]> git.ipfire.org Git - thirdparty/kernel/stable.git/blob - drivers/platform/x86/think-lmi.c
projects / thirdparty / kernel / stable.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'kvm-x86-mmu-6.7' of https://github.com/kvm-x86/linux into HEAD
[thirdparty/kernel/stable.git] / drivers / platform / x86 / think-lmi.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Think LMI BIOS configuration driver
4 *
5 * Copyright(C) 2019-2021 Lenovo
6 *
7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi
8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com>
9 * Distributed under the GPL-2.0 license
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <linux/acpi.h>
15 #include <linux/errno.h>
16 #include <linux/fs.h>
17 #include <linux/mutex.h>
18 #include <linux/string.h>
19 #include <linux/types.h>
20 #include <linux/dmi.h>
21 #include <linux/wmi.h>
22 #include "firmware_attributes_class.h"
23 #include "think-lmi.h"
24
25 static bool debug_support;
26 module_param(debug_support, bool, 0444);
27 MODULE_PARM_DESC(debug_support, "Enable debug command support");
28
29 /*
30 * Name: BiosSetting
31 * Description: Get item name and settings for current LMI instance.
32 * Type: Query
33 * Returns: "Item,Value"
34 * Example: "WakeOnLAN,Enable"
35 */
36 #define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7"
37
38 /*
39 * Name: SetBiosSetting
40 * Description: Change the BIOS setting to the desired value using the SetBiosSetting
41 * class. To save the settings, use the SaveBiosSetting class.
42 * BIOS settings and values are case sensitive.
43 * After making changes to the BIOS settings, you must reboot the computer
44 * before the changes will take effect.
45 * Type: Method
46 * Arguments: "Item,Value,Password,Encoding,KbdLang;"
47 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;"
48 */
49 #define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1"
50
51 /*
52 * Name: SaveBiosSettings
53 * Description: Save any pending changes in settings.
54 * Type: Method
55 * Arguments: "Password,Encoding,KbdLang;"
56 * Example: "pa55w0rd,ascii,us;"
57 */
58 #define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3"
59
60 /*
61 * Name: BiosPasswordSettings
62 * Description: Return BIOS Password settings
63 * Type: Query
64 * Returns: PasswordMode, PasswordState, MinLength, MaxLength,
65 * SupportedEncoding, SupportedKeyboard
66 */
67 #define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246"
68
69 /*
70 * Name: SetBiosPassword
71 * Description: Change a specific password.
72 * - BIOS settings cannot be changed at the same boot as power-on
73 * passwords (POP) and hard disk passwords (HDP). If you want to change
74 * BIOS settings and POP or HDP, you must reboot the system after changing
75 * one of them.
76 * - A password cannot be set using this method when one does not already
77 * exist. Passwords can only be updated or cleared.
78 * Type: Method
79 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;"
80 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;”
81 */
82 #define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7"
83
84 /*
85 * Name: GetBiosSelections
86 * Description: Return a list of valid settings for a given item.
87 * Type: Method
88 * Arguments: "Item"
89 * Returns: "Value1,Value2,Value3,..."
90 * Example:
91 * -> "FlashOverLAN"
92 * <- "Enabled,Disabled"
93 */
94 #define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B"
95
96 /*
97 * Name: DebugCmd
98 * Description: Debug entry method for entering debug commands to the BIOS
99 */
100 #define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1"
101
102 /*
103 * Name: OpcodeIF
104 * Description: Opcode interface which provides the ability to set multiple
105 * parameters and then trigger an action with a final command.
106 * This is particularly useful for simplifying setting passwords.
107 * With this support comes the ability to set System, HDD and NVMe
108 * passwords.
109 * This is currently available on ThinkCenter and ThinkStations platforms
110 */
111 #define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836"
112
113 /*
114 * Name: SetBiosCert
115 * Description: Install BIOS certificate.
116 * Type: Method
117 * Arguments: "Certificate,Password"
118 * You must reboot the computer before the changes will take effect.
119 */
120 #define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE"
121
122 /*
123 * Name: UpdateBiosCert
124 * Description: Update BIOS certificate.
125 * Type: Method
126 * Format: "Certificate,Signature"
127 * You must reboot the computer before the changes will take effect.
128 */
129 #define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE"
130
131 /*
132 * Name: ClearBiosCert
133 * Description: Uninstall BIOS certificate.
134 * Type: Method
135 * Format: "Serial,Signature"
136 * You must reboot the computer before the changes will take effect.
137 */
138 #define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890"
139 /*
140 * Name: CertToPassword
141 * Description: Switch from certificate to password authentication.
142 * Type: Method
143 * Format: "Password,Signature"
144 * You must reboot the computer before the changes will take effect.
145 */
146 #define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D"
147
148 /*
149 * Name: SetBiosSettingCert
150 * Description: Set attribute using certificate authentication.
151 * Type: Method
152 * Format: "Item,Value,Signature"
153 */
154 #define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003"
155
156 /*
157 * Name: SaveBiosSettingCert
158 * Description: Save any pending changes in settings.
