1755 lines · c
1// SPDX-License-Identifier: GPL-2.0-or-later2/*3 * Think LMI BIOS configuration driver4 *5 * Copyright(C) 2019-2021 Lenovo6 *7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com>9 * Distributed under the GPL-2.0 license10 */11 12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt13 14#include <linux/acpi.h>15#include <linux/errno.h>16#include <linux/fs.h>17#include <linux/mutex.h>18#include <linux/string_helpers.h>19#include <linux/types.h>20#include <linux/dmi.h>21#include <linux/wmi.h>22#include "firmware_attributes_class.h"23#include "think-lmi.h"24 25static bool debug_support;26module_param(debug_support, bool, 0444);27MODULE_PARM_DESC(debug_support, "Enable debug command support");28 29/*30 * Name: BiosSetting31 * Description: Get item name and settings for current LMI instance.32 * Type: Query33 * Returns: "Item,Value"34 * Example: "WakeOnLAN,Enable"35 */36#define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7"37 38/*39 * Name: SetBiosSetting40 * Description: Change the BIOS setting to the desired value using the SetBiosSetting41 * class. To save the settings, use the SaveBiosSetting class.42 * BIOS settings and values are case sensitive.43 * After making changes to the BIOS settings, you must reboot the computer44 * before the changes will take effect.45 * Type: Method46 * Arguments: "Item,Value,Password,Encoding,KbdLang;"47 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;"48 */49#define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1"50 51/*52 * Name: SaveBiosSettings53 * Description: Save any pending changes in settings.54 * Type: Method55 * Arguments: "Password,Encoding,KbdLang;"56 * Example: "pa55w0rd,ascii,us;"57 */58#define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3"59 60/*61 * Name: BiosPasswordSettings62 * Description: Return BIOS Password settings63 * Type: Query64 * Returns: PasswordMode, PasswordState, MinLength, MaxLength,65 * SupportedEncoding, SupportedKeyboard66 */67#define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246"68 69/*70 * Name: SetBiosPassword71 * Description: Change a specific password.72 * - BIOS settings cannot be changed at the same boot as power-on73 * passwords (POP) and hard disk passwords (HDP). If you want to change74 * BIOS settings and POP or HDP, you must reboot the system after changing75 * one of them.76 * - A password cannot be set using this method when one does not already77 * exist. Passwords can only be updated or cleared.78 * Type: Method79 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;"80 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;”81 */82#define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7"83 84/*85 * Name: GetBiosSelections86 * Description: Return a list of valid settings for a given item.87 * Type: Method88 * Arguments: "Item"89 * Returns: "Value1,Value2,Value3,..."90 * Example:91 * -> "FlashOverLAN"92 * <- "Enabled,Disabled"93 */94#define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B"95 96/*97 * Name: DebugCmd98 * Description: Debug entry method for entering debug commands to the BIOS99 */100#define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1"101 102/*103 * Name: OpcodeIF104 * Description: Opcode interface which provides the ability to set multiple105 * parameters and then trigger an action with a final command.106 * This is particularly useful for simplifying setting passwords.107 * With this support comes the ability to set System, HDD and NVMe108 * passwords.109 * This is currently available on ThinkCenter and ThinkStations platforms110 */111#define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836"112 113/*114 * Name: SetBiosCert115 * Description: Install BIOS certificate.116 * Type: Method117 * Arguments: "Certificate,Password"118 * You must reboot the computer before the changes will take effect.119 */120#define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE"121 122/*123 * Name: UpdateBiosCert124 * Description: Update BIOS certificate.125 * Type: Method126 * Format: "Certificate,Signature"127 * You must reboot the computer before the changes will take effect.128 */129#define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE"130 131/*132 * Name: ClearBiosCert133 * Description: Uninstall BIOS certificate.134 * Type: Method135 * Format: "Serial,Signature"136 * You must reboot the computer before the changes will take effect.137 */138#define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890"139/*140 * Name: CertToPassword141 * Description: Switch from certificate to password authentication.142 * Type: Method143 * Format: "Password,Signature"144 * You must reboot the computer before the changes will take effect.145 */146#define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D"147 148/*149 * Name: SetBiosSettingCert150 * Description: Set attribute using certificate authentication.151 * Type: Method152 * Format: "Item,Value,Signature"153 */154#define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003"155 156/*157 * Name: SaveBiosSettingCert158 * Description: Save any pending changes in settings.159 * Type: Method160 * Format: "Signature"161 */162#define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551"163 164/*165 * Name: CertThumbprint166 * Description: Display Certificate thumbprints167 * Type: Query168 * Returns: MD5, SHA1 & SHA256 thumbprints169 */170#define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4"171 172#define TLMI_POP_PWD BIT(0) /* Supervisor */173#define TLMI_PAP_PWD BIT(1) /* Power-on */174#define TLMI_HDD_PWD BIT(2) /* HDD/NVME */175#define TLMI_SMP_PWD BIT(6) /* System Management */176#define TLMI_CERT BIT(7) /* Certificate Based */177 178static const struct tlmi_err_codes tlmi_errs[] = {179 {"Success", 0},180 {"Not Supported", -EOPNOTSUPP},181 {"Invalid Parameter", -EINVAL},182 {"Access Denied", -EACCES},183 {"System Busy", -EBUSY},184};185 186static const char * const encoding_options[] = {187 [TLMI_ENCODING_ASCII] = "ascii",188 [TLMI_ENCODING_SCANCODE] = "scancode",189};190static const char * const level_options[] = {191 [TLMI_LEVEL_USER] = "user",192 [TLMI_LEVEL_MASTER] = "master",193};194static struct think_lmi tlmi_priv;195static const struct class *fw_attr_class;196static DEFINE_MUTEX(tlmi_mutex);197 198static inline struct tlmi_pwd_setting *to_tlmi_pwd_setting(struct kobject *kobj)199{200 return container_of(kobj, struct tlmi_pwd_setting, kobj);201}202 203static inline struct tlmi_attr_setting *to_tlmi_attr_setting(struct kobject *kobj)204{205 return container_of(kobj, struct tlmi_attr_setting, kobj);206}207 208/* Convert BIOS WMI error string to suitable error code */209static int tlmi_errstr_to_err(const char *errstr)210{211 int i;212 213 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) {214 if (!strcmp(tlmi_errs[i].err_str, errstr))215 return tlmi_errs[i].err_code;216 }217 return -EPERM;218}219 220/* Extract error string from WMI return buffer */221static int tlmi_extract_error(const struct acpi_buffer *output)222{223 const union acpi_object *obj;224 225 obj = output->pointer;226 if (!obj)227 return -ENOMEM;228 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)229 return -EIO;230 231 return tlmi_errstr_to_err(obj->string.pointer);232}233 234/* Utility function to execute WMI call to BIOS */235static int tlmi_simple_call(const char *guid, const char *arg)236{237 const struct acpi_buffer input = { strlen(arg), (char *)arg };238 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };239 acpi_status status;240 int i, err;241 242 /*243 * Duplicated call required to match BIOS workaround for behavior244 * seen when WMI accessed via scripting on other OS.245 */246 for (i = 0; i < 2; i++) {247 /* (re)initialize output buffer to default state */248 output.length = ACPI_ALLOCATE_BUFFER;249 output.pointer = NULL;250 251 status = wmi_evaluate_method(guid, 0, 0, &input, &output);252 if (ACPI_FAILURE(status)) {253 kfree(output.pointer);254 return -EIO;255 }256 err = tlmi_extract_error(&output);257 kfree(output.pointer);258 if (err)259 return err;260 }261 return 0;262}263 264/* Extract output string from WMI return buffer */265static int tlmi_extract_output_string(const struct acpi_buffer *output,266 char **string)267{268 const union acpi_object *obj;269 char *s;270 271 obj = output->pointer;272 if (!obj)273 return -ENOMEM;274 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)275 return -EIO;276 277 s = kstrdup(obj->string.pointer, GFP_KERNEL);278 if (!s)279 return -ENOMEM;280 *string = s;281 return 0;282}283 284/* ------ Core interface functions ------------*/285 286/* Get password settings from BIOS */287static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg)288{289 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };290 const union acpi_object *obj;291 acpi_status status;292 int copy_size;293 294 if (!tlmi_priv.can_get_password_settings)295 return -EOPNOTSUPP;296 297 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0,298 &output);299 if (ACPI_FAILURE(status))300 return -EIO;301 302 obj = output.pointer;303 if (!obj)304 return -ENOMEM;305 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) {306 kfree(obj);307 return -EIO;308 }309 /*310 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad.311 * To make the driver compatible on different brands, we permit it to get312 * the data in below case.313 * Settings must have at minimum the core fields available314 */315 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) {316 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length);317 kfree(obj);318 return -EIO;319 }320 321 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg));322 323 memcpy(pwdcfg, obj->buffer.pointer, copy_size);324 kfree(obj);325 326 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE))327 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1;328 return 0;329}330 331static int tlmi_save_bios_settings(const char *password)332{333 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID,334 password);335}336 337static int tlmi_opcode_setting(char *setting, const char *value)338{339 char *opcode_str;340 int ret;341 342 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value);343 if (!opcode_str)344 return -ENOMEM;345 346 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str);347 kfree(opcode_str);348 return ret;349}350 351static int tlmi_setting(int item, char **value, const char *guid_string)352{353 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };354 acpi_status status;355 int ret;356 357 status = wmi_query_block(guid_string, item, &output);358 if (ACPI_FAILURE(status)) {359 kfree(output.pointer);360 return -EIO;361 }362 363 ret = tlmi_extract_output_string(&output, value);364 kfree(output.pointer);365 return ret;366}367 368static int tlmi_get_bios_selections(const char *item, char **value)369{370 const struct acpi_buffer input = { strlen(item), (char *)item };371 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };372 acpi_status status;373 int ret;374 375 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID,376 0, 0, &input, &output);377 378 if (ACPI_FAILURE(status)) {379 kfree(output.pointer);380 return -EIO;381 }382 383 ret = tlmi_extract_output_string(&output, value);384 kfree(output.pointer);385 return ret;386}387 388/* ---- Authentication sysfs --------------------------------------------------------- */389static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr,390 char *buf)391{392 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);393 394 return sysfs_emit(buf, "%d\n", setting->valid);395}396 397static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);398 399static ssize_t current_password_store(struct kobject *kobj,400 struct kobj_attribute *attr,401 const char *buf, size_t count)402{403 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);404 size_t pwdlen;405 406 pwdlen = strlen(buf);407 /* pwdlen == 0 is allowed to clear the password */408 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))409 return -EINVAL;410 411 strscpy(setting->password, buf, setting->maxlen);412 /* Strip out CR if one is present, setting password won't work if it is present */413 