1222 kset_unregister(tlmi_priv.attribute_kset); 1223 1224 /* Free up any saved signatures */ 1225 kfree(tlmi_priv.pwd_admin->signature); 1226 kfree(tlmi_priv.pwd_admin->save_signature); 1227 1228 /* Authentication structures */ 1229 sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1230 kobject_put(&tlmi_priv.pwd_admin->kobj); 1231 sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1232 kobject_put(&tlmi_priv.pwd_power->kobj); 1233 1234 if (tlmi_priv.opcode_support) { 1235 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1236 kobject_put(&tlmi_priv.pwd_system->kobj); 1237 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1238 kobject_put(&tlmi_priv.pwd_hdd->kobj); 1239 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1240 kobject_put(&tlmi_priv.pwd_nvme->kobj); 1241 } 1242 1243 kset_unregister(tlmi_priv.authentication_kset); 1244 } 1245 1246 static int tlmi_sysfs_init(void) 1247 { 1248 int i, ret; 1249 1250 ret = fw_attributes_class_get(&fw_attr_class); 1251 if (ret) 1252 return ret; 1253 1254 tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), 1255 NULL, "%s", "thinklmi"); 1256 if (IS_ERR(tlmi_priv.class_dev)) { 1257 ret = PTR_ERR(tlmi_priv.class_dev); 1258 goto fail_class_created; 1259 } 1260 1261 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL, 1262 &tlmi_priv.class_dev->kobj); 1263 if (!tlmi_priv.attribute_kset) { 1264 ret = -ENOMEM; 1265 goto fail_device_created; 1266 } 1267 1268 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1269 /* Check if index is a valid setting - skip if it isn't */ 1270 if (!tlmi_priv.setting[i]) 1271 continue; 1272 1273 /* check for duplicate or reserved values */ 1274 if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->display_name) || 1275 !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) { 1276 pr_debug("duplicate or reserved attribute name found - %s\n", 1277 tlmi_priv.setting[i]->display_name); 1278 kfree(tlmi_priv.setting[i]->possible_values); 1279 kfree(tlmi_priv.setting[i]); 1280 tlmi_priv.setting[i] = NULL; 1281 continue; 1282 } 1283 1284 /* Build attribute */ 1285 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; 1286 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, 1287 "%s", tlmi_priv.setting[i]->display_name); 1288 if (ret) 1289 goto fail_create_attr; 1290 1291 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1292 if (ret) 1293 goto fail_create_attr; 1294 } 1295 1296 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1297 if (ret) 1298 goto fail_create_attr; 1299 1300 if (tlmi_priv.can_debug_cmd && debug_support) { 1301 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1302 if (ret) 1303 goto fail_create_attr; 1304 } 1305 1306 /* Create authentication entries */ 1307 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, 1308 &tlmi_priv.class_dev->kobj); 1309 if (!tlmi_priv.authentication_kset) { 1310 ret = -ENOMEM; 1311 goto fail_create_attr; 1312 } 1313 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; 1314 ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); 1315 if (ret) 1316 goto fail_create_attr; 1317 1318 ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1319 if (ret) 1320 goto fail_create_attr; 1321 1322 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; 1323 ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); 1324 if (ret) 1325 goto fail_create_attr; 1326 1327 ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1328 if (ret) 1329 goto fail_create_attr; 1330 1331 if (tlmi_priv.opcode_support) { 1332 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; 1333 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); 1334 if (ret) 1335 goto fail_create_attr; 1336 1337 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1338 if (ret) 1339 goto fail_create_attr; 1340 1341 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; 1342 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); 1343 if (ret) 1344 goto fail_create_attr; 1345 1346 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1347 if (ret) 1348 goto fail_create_attr; 1349 1350 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; 1351 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); 