159 * Type: Method
160 * Format: "Signature"
161 */
162 #define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551"
163
164 /*
165 * Name: CertThumbprint
166 * Description: Display Certificate thumbprints
167 * Type: Query
168 * Returns: MD5, SHA1 & SHA256 thumbprints
169 */
170 #define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4"
171
172 #define TLMI_POP_PWD BIT(0) /* Supervisor */
173 #define TLMI_PAP_PWD BIT(1) /* Power-on */
174 #define TLMI_HDD_PWD BIT(2) /* HDD/NVME */
175 #define TLMI_SMP_PWD BIT(6) /* System Management */
176 #define TLMI_CERT BIT(7) /* Certificate Based */
177
178 #define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj)
179 #define to_tlmi_attr_setting(kobj) container_of(kobj, struct tlmi_attr_setting, kobj)
180
181 static const struct tlmi_err_codes tlmi_errs[] = {
182 {"Success", 0},
183 {"Not Supported", -EOPNOTSUPP},
184 {"Invalid Parameter", -EINVAL},
185 {"Access Denied", -EACCES},
186 {"System Busy", -EBUSY},
187 };
188
189 static const char * const encoding_options[] = {
190 [TLMI_ENCODING_ASCII] = "ascii",
191 [TLMI_ENCODING_SCANCODE] = "scancode",
192 };
193 static const char * const level_options[] = {
194 [TLMI_LEVEL_USER] = "user",
195 [TLMI_LEVEL_MASTER] = "master",
196 };
197 static struct think_lmi tlmi_priv;
198 static struct class *fw_attr_class;
199 static DEFINE_MUTEX(tlmi_mutex);
200
201 /* ------ Utility functions ------------*/
202 /* Strip out CR if one is present */
203 static void strip_cr(char *str)
204 {
205 char *p = strchrnul(str, '\n');
206 *p = '\0';
207 }
208
209 /* Convert BIOS WMI error string to suitable error code */
210 static int tlmi_errstr_to_err(const char *errstr)
211 {
212 int i;
213
214 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) {
215 if (!strcmp(tlmi_errs[i].err_str, errstr))
216 return tlmi_errs[i].err_code;
217 }
218 return -EPERM;
219 }
220
221 /* Extract error string from WMI return buffer */
222 static int tlmi_extract_error(const struct acpi_buffer *output)
223 {
224 const union acpi_object *obj;
225
226 obj = output->pointer;
227 if (!obj)
228 return -ENOMEM;
229 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
230 return -EIO;
231
232 return tlmi_errstr_to_err(obj->string.pointer);
233 }
234
235 /* Utility function to execute WMI call to BIOS */
236 static int tlmi_simple_call(const char *guid, const char *arg)
237 {
238 const struct acpi_buffer input = { strlen(arg), (char *)arg };
239 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
240 acpi_status status;
241 int i, err;
242
243 /*
244 * Duplicated call required to match BIOS workaround for behavior
245 * seen when WMI accessed via scripting on other OS.
246 */
247 for (i = 0; i < 2; i++) {
248 /* (re)initialize output buffer to default state */
249 output.length = ACPI_ALLOCATE_BUFFER;
250 output.pointer = NULL;
251
252 status = wmi_evaluate_method(guid, 0, 0, &input, &output);
253 if (ACPI_FAILURE(status)) {
254 kfree(output.pointer);
255 return -EIO;
256 }
257 err = tlmi_extract_error(&output);
258 kfree(output.pointer);
259 if (err)
260 return err;
261 }
262 return 0;
263 }
264
265 /* Extract output string from WMI return buffer */
266 static int tlmi_extract_output_string(const struct acpi_buffer *output,
267 char **string)
268 {
269 const union acpi_object *obj;
270 char *s;
271
272 obj = output->pointer;
273 if (!obj)
274 return -ENOMEM;
275 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
276 return -EIO;
277
278 s = kstrdup(obj->string.pointer, GFP_KERNEL);
279 if (!s)
280 return -ENOMEM;
281 *string = s;
282 return 0;
283 }
284
285 /* ------ Core interface functions ------------*/
286
287 /* Get password settings from BIOS */
288 static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg)
289 {
290 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
291 const union acpi_object *obj;
292 acpi_status status;
293 int copy_size;
294
295 if (!tlmi_priv.can_get_password_settings)
296 return -EOPNOTSUPP;
297
298 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0,
299 &output);
300 if (ACPI_FAILURE(status))
301 return -EIO;
302
303 obj = output.pointer;
304 if (!obj)
305 return -ENOMEM;
306 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) {
307 kfree(obj);
308 return -EIO;
309 }
310 /*
311 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad.
312 * To make the driver compatible on different brands, we permit it to get
313 * the data in below case.
314 * Settings must have at minimum the core fields available
315 */
316 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) {
317 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length);
318 kfree(obj);
319 return -EIO;
320 }
321
322 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg));
323
324 memcpy(pwdcfg, obj->buffer.pointer, copy_size);
325 kfree(obj);
326
327 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE))
328 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1;
329 return 0;
330 }
331
332 static int tlmi_save_bios_settings(const char *password)
333 {
334 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID,
335 password);
336 }
337
338 static int tlmi_opcode_setting(char *setting, const char *value)
339 {
340 char *opcode_str;
341 int ret;
342
343 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value);
344 if (!opcode_str)
345 return -ENOMEM;
346
347 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str);
348 kfree(opcode_str);
349 return ret;
350 }
351
352 static int tlmi_setting(int item, char **value, const char *guid_string)
353 {
354 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
355 acpi_status status;
356 int ret;
357
358 status = wmi_query_block(guid_string, item, &output);
359 if (ACPI_FAILURE(status)) {
360 kfree(output.pointer);
361 return -EIO;
362 }
363
364 ret = tlmi_extract_output_string(&output, value);
365 kfree(output.pointer);
366 return ret;
367 }
368
369 static int tlmi_get_bios_selections(const char *item, char **value)
370 {
371 const struct acpi_buffer input = { strlen(item), (char *)item };
372 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
373 acpi_status status;