strreplace(setting->password, '\n', '\0');414 return count;415}416 417static struct kobj_attribute auth_current_password = __ATTR_WO(current_password);418 419static ssize_t new_password_store(struct kobject *kobj,420 struct kobj_attribute *attr,421 const char *buf, size_t count)422{423 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);424 char *auth_str, *new_pwd;425 size_t pwdlen;426 int ret;427 428 if (!capable(CAP_SYS_ADMIN))429 return -EPERM;430 431 if (!tlmi_priv.can_set_bios_password)432 return -EOPNOTSUPP;433 434 /* Strip out CR if one is present, setting password won't work if it is present */435 new_pwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);436 if (!new_pwd)437 return -ENOMEM;438 439 /* Use lock in case multiple WMI operations needed */440 mutex_lock(&tlmi_mutex);441 442 pwdlen = strlen(new_pwd);443 /* pwdlen == 0 is allowed to clear the password */444 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {445 ret = -EINVAL;446 goto out;447 }448 449 /* If opcode support is present use that interface */450 if (tlmi_priv.opcode_support) {451 char pwd_type[8];452 453 /* Special handling required for HDD and NVMe passwords */454 if (setting == tlmi_priv.pwd_hdd) {455 if (setting->level == TLMI_LEVEL_USER)456 sprintf(pwd_type, "uhdp%d", setting->index);457 else458 sprintf(pwd_type, "mhdp%d", setting->index);459 } else if (setting == tlmi_priv.pwd_nvme) {460 if (setting->level == TLMI_LEVEL_USER)461 sprintf(pwd_type, "udrp%d", setting->index);462 else463 sprintf(pwd_type, "adrp%d", setting->index);464 } else {465 sprintf(pwd_type, "%s", setting->pwd_type);466 }467 468 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type);469 if (ret)470 goto out;471 472 if (tlmi_priv.pwd_admin->valid) {473 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",474 tlmi_priv.pwd_admin->password);475 if (ret)476 goto out;477 }478 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password);479 if (ret)480 goto out;481 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd);482 if (ret)483 goto out;484 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;");485 } else {486 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */487 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;",488 setting->pwd_type, setting->password, new_pwd,489 encoding_options[setting->encoding], setting->kbdlang);490 if (!auth_str) {491 ret = -ENOMEM;492 goto out;493 }494 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str);495 kfree(auth_str);496 }497out:498 mutex_unlock(&tlmi_mutex);499 kfree(new_pwd);500 return ret ?: count;501}502 503static struct kobj_attribute auth_new_password = __ATTR_WO(new_password);504 505static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,506 char *buf)507{508 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);509 510 return sysfs_emit(buf, "%d\n", setting->minlen);511}512 513static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length);514 515static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,516 char *buf)517{518 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);519 520 return sysfs_emit(buf, "%d\n", setting->maxlen);521}522static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length);523 524static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr,525 char *buf)526{527 return sysfs_emit(buf, "password\n");528}529static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism);530 531static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr,532 char *buf)533{534 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);535 536 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]);537}538 539static ssize_t encoding_store(struct kobject *kobj,540 struct kobj_attribute *attr,541 const char *buf, size_t count)542{543 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);544 int i;545 546 /* Scan for a matching profile */547 i = sysfs_match_string(encoding_options, buf);548 if (i < 0)549 return -EINVAL;550 551 setting->encoding = i;552 return count;553}554 555static struct kobj_attribute auth_encoding = __ATTR_RW(encoding);556 557static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr,558 char *buf)559{560 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);561 562 return sysfs_emit(buf, "%s\n", setting->kbdlang);563}564 565static ssize_t kbdlang_store(struct kobject *kobj,566 struct kobj_attribute *attr,567 const char *buf, size_t count)568{569 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);570 int length;571 572 /* Calculate length till '\n' or terminating 0 */573 length = strchrnul(buf, '\n') - buf;574 if (!length || length >= TLMI_LANG_MAXLEN)575 return -EINVAL;576 577 memcpy(setting->kbdlang, buf, length);578 setting->kbdlang[length] = '\0';579 return count;580}581 582static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang);583 584static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr,585 char *buf)586{587 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);588 589 return sysfs_emit(buf, "%s\n", setting->role);590}591static struct kobj_attribute auth_role = __ATTR_RO(role);592 593static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr,594 char *buf)595{596 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);597 598 return sysfs_emit(buf, "%d\n", setting->index);599}600 601static ssize_t index_store(struct kobject *kobj,602 struct kobj_attribute *attr,603 const char *buf, size_t count)604{605 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);606 int err, val;607 608 err = kstrtoint(buf, 10, &val);609 if (err < 0)610 return err;611 612 if (val < 0 || val > TLMI_INDEX_MAX)613 return -EINVAL;614 615 setting->index = val;616 return count;617}618 619static struct kobj_attribute auth_index = __ATTR_RW(index);620 621static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr,622 char *buf)623{624 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);625 626 return sysfs_emit(buf, "%s\n", level_options[setting->level]);627}628 629static ssize_t level_store(struct kobject *kobj,630 struct kobj_attribute *attr,631 const char *buf, size_t