1352 if (ret) 1353 goto fail_create_attr; 1354 1355 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1356 if (ret) 1357 goto fail_create_attr; 1358 } 1359 1360 return ret; 1361 1362 fail_create_attr: 1363 tlmi_release_attr(); 1364 fail_device_created: 1365 device_destroy(fw_attr_class, MKDEV(0, 0)); 1366 fail_class_created: 1367 fw_attributes_class_put(); 1368 return ret; 1369 } 1370 1371 /* ---- Base Driver -------------------------------------------------------- */ 1372 static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type, 1373 const char *pwd_role) 1374 { 1375 struct tlmi_pwd_setting *new_pwd; 1376 1377 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL); 1378 if (!new_pwd) 1379 return NULL; 1380 1381 strscpy(new_pwd->kbdlang, "us", TLMI_LANG_MAXLEN); 1382 new_pwd->encoding = TLMI_ENCODING_ASCII; 1383 new_pwd->pwd_type = pwd_type; 1384 new_pwd->role = pwd_role; 1385 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length; 1386 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; 1387 new_pwd->index = 0; 1388 1389 kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); 1390 1391 return new_pwd; 1392 } 1393 1394 static int tlmi_analyze(void) 1395 { 1396 int i, ret; 1397 1398 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) && 1399 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID)) 1400 tlmi_priv.can_set_bios_settings = true; 1401 1402 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID)) 1403 tlmi_priv.can_get_bios_selections = true; 1404 1405 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID)) 1406 tlmi_priv.can_set_bios_password = true; 1407 1408 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID)) 1409 tlmi_priv.can_get_password_settings = true; 1410 1411 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID)) 1412 tlmi_priv.can_debug_cmd = true; 1413 1414 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID)) 1415 tlmi_priv.opcode_support = true; 1416 1417 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) && 1418 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) && 1419 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID)) 1420 tlmi_priv.certificate_support = true; 1421 1422 /* 1423 * Try to find the number of valid settings of this machine 1424 * and use it to create sysfs attributes. 1425 */ 1426 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1427 struct tlmi_attr_setting *setting; 1428 char *item = NULL; 1429 char *p; 1430 1431 tlmi_priv.setting[i] = NULL; 1432 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID); 1433 if (ret) 1434 break; 1435 if (!item) 1436 break; 1437 if (!*item) { 1438 kfree(item); 1439 continue; 1440 } 1441 1442 /* It is not allowed to have '/' for file name. Convert it into '\'. */ 1443 strreplace(item, '/', '\\'); 1444 1445 /* Remove the value part */ 1446 p = strchrnul(item, ','); 1447 *p = '\0'; 1448 1449 /* Create a setting entry */ 1450 setting = kzalloc(sizeof(*setting), GFP_KERNEL); 1451 if (!setting) { 1452 ret = -ENOMEM; 1453 kfree(item); 1454 goto fail_clear_attr; 1455 } 1456 setting->index = i; 1457 strscpy(setting->display_name, item, TLMI_SETTINGS_MAXLEN); 1458 /* If BIOS selections supported, load those */ 1459 if (tlmi_priv.can_get_bios_selections) { 1460 ret = tlmi_get_bios_selections(setting->display_name, 1461 &setting->possible_values); 1462 if (ret || !setting->possible_values) 1463 pr_info("Error retrieving possible values for %d : %s\n", 1464 i, setting->display_name); 1465 } else { 1466 /* 1467 * Older Thinkstations don't support the bios_selections API. 1468 * Instead they store this as a [Optional:Option1,Option2] section of the 1469 * name string. 1470 * Try and pull that out if it's available. 1471 */ 1472 char *optitem, *optstart, *optend; 1473 1474 if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) { 1475 optstart = strstr(optitem, "[Optional:"); 1476 if (optstart) { 1477 optstart += strlen("[Optional:"); 1478 optend = strstr(optstart, "]"); 1479 if (optend) 1480 setting->possible_values = 1481 kstrndup(optstart, optend - optstart, 1482 GFP_KERNEL); 1483 } 1484 kfree(optitem); 1485 } 1486 } 1487 /* 1488 * firmware-attributes requires that possible_values are separated by ';' but 1489 * Lenovo FW uses ','. Replace appropriately. 