374 int ret;
375
376 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID,
377 0, 0, &input, &output);
378
379 if (ACPI_FAILURE(status)) {
380 kfree(output.pointer);
381 return -EIO;
382 }
383
384 ret = tlmi_extract_output_string(&output, value);
385 kfree(output.pointer);
386 return ret;
387 }
388
389 /* ---- Authentication sysfs --------------------------------------------------------- */
390 static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr,
391 char *buf)
392 {
393 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
394
395 return sysfs_emit(buf, "%d\n", setting->valid);
396 }
397
398 static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);
399
400 static ssize_t current_password_store(struct kobject *kobj,
401 struct kobj_attribute *attr,
402 const char *buf, size_t count)
403 {
404 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
405 size_t pwdlen;
406
407 pwdlen = strlen(buf);
408 /* pwdlen == 0 is allowed to clear the password */
409 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
410 return -EINVAL;
411
412 strscpy(setting->password, buf, setting->maxlen);
413 /* Strip out CR if one is present, setting password won't work if it is present */
414 strip_cr(setting->password);
415 return count;
416 }
417
418 static struct kobj_attribute auth_current_password = __ATTR_WO(current_password);
419
420 static ssize_t new_password_store(struct kobject *kobj,
421 struct kobj_attribute *attr,
422 const char *buf, size_t count)
423 {
424 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
425 char *auth_str, *new_pwd;
426 size_t pwdlen;
427 int ret;
428
429 if (!capable(CAP_SYS_ADMIN))
430 return -EPERM;
431
432 if (!tlmi_priv.can_set_bios_password)
433 return -EOPNOTSUPP;
434
435 new_pwd = kstrdup(buf, GFP_KERNEL);
436 if (!new_pwd)
437 return -ENOMEM;
438
439 /* Strip out CR if one is present, setting password won't work if it is present */
440 strip_cr(new_pwd);
441
442 /* Use lock in case multiple WMI operations needed */
443 mutex_lock(&tlmi_mutex);
444
445 pwdlen = strlen(new_pwd);
446 /* pwdlen == 0 is allowed to clear the password */
447 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
448 ret = -EINVAL;
449 goto out;
450 }
451
452 /* If opcode support is present use that interface */
453 if (tlmi_priv.opcode_support) {
454 char pwd_type[8];
455
456 /* Special handling required for HDD and NVMe passwords */
457 if (setting == tlmi_priv.pwd_hdd) {
458 if (setting->level == TLMI_LEVEL_USER)
459 sprintf(pwd_type, "uhdp%d", setting->index);
460 else
461 sprintf(pwd_type, "mhdp%d", setting->index);
462 } else if (setting == tlmi_priv.pwd_nvme) {
463 if (setting->level == TLMI_LEVEL_USER)
464 sprintf(pwd_type, "udrp%d", setting->index);
465 else
466 sprintf(pwd_type, "adrp%d", setting->index);
467 } else {
468 sprintf(pwd_type, "%s", setting->pwd_type);
469 }
470
471 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type);
472 if (ret)
473 goto out;
474
475 if (tlmi_priv.pwd_admin->valid) {
476 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
477 tlmi_priv.pwd_admin->password);
478 if (ret)
479 goto out;
480 }
481 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password);
482 if (ret)
483 goto out;
484 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd);
485 if (ret)
486 goto out;
487 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;");
488 } else {
489 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */
490 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;",
491 setting->pwd_type, setting->password, new_pwd,
492 encoding_options[setting->encoding], setting->kbdlang);
493 if (!auth_str) {
494 ret = -ENOMEM;
495 goto out;
496 }
497 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str);
498 kfree(auth_str);
499 }
500 out:
501 mutex_unlock(&tlmi_mutex);
502 kfree(new_pwd);
503 return ret ?: count;
504 }
505
506 static struct kobj_attribute auth_new_password = __ATTR_WO(new_password);
507
508 static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
509 char *buf)
510 {
511 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
512
513 return sysfs_emit(buf, "%d\n", setting->minlen);
514 }
515
516 static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length);
517
518 static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
519 char *buf)
520 {
521 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
522
523 return sysfs_emit(buf, "%d\n", setting->maxlen);
524 }
525 static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length);
526
527 static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr,
528 char *buf)
529 {
530 return sysfs_emit(buf, "password\n");
531 }
532 static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism);
533
534 static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr,
535 char *buf)
536 {
537 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
538
539 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]);
540 }
541
542 static ssize_t encoding_store(struct kobject *kobj,
543 struct kobj_attribute *attr,
544 const char *buf, size_t count)
545 {
546 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
547 int i;
548
549 /* Scan for a matching profile */
550 i = sysfs_match_string(encoding_options, buf);
551 if (i < 0)
552 return -EINVAL;
553
554 setting->encoding = i;
555 return count;
556 }
557
558 static struct kobj_attribute auth_encoding = __ATTR_RW(encoding);
559
560 static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr,
561 char *buf)
562 {
563 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
564
565 return sysfs_emit(buf, "%s\n", setting->kbdlang);
566 }
567
568 static ssize_t kbdlang_store(struct kobject *kobj,
569 struct kobj_attribute *attr,
570 const char *buf, size_t count)
571 {
572 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
573 int length;
574
575 /* Calculate length till '\n' or terminating 0 */
576 length = strchrnul(buf, '\n') - buf;
577 if (!length || length >= TLMI_LANG_MAXLEN)
578 return -EINVAL;
579
580 memcpy(setting->kbdlang, buf, length);
581 setting->kbdlang[length] = '\0';
582 return count;
583 }
584