count)632{633 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);634 int i;635 636 /* Scan for a matching profile */637 i = sysfs_match_string(level_options, buf);638 if (i < 0)639 return -EINVAL;640 641 setting->level = i;642 return count;643}644 645static struct kobj_attribute auth_level = __ATTR_RW(level);646 647static ssize_t cert_thumbprint(char *buf, const char *arg, int count)648{649 const struct acpi_buffer input = { strlen(arg), (char *)arg };650 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };651 const union acpi_object *obj;652 acpi_status status;653 654 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output);655 if (ACPI_FAILURE(status)) {656 kfree(output.pointer);657 return -EIO;658 }659 obj = output.pointer;660 if (!obj)661 return -ENOMEM;662 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) {663 kfree(output.pointer);664 return -EIO;665 }666 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer);667 kfree(output.pointer);668 669 return count;670}671 672static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,673 char *buf)674{675 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);676 int count = 0;677 678 if (!tlmi_priv.certificate_support || !setting->cert_installed)679 return -EOPNOTSUPP;680 681 count += cert_thumbprint(buf, "Md5", count);682 count += cert_thumbprint(buf, "Sha1", count);683 count += cert_thumbprint(buf, "Sha256", count);684 return count;685}686 687static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint);688 689static ssize_t cert_to_password_store(struct kobject *kobj,690 struct kobj_attribute *attr,691 const char *buf, size_t count)692{693 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);694 char *auth_str, *passwd;695 int ret;696 697 if (!capable(CAP_SYS_ADMIN))698 return -EPERM;699 700 if (!tlmi_priv.certificate_support)701 return -EOPNOTSUPP;702 703 if (!setting->cert_installed)704 return -EINVAL;705 706 if (!setting->signature || !setting->signature[0])707 return -EACCES;708 709 /* Strip out CR if one is present */710 passwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);711 if (!passwd)712 return -ENOMEM;713 714 /* Format: 'Password,Signature' */715 auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature);716 if (!auth_str) {717 kfree_sensitive(passwd);718 return -ENOMEM;719 }720 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str);721 kfree(auth_str);722 kfree_sensitive(passwd);723 724 return ret ?: count;725}726 727static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password);728 729static ssize_t certificate_store(struct kobject *kobj,730 struct kobj_attribute *attr,731 const char *buf, size_t count)732{733 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);734 char *auth_str, *new_cert;735 char *guid;736 int ret;737 738 if (!capable(CAP_SYS_ADMIN))739 return -EPERM;740 741 if (!tlmi_priv.certificate_support)742 return -EOPNOTSUPP;743 744 /* If empty then clear installed certificate */745 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */746 /* Check that signature is set */747 if (!setting->signature || !setting->signature[0])748 return -EACCES;749 750 /* Format: 'serial#, signature' */751 auth_str = kasprintf(GFP_KERNEL, "%s,%s",752 dmi_get_system_info(DMI_PRODUCT_SERIAL),753 setting->signature);754 if (!auth_str)755 return -ENOMEM;756 757 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str);758 kfree(auth_str);759 760 return ret ?: count;761 }762 763 /* Strip out CR if one is present */764 new_cert = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);765 if (!new_cert)766 return -ENOMEM;767 768 if (setting->cert_installed) {769 /* Certificate is installed so this is an update */770 if (!setting->signature || !setting->signature[0]) {771 kfree(new_cert);772 return -EACCES;773 }774 guid = LENOVO_UPDATE_BIOS_CERT_GUID;775 /* Format: 'Certificate,Signature' */776 auth_str = kasprintf(GFP_KERNEL, "%s,%s",777 new_cert, setting->signature);778 } else {779 /* This is a fresh install */780 if (!setting->valid || !setting->password[0]) {781 kfree(new_cert);782 return -EACCES;783 }784 guid = LENOVO_SET_BIOS_CERT_GUID;785 /* Format: 'Certificate,Admin-password' */786 auth_str = kasprintf(GFP_KERNEL, "%s,%s",787 new_cert, setting->password);788 }789 kfree(new_cert);790 if (!auth_str)791 return -ENOMEM;792 793 ret = tlmi_simple_call(guid, auth_str);794 kfree(auth_str);795 796 return ret ?: count;797}798 799static struct kobj_attribute auth_certificate = __ATTR_WO(certificate);800 801static ssize_t signature_store(struct kobject *kobj,802 struct kobj_attribute *attr,803 const char *buf, size_t count)804{805 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);806 char *new_signature;807 808 if (!capable(CAP_SYS_ADMIN))809 return -EPERM;810 811 if (!tlmi_priv.certificate_support)812 return -EOPNOTSUPP;813 814 /* Strip out CR if one is present */815 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);816 if (!new_signature)817 return -ENOMEM;818 819 /* Free any previous signature */820 kfree(setting->signature);821 setting->signature = new_signature;822 823 return count;824}825 826static struct kobj_attribute auth_signature = __ATTR_WO(signature);827 828static ssize_t save_signature_store(struct kobject *kobj,829 struct kobj_attribute *attr,830 const char *buf, size_t count)831{832 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);833 char *new_signature;834 835 if (!capable(CAP_SYS_ADMIN))836 return -EPERM;837 838 if (!tlmi_priv.certificate_support)839 return -EOPNOTSUPP;840 841 /* Strip out CR if one is present */842 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);843 if (!new_signature)844 return -ENOMEM;845 846 /* Free any previous signature */847 kfree(setting->save_signature);848 setting->save_signature = new_signature;849 850 return count;851}852 853static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature);854 855static umode_t auth_attr_is_visible(struct kobject *kobj,856 struct attribute *attr, int n)857{858 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);859 860 /* We only want to display level