1490 */ 1491 if (setting->possible_values) 1492 strreplace(setting->possible_values, ',', ';'); 1493 1494 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); 1495 tlmi_priv.setting[i] = setting; 1496 kfree(item); 1497 } 1498 1499 /* Create password setting structure */ 1500 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg); 1501 if (ret) 1502 goto fail_clear_attr; 1503 1504 /* All failures below boil down to kmalloc failures */ 1505 ret = -ENOMEM; 1506 1507 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin"); 1508 if (!tlmi_priv.pwd_admin) 1509 goto fail_clear_attr; 1510 1511 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD) 1512 tlmi_priv.pwd_admin->valid = true; 1513 1514 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on"); 1515 if (!tlmi_priv.pwd_power) 1516 goto fail_clear_attr; 1517 1518 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD) 1519 tlmi_priv.pwd_power->valid = true; 1520 1521 if (tlmi_priv.opcode_support) { 1522 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system"); 1523 if (!tlmi_priv.pwd_system) 1524 goto fail_clear_attr; 1525 1526 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD) 1527 tlmi_priv.pwd_system->valid = true; 1528 1529 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd"); 1530 if (!tlmi_priv.pwd_hdd) 1531 goto fail_clear_attr; 1532 1533 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme"); 1534 if (!tlmi_priv.pwd_nvme) 1535 goto fail_clear_attr; 1536 1537 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) { 1538 /* Check if PWD is configured and set index to first drive found */ 1539 if (tlmi_priv.pwdcfg.ext.hdd_user_password || 1540 tlmi_priv.pwdcfg.ext.hdd_master_password) { 1541 tlmi_priv.pwd_hdd->valid = true; 1542 if (tlmi_priv.pwdcfg.ext.hdd_master_password) 1543 tlmi_priv.pwd_hdd->index = 1544 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1; 1545 else 1546 tlmi_priv.pwd_hdd->index = 1547 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1; 1548 } 1549 if (tlmi_priv.pwdcfg.ext.nvme_user_password || 1550 tlmi_priv.pwdcfg.ext.nvme_master_password) { 1551 tlmi_priv.pwd_nvme->valid = true; 1552 if (tlmi_priv.pwdcfg.ext.nvme_master_password) 1553 tlmi_priv.pwd_nvme->index = 1554 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1; 1555 else 1556 tlmi_priv.pwd_nvme->index = 1557 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1; 1558 } 1559 } 1560 } 1561 1562 if (tlmi_priv.certificate_support && 1563 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT)) 1564 tlmi_priv.pwd_admin->cert_installed = true; 1565 1566 return 0; 1567 1568 fail_clear_attr: 1569 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1570 if (tlmi_priv.setting[i]) { 1571 kfree(tlmi_priv.setting[i]->possible_values); 1572 kfree(tlmi_priv.setting[i]); 1573 } 1574 } 1575 kfree(tlmi_priv.pwd_admin); 1576 kfree(tlmi_priv.pwd_power); 1577 kfree(tlmi_priv.pwd_system); 1578 kfree(tlmi_priv.pwd_hdd); 1579 kfree(tlmi_priv.pwd_nvme); 1580 return ret; 1581 } 1582 1583 static void tlmi_remove(struct wmi_device *wdev) 1584 { 1585 tlmi_release_attr(); 1586 device_destroy(fw_attr_class, MKDEV(0, 0)); 1587 fw_attributes_class_put(); 1588 } 1589 1590 static int tlmi_probe(struct wmi_device *wdev, const void *context) 1591 { 1592 int ret; 1593 1594 ret = tlmi_analyze(); 1595 if (ret) 1596 return ret; 1597 1598 return tlmi_sysfs_init(); 1599 } 1600 1601 static const struct wmi_device_id tlmi_id_table[] = { 1602 { .guid_string = LENOVO_BIOS_SETTING_GUID }, 1603 { } 1604 }; 1605 MODULE_DEVICE_TABLE(wmi, tlmi_id_table); 1606 1607 static struct wmi_driver tlmi_driver = { 1608 .driver = { 1609 .name = "think-lmi", 1610 }, 1611 .id_table = tlmi_id_table, 1612 .probe = tlmi_probe, 1613 .remove = tlmi_remove, 1614 }; 1615 1616 MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>"); 1617 MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>"); 1618 MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>"); 1619 MODULE_DESCRIPTION("ThinkLMI Driver"); 1620 MODULE_LICENSE("GPL"); 1621 1622 module_wmi_driver(tlmi_driver); 1623