585 static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang);
586
587 static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr,
588 char *buf)
589 {
590 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
591
592 return sysfs_emit(buf, "%s\n", setting->role);
593 }
594 static struct kobj_attribute auth_role = __ATTR_RO(role);
595
596 static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr,
597 char *buf)
598 {
599 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
600
601 return sysfs_emit(buf, "%d\n", setting->index);
602 }
603
604 static ssize_t index_store(struct kobject *kobj,
605 struct kobj_attribute *attr,
606 const char *buf, size_t count)
607 {
608 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
609 int err, val;
610
611 err = kstrtoint(buf, 10, &val);
612 if (err < 0)
613 return err;
614
615 if (val < 0 || val > TLMI_INDEX_MAX)
616 return -EINVAL;
617
618 setting->index = val;
619 return count;
620 }
621
622 static struct kobj_attribute auth_index = __ATTR_RW(index);
623
624 static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr,
625 char *buf)
626 {
627 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
628
629 return sysfs_emit(buf, "%s\n", level_options[setting->level]);
630 }
631
632 static ssize_t level_store(struct kobject *kobj,
633 struct kobj_attribute *attr,
634 const char *buf, size_t count)
635 {
636 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
637 int i;
638
639 /* Scan for a matching profile */
640 i = sysfs_match_string(level_options, buf);
641 if (i < 0)
642 return -EINVAL;
643
644 setting->level = i;
645 return count;
646 }
647
648 static struct kobj_attribute auth_level = __ATTR_RW(level);
649
650 static ssize_t cert_thumbprint(char *buf, const char *arg, int count)
651 {
652 const struct acpi_buffer input = { strlen(arg), (char *)arg };
653 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
654 const union acpi_object *obj;
655 acpi_status status;
656
657 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output);
658 if (ACPI_FAILURE(status)) {
659 kfree(output.pointer);
660 return -EIO;
661 }
662 obj = output.pointer;
663 if (!obj)
664 return -ENOMEM;
665 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) {
666 kfree(output.pointer);
667 return -EIO;
668 }
669 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer);
670 kfree(output.pointer);
671
672 return count;
673 }
674
675 static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,
676 char *buf)
677 {
678 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
679 int count = 0;
680
681 if (!tlmi_priv.certificate_support || !setting->cert_installed)
682 return -EOPNOTSUPP;
683
684 count += cert_thumbprint(buf, "Md5", count);
685 count += cert_thumbprint(buf, "Sha1", count);
686 count += cert_thumbprint(buf, "Sha256", count);
687 return count;
688 }
689
690 static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint);
691
692 static ssize_t cert_to_password_store(struct kobject *kobj,
693 struct kobj_attribute *attr,
694 const char *buf, size_t count)
695 {
696 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
697 char *auth_str, *passwd;
698 int ret;
699
700 if (!capable(CAP_SYS_ADMIN))
701 return -EPERM;
702
703 if (!tlmi_priv.certificate_support)
704 return -EOPNOTSUPP;
705
706 if (!setting->cert_installed)
707 return -EINVAL;
708
709 if (!setting->signature || !setting->signature[0])
710 return -EACCES;
711
712 passwd = kstrdup(buf, GFP_KERNEL);
713 if (!passwd)
714 return -ENOMEM;
715
716 /* Strip out CR if one is present */
717 strip_cr(passwd);
718
719 /* Format: 'Password,Signature' */
720 auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature);
721 if (!auth_str) {
722 kfree_sensitive(passwd);
723 return -ENOMEM;
724 }
725 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str);
726 kfree(auth_str);
727 kfree_sensitive(passwd);
728
729 return ret ?: count;
730 }
731
732 static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password);
733
734 static ssize_t certificate_store(struct kobject *kobj,
735 struct kobj_attribute *attr,
736 const char *buf, size_t count)
737 {
738 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
739 char *auth_str, *new_cert;
740 char *guid;
741 int ret;
742
743 if (!capable(CAP_SYS_ADMIN))
744 return -EPERM;
745
746 if (!tlmi_priv.certificate_support)
747 return -EOPNOTSUPP;
748
749 /* If empty then clear installed certificate */
750 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */
751 /* Check that signature is set */
752 if (!setting->signature || !setting->signature[0])
753 return -EACCES;
754
755 /* Format: 'serial#, signature' */
756 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
757 dmi_get_system_info(DMI_PRODUCT_SERIAL),
758 setting->signature);
759 if (!auth_str)
760 return -ENOMEM;
761
762 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str);
763 kfree(auth_str);
764
765 return ret ?: count;
766 }
767
768 new_cert = kstrdup(buf, GFP_KERNEL);
769 if (!new_cert)
770 return -ENOMEM;
771 /* Strip out CR if one is present */
772 strip_cr(new_cert);
773
774 if (setting->cert_installed) {
775 /* Certificate is installed so this is an update */
776 if (!setting->signature || !setting->signature[0]) {
777 kfree(new_cert);
778 return -EACCES;
779 }
780 guid = LENOVO_UPDATE_BIOS_CERT_GUID;
781 /* Format: 'Certificate,Signature' */
782 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
783 new_cert, setting->signature);
784 } else {
785 /* This is a fresh install */
786 if (!setting->valid || !setting->password[0]) {
787 kfree(new_cert);
788 return -EACCES;
789 }
790 guid = LENOVO_SET_BIOS_CERT_GUID;
791 /* Format: 'Certificate,Admin-password' */
792 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
793 new_cert, setting->password);
794 }
795 kfree(new_cert);
796 if (!auth_str)
797 return -ENOMEM;
798
799 ret = tlmi_simple_call(guid, auth_str);
800 kfree(auth_str);
801
802 return ret ?: count;
803 }
804
805 static struct kobj_attribute auth_certificate = __ATTR_WO(certificate);
806
807 static ssize_t signature_store(struct kobject *kobj,
808 struct kobj_attribute *attr,
809 const char *buf, size_t count)