and index settings on HDD/NVMe */861 if (attr == &auth_index.attr || attr == &auth_level.attr) {862 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme))863 return attr->mode;864 return 0;865 }866 867 /* We only display certificates on Admin account, if supported */868 if (attr == &auth_certificate.attr ||869 attr == &auth_signature.attr ||870 attr == &auth_save_signature.attr ||871 attr == &auth_cert_thumb.attr ||872 attr == &auth_cert_to_password.attr) {873 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support)874 return attr->mode;875 return 0;876 }877 878 /* Don't display un-needed settings if opcode available */879 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) &&880 tlmi_priv.opcode_support)881 return 0;882 883 return attr->mode;884}885 886static struct attribute *auth_attrs[] = {887 &auth_is_pass_set.attr,888 &auth_min_pass_length.attr,889 &auth_max_pass_length.attr,890 &auth_current_password.attr,891 &auth_new_password.attr,892 &auth_role.attr,893 &auth_mechanism.attr,894 &auth_encoding.attr,895 &auth_kbdlang.attr,896 &auth_index.attr,897 &auth_level.attr,898 &auth_certificate.attr,899 &auth_signature.attr,900 &auth_save_signature.attr,901 &auth_cert_thumb.attr,902 &auth_cert_to_password.attr,903 NULL904};905 906static const struct attribute_group auth_attr_group = {907 .is_visible = auth_attr_is_visible,908 .attrs = auth_attrs,909};910 911/* ---- Attributes sysfs --------------------------------------------------------- */912static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,913 char *buf)914{915 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);916 917 return sysfs_emit(buf, "%s\n", setting->display_name);918}919 920static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)921{922 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);923 char *item, *value;924 int ret;925 926 ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID);927 if (ret)928 return ret;929 930 /* validate and split from `item,value` -> `value` */931 value = strpbrk(item, ",");932 if (!value || value == item || !strlen(value + 1))933 ret = -EINVAL;934 else {935 /* On Workstations remove the Options part after the value */936 strreplace(value, ';', '\0');937 ret = sysfs_emit(buf, "%s\n", value + 1);938 }939 kfree(item);940 941 return ret;942}943 944static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)945{946 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);947 948 return sysfs_emit(buf, "%s\n", setting->possible_values);949}950 951static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,952 char *buf)953{954 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);955 956 if (setting->possible_values) {957 /* Figure out what setting type is as BIOS does not return this */958 if (strchr(setting->possible_values, ';'))959 return sysfs_emit(buf, "enumeration\n");960 }961 /* Anything else is going to be a string */962 return sysfs_emit(buf, "string\n");963}964 965static ssize_t current_value_store(struct kobject *kobj,966 struct kobj_attribute *attr,967 const char *buf, size_t count)968{969 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);970 char *set_str = NULL, *new_setting = NULL;971 char *auth_str = NULL;972 int ret;973 974 if (!tlmi_priv.can_set_bios_settings)975 return -EOPNOTSUPP;976 977 /*978 * If we are using bulk saves a reboot should be done once save has979 * been called980 */981 if (tlmi_priv.save_mode == TLMI_SAVE_BULK && tlmi_priv.reboot_required)982 return -EPERM;983 984 /* Strip out CR if one is present */985 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);986 if (!new_setting)987 return -ENOMEM;988 989 /* Use lock in case multiple WMI operations needed */990 mutex_lock(&tlmi_mutex);991 992 /* Check if certificate authentication is enabled and active */993 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {994 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {995 ret = -EINVAL;996 goto out;997 }998 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,999 new_setting, tlmi_priv.pwd_admin->signature);1000 if (!set_str) {1001 ret = -ENOMEM;1002 goto out;1003 }1004 1005 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str);1006 if (ret)1007 goto out;1008 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)1009 tlmi_priv.save_required = true;1010 else1011 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,1012 tlmi_priv.pwd_admin->save_signature);1013 } else if (tlmi_priv.opcode_support) {1014 /*1015 * If opcode support is present use that interface.1016 * Note - this sets the variable and then the password as separate1017 * WMI calls. Function tlmi_save_bios_settings will error if the1018 * password is incorrect.1019 * Workstation's require the opcode to be set before changing the1020 * attribute.1021 */1022 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {1023 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",1024 tlmi_priv.pwd_admin->password);1025 if (ret)1026 goto out;1027 }1028 1029 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,1030 new_setting);1031 if (!set_str) {1032 ret = -ENOMEM;1033 goto out;1034 }1035 1036 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);1037 if (ret)1038 goto out;1039 1040 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)1041 tlmi_priv.save_required = true;1042 else1043 ret = tlmi_save_bios_settings("");1044 } else { /* old non-opcode based authentication method (deprecated) */1045 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {1046 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",1047 tlmi_priv.pwd_admin->password,1048 encoding_options[tlmi_priv.pwd_admin->encoding],1049 tlmi_priv.pwd_admin->kbdlang);1050 if (!auth_str) {1051 ret = -ENOMEM;1052 goto out;1053 }1054 }1055 1056 if (auth_str)1057 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,1058 new_setting, auth_str);1059 else1060 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,1061 new_setting);1062 if (!set_str) {1063 ret = -ENOMEM;1064 goto out;1065 }1066 1067 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);1068 if (ret)1069 goto