810 {
811 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
812 char *new_signature;
813
814 if (!capable(CAP_SYS_ADMIN))
815 return -EPERM;
816
817 if (!tlmi_priv.certificate_support)
818 return -EOPNOTSUPP;
819
820 new_signature = kstrdup(buf, GFP_KERNEL);
821 if (!new_signature)
822 return -ENOMEM;
823
824 /* Strip out CR if one is present */
825 strip_cr(new_signature);
826
827 /* Free any previous signature */
828 kfree(setting->signature);
829 setting->signature = new_signature;
830
831 return count;
832 }
833
834 static struct kobj_attribute auth_signature = __ATTR_WO(signature);
835
836 static ssize_t save_signature_store(struct kobject *kobj,
837 struct kobj_attribute *attr,
838 const char *buf, size_t count)
839 {
840 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
841 char *new_signature;
842
843 if (!capable(CAP_SYS_ADMIN))
844 return -EPERM;
845
846 if (!tlmi_priv.certificate_support)
847 return -EOPNOTSUPP;
848
849 new_signature = kstrdup(buf, GFP_KERNEL);
850 if (!new_signature)
851 return -ENOMEM;
852
853 /* Strip out CR if one is present */
854 strip_cr(new_signature);
855
856 /* Free any previous signature */
857 kfree(setting->save_signature);
858 setting->save_signature = new_signature;
859
860 return count;
861 }
862
863 static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature);
864
865 static umode_t auth_attr_is_visible(struct kobject *kobj,
866 struct attribute *attr, int n)
867 {
868 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
869
870 /* We only want to display level and index settings on HDD/NVMe */
871 if (attr == &auth_index.attr || attr == &auth_level.attr) {
872 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme))
873 return attr->mode;
874 return 0;
875 }
876
877 /* We only display certificates on Admin account, if supported */
878 if (attr == &auth_certificate.attr ||
879 attr == &auth_signature.attr ||
880 attr == &auth_save_signature.attr ||
881 attr == &auth_cert_thumb.attr ||
882 attr == &auth_cert_to_password.attr) {
883 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support)
884 return attr->mode;
885 return 0;
886 }
887
888 /* Don't display un-needed settings if opcode available */
889 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) &&
890 tlmi_priv.opcode_support)
891 return 0;
892
893 return attr->mode;
894 }
895
896 static struct attribute *auth_attrs[] = {
897 &auth_is_pass_set.attr,
898 &auth_min_pass_length.attr,
899 &auth_max_pass_length.attr,
900 &auth_current_password.attr,
901 &auth_new_password.attr,
902 &auth_role.attr,
903 &auth_mechanism.attr,
904 &auth_encoding.attr,
905 &auth_kbdlang.attr,
906 &auth_index.attr,
907 &auth_level.attr,
908 &auth_certificate.attr,
909 &auth_signature.attr,
910 &auth_save_signature.attr,
911 &auth_cert_thumb.attr,
912 &auth_cert_to_password.attr,
913 NULL
914 };
915
916 static const struct attribute_group auth_attr_group = {
917 .is_visible = auth_attr_is_visible,
918 .attrs = auth_attrs,
919 };
920
921 /* ---- Attributes sysfs --------------------------------------------------------- */
922 static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,
923 char *buf)
924 {
925 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
926
927 return sysfs_emit(buf, "%s\n", setting->display_name);
928 }
929
930 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
931 {
932 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
933 char *item, *value, *p;
934 int ret;
935
936 ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID);
937 if (ret)
938 return ret;
939
940 /* validate and split from `item,value` -> `value` */
941 value = strpbrk(item, ",");
942 if (!value || value == item || !strlen(value + 1))
943 ret = -EINVAL;
944 else {
945 /* On Workstations remove the Options part after the value */
946 p = strchrnul(value, ';');
947 *p = '\0';
948 ret = sysfs_emit(buf, "%s\n", value + 1);
949 }
950 kfree(item);
951
952 return ret;
953 }
954
955 static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
956 {
957 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
958
959 return sysfs_emit(buf, "%s\n", setting->possible_values);
960 }
961
962 static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
963 char *buf)
964 {
965 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
966
967 if (setting->possible_values) {
968 /* Figure out what setting type is as BIOS does not return this */
969 if (strchr(setting->possible_values, ';'))
970 return sysfs_emit(buf, "enumeration\n");
971 }
972 /* Anything else is going to be a string */
973 return sysfs_emit(buf, "string\n");
974 }
975
976 static ssize_t current_value_store(struct kobject *kobj,
977 struct kobj_attribute *attr,
978 const char *buf, size_t count)
979 {
980 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
981 char *set_str = NULL, *new_setting = NULL;
982 char *auth_str = NULL;
983 int ret;
984
985 if (!tlmi_priv.can_set_bios_settings)
986 return -EOPNOTSUPP;
987
988 new_setting = kstrdup(buf, GFP_KERNEL);
989 if (!new_setting)
990 return -ENOMEM;
991
992 /* Strip out CR if one is present */
993 strip_cr(new_setting);
994
995 /* Use lock in case multiple WMI operations needed */
996 mutex_lock(&tlmi_mutex);
997
998 /* Check if certificate authentication is enabled and active */
999 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1000 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
1001 ret = -EINVAL;
1002 goto out;
1003 }
1004 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
1005 new_setting, tlmi_priv.pwd_admin->signature);
1006 if (!set_str) {
1007 ret = -ENOMEM;
1008 goto out;
1009 }
1010
1011 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str);
1012 if (ret)
1013 goto out;
1014 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,
1015 tlmi_priv.pwd_admin->save_signature);
1016 if (ret)
1017 goto out;
1018 } else if (tlmi_priv.opcode_support) {
1019 /*
1020 * If opcode support is present use that interface.
1021 * Note - this sets the variable and then the password as separate
1022 * WMI calls. Function tlmi_save_bios_settings will error if the
1023 * password is incorrect.