out;1070 1071 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) {1072 tlmi_priv.save_required = true;1073 } else {1074 if (auth_str)1075 ret = tlmi_save_bios_settings(auth_str);1076 else1077 ret = tlmi_save_bios_settings("");1078 }1079 }1080 if (!ret && !tlmi_priv.pending_changes) {1081 tlmi_priv.pending_changes = true;1082 /* let userland know it may need to check reboot pending again */1083 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);1084 }1085out:1086 mutex_unlock(&tlmi_mutex);1087 kfree(auth_str);1088 kfree(set_str);1089 kfree(new_setting);1090 return ret ?: count;1091}1092 1093static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name);1094 1095static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);1096 1097static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);1098 1099static struct kobj_attribute attr_type = __ATTR_RO(type);1100 1101static umode_t attr_is_visible(struct kobject *kobj,1102 struct attribute *attr, int n)1103{1104 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);1105 1106 /* We don't want to display possible_values attributes if not available */1107 if ((attr == &attr_possible_values.attr) && (!setting->possible_values))1108 return 0;1109 1110 return attr->mode;1111}1112 1113static struct attribute *tlmi_attrs[] = {1114 &attr_displ_name.attr,1115 &attr_current_val.attr,1116 &attr_possible_values.attr,1117 &attr_type.attr,1118 NULL1119};1120 1121static const struct attribute_group tlmi_attr_group = {1122 .is_visible = attr_is_visible,1123 .attrs = tlmi_attrs,1124};1125 1126static void tlmi_attr_setting_release(struct kobject *kobj)1127{1128 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);1129 1130 kfree(setting->possible_values);1131 kfree(setting);1132}1133 1134static void tlmi_pwd_setting_release(struct kobject *kobj)1135{1136 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);1137 1138 kfree(setting);1139}1140 1141static const struct kobj_type tlmi_attr_setting_ktype = {1142 .release = &tlmi_attr_setting_release,1143 .sysfs_ops = &kobj_sysfs_ops,1144};1145 1146static const struct kobj_type tlmi_pwd_setting_ktype = {1147 .release = &tlmi_pwd_setting_release,1148 .sysfs_ops = &kobj_sysfs_ops,1149};1150 1151static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,1152 char *buf)1153{1154 return sprintf(buf, "%d\n", tlmi_priv.pending_changes);1155}1156 1157static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);1158 1159static const char * const save_mode_strings[] = {1160 [TLMI_SAVE_SINGLE] = "single",1161 [TLMI_SAVE_BULK] = "bulk",1162 [TLMI_SAVE_SAVE] = "save"1163};1164 1165static ssize_t save_settings_show(struct kobject *kobj, struct kobj_attribute *attr,1166 char *buf)1167{1168 /* Check that setting is valid */1169 if (WARN_ON(tlmi_priv.save_mode < TLMI_SAVE_SINGLE ||1170 tlmi_priv.save_mode > TLMI_SAVE_BULK))1171 return -EIO;1172 return sysfs_emit(buf, "%s\n", save_mode_strings[tlmi_priv.save_mode]);1173}1174 1175static ssize_t save_settings_store(struct kobject *kobj, struct kobj_attribute *attr,1176 const char *buf, size_t count)1177{1178 char *auth_str = NULL;1179 int ret = 0;1180 int cmd;1181 1182 cmd = sysfs_match_string(save_mode_strings, buf);1183 if (cmd < 0)1184 return cmd;1185 1186 /* Use lock in case multiple WMI operations needed */1187 mutex_lock(&tlmi_mutex);1188 1189 switch (cmd) {1190 case TLMI_SAVE_SINGLE:1191 case TLMI_SAVE_BULK:1192 tlmi_priv.save_mode = cmd;1193 goto out;1194 case TLMI_SAVE_SAVE:1195 /* Check if supported*/1196 if (!tlmi_priv.can_set_bios_settings ||1197 tlmi_priv.save_mode == TLMI_SAVE_SINGLE) {1198 ret = -EOPNOTSUPP;1199 goto out;1200 }1201 /* Check there is actually something to save */1202 if (!tlmi_priv.save_required) {1203 ret = -ENOENT;1204 goto out;1205 }1206 /* Check if certificate authentication is enabled and active */1207 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {1208 if (!tlmi_priv.pwd_admin->signature ||1209 !tlmi_priv.pwd_admin->save_signature) {1210 ret = -EINVAL;1211 goto out;1212 }1213 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,1214 tlmi_priv.pwd_admin->save_signature);1215 if (ret)1216 goto out;1217 } else if (tlmi_priv.opcode_support) {1218 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {1219 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",1220 tlmi_priv.pwd_admin->password);1221 if (ret)1222 goto out;1223 }1224 ret = tlmi_save_bios_settings("");1225 } else { /* old non-opcode based authentication method (deprecated) */1226 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {1227 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",1228 tlmi_priv.pwd_admin->password,1229 encoding_options[tlmi_priv.pwd_admin->encoding],1230 tlmi_priv.pwd_admin->kbdlang);1231 if (!auth_str) {1232 ret = -ENOMEM;1233 goto out;1234 }1235 }1236 1237 if (auth_str)1238 ret = tlmi_save_bios_settings(auth_str);1239 else1240 ret = tlmi_save_bios_settings("");1241 }1242 tlmi_priv.save_required = false;1243 tlmi_priv.reboot_required = true;1244 1245 if (!ret && !tlmi_priv.pending_changes) {1246 tlmi_priv.pending_changes = true;1247 /* let userland know it may need to check reboot pending again */1248 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);1249 }1250 break;1251 }1252out:1253 mutex_unlock(&tlmi_mutex);1254 kfree(auth_str);1255 return ret ?: count;1256}1257 1258static struct kobj_attribute save_settings = __ATTR_RW(save_settings);1259 1260/* ---- Debug interface--------------------------------------------------------- */1261static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr,1262 const char *buf, size_t count)1263{1264 char *set_str = NULL, *new_setting = NULL;1265 char *auth_str = NULL;1266 int ret;1267 1268 if (!tlmi_priv.can_debug_cmd)1269 return -EOPNOTSUPP;1270 1271 /* Strip out CR if one is present */1272 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);1273 if (!new_setting)1274 return -ENOMEM;1275 1276 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {1277 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",1278 tlmi_priv.pwd_admin->password,1279 