1024 */
1025 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
1026 new_setting);
1027 if (!set_str) {
1028 ret = -ENOMEM;
1029 goto out;
1030 }
1031
1032 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1033 if (ret)
1034 goto out;
1035
1036 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1037 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1038 tlmi_priv.pwd_admin->password);
1039 if (ret)
1040 goto out;
1041 }
1042
1043 ret = tlmi_save_bios_settings("");
1044 } else { /* old non-opcode based authentication method (deprecated) */
1045 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1046 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1047 tlmi_priv.pwd_admin->password,
1048 encoding_options[tlmi_priv.pwd_admin->encoding],
1049 tlmi_priv.pwd_admin->kbdlang);
1050 if (!auth_str) {
1051 ret = -ENOMEM;
1052 goto out;
1053 }
1054 }
1055
1056 if (auth_str)
1057 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
1058 new_setting, auth_str);
1059 else
1060 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
1061 new_setting);
1062 if (!set_str) {
1063 ret = -ENOMEM;
1064 goto out;
1065 }
1066
1067 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1068 if (ret)
1069 goto out;
1070
1071 if (auth_str)
1072 ret = tlmi_save_bios_settings(auth_str);
1073 else
1074 ret = tlmi_save_bios_settings("");
1075 }
1076 if (!ret && !tlmi_priv.pending_changes) {
1077 tlmi_priv.pending_changes = true;
1078 /* let userland know it may need to check reboot pending again */
1079 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1080 }
1081 out:
1082 mutex_unlock(&tlmi_mutex);
1083 kfree(auth_str);
1084 kfree(set_str);
1085 kfree(new_setting);
1086 return ret ?: count;
1087 }
1088
1089 static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name);
1090
1091 static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);
1092
1093 static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);
1094
1095 static struct kobj_attribute attr_type = __ATTR_RO(type);
1096
1097 static umode_t attr_is_visible(struct kobject *kobj,
1098 struct attribute *attr, int n)
1099 {
1100 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1101
1102 /* We don't want to display possible_values attributes if not available */
1103 if ((attr == &attr_possible_values.attr) && (!setting->possible_values))
1104 return 0;
1105
1106 return attr->mode;
1107 }
1108
1109 static struct attribute *tlmi_attrs[] = {
1110 &attr_displ_name.attr,
1111 &attr_current_val.attr,
1112 &attr_possible_values.attr,
1113 &attr_type.attr,
1114 NULL
1115 };
1116
1117 static const struct attribute_group tlmi_attr_group = {
1118 .is_visible = attr_is_visible,
1119 .attrs = tlmi_attrs,
1120 };
1121
1122 static void tlmi_attr_setting_release(struct kobject *kobj)
1123 {
1124 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1125
1126 kfree(setting->possible_values);
1127 kfree(setting);
1128 }
1129
1130 static void tlmi_pwd_setting_release(struct kobject *kobj)
1131 {
1132 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
1133
1134 kfree(setting);
1135 }
1136
1137 static const struct kobj_type tlmi_attr_setting_ktype = {
1138 .release = &tlmi_attr_setting_release,
1139 .sysfs_ops = &kobj_sysfs_ops,
1140 };
1141
1142 static const struct kobj_type tlmi_pwd_setting_ktype = {
1143 .release = &tlmi_pwd_setting_release,
1144 .sysfs_ops = &kobj_sysfs_ops,
1145 };
1146
1147 static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,
1148 char *buf)
1149 {
1150 return sprintf(buf, "%d\n", tlmi_priv.pending_changes);
1151 }
1152
1153 static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);
1154
1155 /* ---- Debug interface--------------------------------------------------------- */
1156 static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr,
1157 const char *buf, size_t count)
1158 {
1159 char *set_str = NULL, *new_setting = NULL;
1160 char *auth_str = NULL;
1161 int ret;
1162
1163 if (!tlmi_priv.can_debug_cmd)
1164 return -EOPNOTSUPP;
1165
1166 new_setting = kstrdup(buf, GFP_KERNEL);
1167 if (!new_setting)
1168 return -ENOMEM;
1169
1170 /* Strip out CR if one is present */
1171 strip_cr(new_setting);
1172
1173 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1174 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1175 tlmi_priv.pwd_admin->password,
1176 encoding_options[tlmi_priv.pwd_admin->encoding],
1177 tlmi_priv.pwd_admin->kbdlang);
1178 if (!auth_str) {
1179 ret = -ENOMEM;
1180 goto out;
1181 }
1182 }
1183
1184 if (auth_str)
1185 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str);
1186 else
1187 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting);
1188 if (!set_str) {
1189 ret = -ENOMEM;
1190 goto out;
1191 }
1192
1193 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str);
1194 if (ret)
1195 goto out;
1196
1197 if (!ret && !tlmi_priv.pending_changes) {
1198 tlmi_priv.pending_changes = true;
1199 /* let userland know it may need to check reboot pending again */
1200 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1201 }
1202 out:
1203 kfree(auth_str);
1204 kfree(set_str);
1205 kfree(new_setting);
1206 return ret ?: count;
1207 }
1208
1209 static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);
1210
1211 /* ---- Initialisation --------------------------------------------------------- */
1212 static void tlmi_release_attr(void)
1213 {
1214 int i;
1215
1216 /* Attribute structures */
1217 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1218 if (tlmi_priv.setting[i]) {
1219 sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
1220 kobject_put(&tlmi_priv.setting[i]->kobj);
1221 }
1222 }
1223 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1224 if (tlmi_priv.can_debug_cmd && debug_support)
1225 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1226
1227 kset_unregister(tlmi_priv.attribute_kset);
1228
1229 /* Free up any saved signatures */
1230 kfree(tlmi_priv.pwd_admin->signature);
1231 kfree(tlmi_priv.pwd_admin->save_signature);
1232
1233 /* Authentication structures */
1234 sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
1235 kobject_put(&tlmi_priv.pwd_admin->kobj);
1236 sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
1237 kobject_put(&tlmi_priv.pwd_power->kobj);
1238
1239 if (tlmi_priv.opcode_support) {
1240 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
1241 kobject_put(&tlmi_priv.pwd_system->kobj);
1242 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
1243 kobject_put(&tlmi_priv.pwd_hdd->kobj);
1244 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
1245 kobject_put(&tlmi_priv.pwd_nvme->kobj);
1246 }
1247
1248 kset_unregister(tlmi_priv.authentication_kset);
1249 }
1250
1251 static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)
1252 {
1253 struct kobject *duplicate;
1254
1255 if (!strcmp(name, "Reserved"))
1256 return -EINVAL;
1257
1258 duplicate = kset_find_obj(attribute_kset, name);
1259 if (duplicate) {
1260 pr_debug("Duplicate attribute name found - %s\n", name);
1261 /* kset_find_obj() returns a reference */
1262 kobject_put(duplicate);
1263 return -EBUSY;
1264 }
1265
1266 return 0;
1267 }
1268
1269 static int tlmi_sysfs_init(void)
1270 {
1271 int i, ret;
1272
1273 ret = fw_attributes_class_get(&fw_attr_class);
1274 if (ret)
1275 return ret;
1276
1277 tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0),
1278 NULL, "%s", "thinklmi");
1279 if (IS_ERR(tlmi_priv.class_dev)) {
1280 ret = PTR_ERR(tlmi_priv.class_dev);
1281 goto fail_class_created;
1282 }
1283
1284 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL,
1285 &tlmi_priv.class_dev->kobj);
1286 if (!tlmi_priv.attribute_kset) {
1287 ret = -ENOMEM;
1288 goto fail_device_created;
1289 }
1290
1291 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1292 /* Check if index is a valid setting - skip if it isn't */
1293 if (!tlmi_priv.setting[i])
1294 continue;
1295
1296 /* check for duplicate or reserved values */
1297 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
1298 tlmi_priv.setting[i]->display_name) < 0) {
1299 kfree(tlmi_priv.setting[i]->possible_values);
1300 kfree(tlmi_priv.setting[i]);
1301 tlmi_priv.setting[i] = NULL;
1302 continue;
1303 }
1304
1305 /* Build attribute */
1306 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
1307 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,
1308 "%s", tlmi_priv.setting[i]->display_name);
1309 if (ret)
1310 goto fail_create_attr;
1311
1312 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
1313 if (ret)
1314 goto fail_create_attr;
1315 }
1316
1317 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1318 if (ret)
1319 goto fail_create_attr;
1320
1321 if (tlmi_priv.can_debug_cmd && debug_support) {
1322 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1323 if (ret)
1324 goto fail_create_attr;
1325 }
1326
1327 /* Create authentication entries */
1328 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
1329 &tlmi_priv.class_dev->kobj);
1330 if (!tlmi_priv.authentication_kset) {
1331 ret = -ENOMEM;
1332 goto fail_create_attr;
1333 }
1334 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
1335 ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
1336 if (ret)
1337 goto fail_create_attr;
1338
1339 ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
1340 if (ret)
1341 goto fail_create_attr;
1342
1343 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
1344 ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");
1345 if (ret)
1346 goto fail_create_attr;
1347
1348 ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
1349 if (ret)
1350 goto fail_create_attr;
1351
1352 if (tlmi_priv.opcode_support) {
1353 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
1354 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");
1355 if (ret)
1356 goto fail_create_attr;
1357
1358 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
1359 if (ret)
1360 goto fail_create_attr;
1361
1362 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
1363 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");
1364 if (ret)
1365 goto fail_create_attr;
1366
1367 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
1368 if (ret)
1369 goto fail_create_attr;
1370
1371 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
1372 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");
1373 if (ret)
1374 goto fail_create_attr;
1375
1376 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
1377 if (ret)
1378 goto fail_create_attr;
1379 }
1380
1381 return ret;
1382
1383 fail_create_attr:
1384 tlmi_release_attr();
1385 fail_device_created:
1386 device_destroy(fw_attr_class, MKDEV(0, 0));
1387 fail_class_created:
1388 fw_attributes_class_put();
1389 return ret;
1390 }
1391
1392 /* ---- Base Driver -------------------------------------------------------- */
1393 static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,
1394 const char *pwd_role)
1395 {
1396 struct tlmi_pwd_setting *new_pwd;
1397
1398 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL);
1399 if (!new_pwd)
1400 return NULL;
1401
1402 strscpy(new_pwd->kbdlang, "us", TLMI_LANG_MAXLEN);
1403 new_pwd->encoding = TLMI_ENCODING_ASCII;
1404 new_pwd->pwd_type = pwd_type;
1405 new_pwd->role = pwd_role;
1406 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length;
1407 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
1408 new_pwd->index = 0;
1409
1410 kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);
1411
1412 return new_pwd;
1413 }
1414
1415 static int tlmi_analyze(void)
1416 {
1417 int i, ret;
1418
1419 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) &&
1420 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID))
1421 tlmi_priv.can_set_bios_settings = true;
1422
1423 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID))
1424 tlmi_priv.can_get_bios_selections = true;
1425
1426 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID))
1427 tlmi_priv.can_set_bios_password = true;
1428
1429 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID))
1430 tlmi_priv.can_get_password_settings = true;
1431
1432 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID))
1433 tlmi_priv.can_debug_cmd = true;
1434
1435 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID))
1436 tlmi_priv.opcode_support = true;
1437
1438 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) &&
1439 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) &&
1440 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID))
1441 tlmi_priv.certificate_support = true;
1442
1443 /*
1444 * Try to find the number of valid settings of this machine
1445 * and use it to create sysfs attributes.
1446 */
1447 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1448 struct tlmi_attr_setting *setting;
1449 char *item = NULL;
1450 char *p;
1451
1452 tlmi_priv.setting[i] = NULL;
1453 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID);
1454 if (ret)
1455 break;
1456 if (!item)
1457 break;
1458 if (!*item) {
1459 kfree(item);
1460 continue;
1461 }
1462
1463 /* It is not allowed to have '/' for file name. Convert it into '\'. */
1464 strreplace(item, '/', '\\');
1465
1466 /* Remove the value part */
1467 p = strchrnul(item, ',');
1468 *p = '\0';
1469
1470 /* Create a setting entry */
1471 setting = kzalloc(sizeof(*setting), GFP_KERNEL);
1472 if (!setting) {
1473 ret = -ENOMEM;
1474 kfree(item);
1475 goto fail_clear_attr;
1476 }
1477 setting->index = i;
1478 strscpy(setting->display_name, item, TLMI_SETTINGS_MAXLEN);
1479 /* If BIOS selections supported, load those */
1480 if (tlmi_priv.can_get_bios_selections) {
1481 ret = tlmi_get_bios_selections(setting->display_name,
1482 &setting->possible_values);
1483 if (ret || !setting->possible_values)
1484 pr_info("Error retrieving possible values for %d : %s\n",
1485 i, setting->display_name);
1486 } else {
1487 /*
1488 * Older Thinkstations don't support the bios_selections API.