encoding_options[tlmi_priv.pwd_admin->encoding],1280 tlmi_priv.pwd_admin->kbdlang);1281 if (!auth_str) {1282 ret = -ENOMEM;1283 goto out;1284 }1285 }1286 1287 if (auth_str)1288 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str);1289 else1290 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting);1291 if (!set_str) {1292 ret = -ENOMEM;1293 goto out;1294 }1295 1296 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str);1297 if (ret)1298 goto out;1299 1300 if (!ret && !tlmi_priv.pending_changes) {1301 tlmi_priv.pending_changes = true;1302 /* let userland know it may need to check reboot pending again */1303 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);1304 }1305out:1306 kfree(auth_str);1307 kfree(set_str);1308 kfree(new_setting);1309 return ret ?: count;1310}1311 1312static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);1313 1314/* ---- Initialisation --------------------------------------------------------- */1315static void tlmi_release_attr(void)1316{1317 int i;1318 1319 /* Attribute structures */1320 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {1321 if (tlmi_priv.setting[i]) {1322 sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);1323 kobject_put(&tlmi_priv.setting[i]->kobj);1324 }1325 }1326 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);1327 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);1328 1329 if (tlmi_priv.can_debug_cmd && debug_support)1330 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);1331 1332 kset_unregister(tlmi_priv.attribute_kset);1333 1334 /* Free up any saved signatures */1335 kfree(tlmi_priv.pwd_admin->signature);1336 kfree(tlmi_priv.pwd_admin->save_signature);1337 1338 /* Authentication structures */1339 sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);1340 kobject_put(&tlmi_priv.pwd_admin->kobj);1341 sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);1342 kobject_put(&tlmi_priv.pwd_power->kobj);1343 1344 if (tlmi_priv.opcode_support) {1345 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);1346 kobject_put(&tlmi_priv.pwd_system->kobj);1347 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);1348 kobject_put(&tlmi_priv.pwd_hdd->kobj);1349 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);1350 kobject_put(&tlmi_priv.pwd_nvme->kobj);1351 }1352 1353 kset_unregister(tlmi_priv.authentication_kset);1354}1355 1356static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)1357{1358 struct kobject *duplicate;1359 1360 if (!strcmp(name, "Reserved"))1361 return -EINVAL;1362 1363 duplicate = kset_find_obj(attribute_kset, name);1364 if (duplicate) {1365 pr_debug("Duplicate attribute name found - %s\n", name);1366 /* kset_find_obj() returns a reference */1367 kobject_put(duplicate);1368 return -EBUSY;1369 }1370 1371 return 0;1372}1373 1374static int tlmi_sysfs_init(void)1375{1376 int i, ret;1377 1378 ret = fw_attributes_class_get(&fw_attr_class);1379 if (ret)1380 return ret;1381 1382 tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0),1383 NULL, "%s", "thinklmi");1384 if (IS_ERR(tlmi_priv.class_dev)) {1385 ret = PTR_ERR(tlmi_priv.class_dev);1386 goto fail_class_created;1387 }1388 1389 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL,1390 &tlmi_priv.class_dev->kobj);1391 if (!tlmi_priv.attribute_kset) {1392 ret = -ENOMEM;1393 goto fail_device_created;1394 }1395 1396 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {1397 /* Check if index is a valid setting - skip if it isn't */1398 if (!tlmi_priv.setting[i])1399 continue;1400 1401 /* check for duplicate or reserved values */1402 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,1403 tlmi_priv.setting[i]->display_name) < 0) {1404 kfree(tlmi_priv.setting[i]->possible_values);1405 kfree(tlmi_priv.setting[i]);1406 tlmi_priv.setting[i] = NULL;1407 continue;1408 }1409 1410 /* Build attribute */1411 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;1412 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,1413 "%s", tlmi_priv.setting[i]->display_name);1414 if (ret)1415 goto fail_create_attr;1416 1417 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);1418 if (ret)1419 goto fail_create_attr;1420 }1421 1422 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);1423 if (ret)1424 goto fail_create_attr;1425 1426 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);1427 if (ret)1428 goto fail_create_attr;1429 1430 if (tlmi_priv.can_debug_cmd && debug_support) {1431 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);1432 if (ret)1433 goto fail_create_attr;1434 }1435 1436 /* Create authentication entries */1437 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,1438 &tlmi_priv.class_dev->kobj);1439 if (!tlmi_priv.authentication_kset) {1440 ret = -ENOMEM;1441 goto fail_create_attr;1442 }1443 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;1444 ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");1445 if (ret)1446 goto fail_create_attr;1447 1448 ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);1449 if (ret)1450 goto fail_create_attr;1451 1452 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;1453 ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");1454 if (ret)1455 goto fail_create_attr;1456 1457 ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);1458 if (ret)1459 goto fail_create_attr;1460 1461 if (tlmi_priv.opcode_support) {1462 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;1463 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");1464 if (ret)1465 goto fail_create_attr;1466 1467 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);1468 if (ret)1469 goto fail_create_attr;1470 1471 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;1472 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");1473 if (ret)1474 goto fail_create_attr;1475 1476 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);1477 if (ret)1478 goto fail_create_attr;1479 1480 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;1481 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");1482 if (ret)1483 goto fail_create_attr;1484 1485 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);1486 