1489 * Instead they store this as a [Optional:Option1,Option2] section of the
1490 * name string.
1491 * Try and pull that out if it's available.
1492 */
1493 char *optitem, *optstart, *optend;
1494
1495 if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) {
1496 optstart = strstr(optitem, "[Optional:");
1497 if (optstart) {
1498 optstart += strlen("[Optional:");
1499 optend = strstr(optstart, "]");
1500 if (optend)
1501 setting->possible_values =
1502 kstrndup(optstart, optend - optstart,
1503 GFP_KERNEL);
1504 }
1505 kfree(optitem);
1506 }
1507 }
1508 /*
1509 * firmware-attributes requires that possible_values are separated by ';' but
1510 * Lenovo FW uses ','. Replace appropriately.
1511 */
1512 if (setting->possible_values)
1513 strreplace(setting->possible_values, ',', ';');
1514
1515 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
1516 tlmi_priv.setting[i] = setting;
1517 kfree(item);
1518 }
1519
1520 /* Create password setting structure */
1521 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg);
1522 if (ret)
1523 goto fail_clear_attr;
1524
1525 /* All failures below boil down to kmalloc failures */
1526 ret = -ENOMEM;
1527
1528 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin");
1529 if (!tlmi_priv.pwd_admin)
1530 goto fail_clear_attr;
1531
1532 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)
1533 tlmi_priv.pwd_admin->valid = true;
1534
1535 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");
1536 if (!tlmi_priv.pwd_power)
1537 goto fail_clear_attr;
1538
1539 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)
1540 tlmi_priv.pwd_power->valid = true;
1541
1542 if (tlmi_priv.opcode_support) {
1543 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
1544 if (!tlmi_priv.pwd_system)
1545 goto fail_clear_attr;
1546
1547 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
1548 tlmi_priv.pwd_system->valid = true;
1549
1550 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
1551 if (!tlmi_priv.pwd_hdd)
1552 goto fail_clear_attr;
1553
1554 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme");
1555 if (!tlmi_priv.pwd_nvme)
1556 goto fail_clear_attr;
1557
1558 /* Set default hdd/nvme index to 1 as there is no device 0 */
1559 tlmi_priv.pwd_hdd->index = 1;
1560 tlmi_priv.pwd_nvme->index = 1;
1561
1562 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) {
1563 /* Check if PWD is configured and set index to first drive found */
1564 if (tlmi_priv.pwdcfg.ext.hdd_user_password ||
1565 tlmi_priv.pwdcfg.ext.hdd_master_password) {
1566 tlmi_priv.pwd_hdd->valid = true;
1567 if (tlmi_priv.pwdcfg.ext.hdd_master_password)
1568 tlmi_priv.pwd_hdd->index =
1569 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;
1570 else
1571 tlmi_priv.pwd_hdd->index =
1572 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1;
1573 }
1574 if (tlmi_priv.pwdcfg.ext.nvme_user_password ||
1575 tlmi_priv.pwdcfg.ext.nvme_master_password) {
1576 tlmi_priv.pwd_nvme->valid = true;
1577 if (tlmi_priv.pwdcfg.ext.nvme_master_password)
1578 tlmi_priv.pwd_nvme->index =
1579 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;
1580 else
1581 tlmi_priv.pwd_nvme->index =
1582 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1;
1583 }
1584 }
1585 }
1586
1587 if (tlmi_priv.certificate_support &&
1588 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT))
1589 tlmi_priv.pwd_admin->cert_installed = true;
1590
1591 return 0;
1592
1593 fail_clear_attr:
1594 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1595 if (tlmi_priv.setting[i]) {
1596 kfree(tlmi_priv.setting[i]->possible_values);
1597 kfree(tlmi_priv.setting[i]);
1598 }
1599 }
1600 kfree(tlmi_priv.pwd_admin);
1601 kfree(tlmi_priv.pwd_power);
1602 kfree(tlmi_priv.pwd_system);
1603 kfree(tlmi_priv.pwd_hdd);
1604 kfree(tlmi_priv.pwd_nvme);
1605 return ret;
1606 }
1607
1608 static void tlmi_remove(struct wmi_device *wdev)
1609 {
1610 tlmi_release_attr();
1611 device_destroy(fw_attr_class, MKDEV(0, 0));
1612 fw_attributes_class_put();
1613 }
1614
1615 static int tlmi_probe(struct wmi_device *wdev, const void *context)
1616 {
1617 int ret;
1618
1619 ret = tlmi_analyze();
1620 if (ret)
1621 return ret;
1622
1623 return tlmi_sysfs_init();
1624 }
1625
1626 static const struct wmi_device_id tlmi_id_table[] = {
1627 { .guid_string = LENOVO_BIOS_SETTING_GUID },
1628 { }
1629 };
1630 MODULE_DEVICE_TABLE(wmi, tlmi_id_table);
1631
1632 static struct wmi_driver tlmi_driver = {
1633 .driver = {
1634 .name = "think-lmi",
1635 },
1636 .id_table = tlmi_id_table,
1637 .probe = tlmi_probe,
1638 .remove = tlmi_remove,
1639 };
1640
1641 MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>");
1642 MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>");
1643 MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>");
1644 MODULE_DESCRIPTION("ThinkLMI Driver");
1645 MODULE_LICENSE("GPL");
1646
1647 module_wmi_driver(tlmi_driver);
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git