if (ret)1487 goto fail_create_attr;1488 }1489 1490 return ret;1491 1492fail_create_attr:1493 tlmi_release_attr();1494fail_device_created:1495 device_destroy(fw_attr_class, MKDEV(0, 0));1496fail_class_created:1497 fw_attributes_class_put();1498 return ret;1499}1500 1501/* ---- Base Driver -------------------------------------------------------- */1502static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,1503 const char *pwd_role)1504{1505 struct tlmi_pwd_setting *new_pwd;1506 1507 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL);1508 if (!new_pwd)1509 return NULL;1510 1511 strscpy(new_pwd->kbdlang, "us");1512 new_pwd->encoding = TLMI_ENCODING_ASCII;1513 new_pwd->pwd_type = pwd_type;1514 new_pwd->role = pwd_role;1515 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length;1516 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;1517 new_pwd->index = 0;1518 1519 kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);1520 1521 return new_pwd;1522}1523 1524static int tlmi_analyze(void)1525{1526 int i, ret;1527 1528 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) &&1529 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID))1530 tlmi_priv.can_set_bios_settings = true;1531 1532 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID))1533 tlmi_priv.can_get_bios_selections = true;1534 1535 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID))1536 tlmi_priv.can_set_bios_password = true;1537 1538 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID))1539 tlmi_priv.can_get_password_settings = true;1540 1541 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID))1542 tlmi_priv.can_debug_cmd = true;1543 1544 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID))1545 tlmi_priv.opcode_support = true;1546 1547 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) &&1548 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) &&1549 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID))1550 tlmi_priv.certificate_support = true;1551 1552 /*1553 * Try to find the number of valid settings of this machine1554 * and use it to create sysfs attributes.1555 */1556 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {1557 struct tlmi_attr_setting *setting;1558 char *item = NULL;1559 1560 tlmi_priv.setting[i] = NULL;1561 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID);1562 if (ret)1563 break;1564 if (!item)1565 break;1566 if (!*item) {1567 kfree(item);1568 continue;1569 }1570 1571 /* It is not allowed to have '/' for file name. Convert it into '\'. */1572 strreplace(item, '/', '\\');1573 1574 /* Remove the value part */1575 strreplace(item, ',', '\0');1576 1577 /* Create a setting entry */1578 setting = kzalloc(sizeof(*setting), GFP_KERNEL);1579 if (!setting) {1580 ret = -ENOMEM;1581 kfree(item);1582 goto fail_clear_attr;1583 }1584 setting->index = i;1585 strscpy(setting->display_name, item);1586 /* If BIOS selections supported, load those */1587 if (tlmi_priv.can_get_bios_selections) {1588 ret = tlmi_get_bios_selections(setting->display_name,1589 &setting->possible_values);1590 if (ret || !setting->possible_values)1591 pr_info("Error retrieving possible values for %d : %s\n",1592 i, setting->display_name);1593 } else {1594 /*1595 * Older Thinkstations don't support the bios_selections API.1596 * Instead they store this as a [Optional:Option1,Option2] section of the1597 * name string.1598 * Try and pull that out if it's available.1599 */1600 char *optitem, *optstart, *optend;1601 1602 if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) {1603 optstart = strstr(optitem, "[Optional:");1604 if (optstart) {1605 optstart += strlen("[Optional:");1606 optend = strstr(optstart, "]");1607 if (optend)1608 setting->possible_values =1609 kstrndup(optstart, optend - optstart,1610 GFP_KERNEL);1611 }1612 kfree(optitem);1613 }1614 }1615 /*1616 * firmware-attributes requires that possible_values are separated by ';' but1617 * Lenovo FW uses ','. Replace appropriately.1618 */1619 if (setting->possible_values)1620 strreplace(setting->possible_values, ',', ';');1621 1622 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);1623 tlmi_priv.setting[i] = setting;1624 kfree(item);1625 }1626 1627 /* Create password setting structure */1628 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg);1629 if (ret)1630 goto fail_clear_attr;1631 1632 /* All failures below boil down to kmalloc failures */1633 ret = -ENOMEM;1634 1635 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin");1636 if (!tlmi_priv.pwd_admin)1637 goto fail_clear_attr;1638 1639 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)1640 tlmi_priv.pwd_admin->valid = true;1641 1642 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");1643 if (!tlmi_priv.pwd_power)1644 goto fail_clear_attr;1645 1646 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)1647 tlmi_priv.pwd_power->valid = true;1648 1649 if (tlmi_priv.opcode_support) {1650 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");1651 if (!tlmi_priv.pwd_system)1652 goto fail_clear_attr;1653 1654 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)1655 tlmi_priv.pwd_system->valid = true;1656 1657 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");1658 if (!tlmi_priv.pwd_hdd)1659 goto fail_clear_attr;1660 1661 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme");1662 if (!tlmi_priv.pwd_nvme)1663 goto fail_clear_attr;1664 1665 /* Set default hdd/nvme index to 1 as there is no device 0 */1666 tlmi_priv.pwd_hdd->index = 1;1667 tlmi_priv.pwd_nvme->index = 1;1668 1669 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) {1670 /* Check if PWD is configured and set index to first drive found */1671 if (tlmi_priv.pwdcfg.ext.hdd_user_password ||1672 tlmi_priv.pwdcfg.ext.hdd_master_password) {1673 tlmi_priv.pwd_hdd->valid = true;1674 if (tlmi_priv.pwdcfg.ext.hdd_master_password)1675 tlmi_priv.pwd_hdd->index =1676 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;1677 else1678 tlmi_priv.pwd_hdd->index =1679 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1;1680 }1681 if (tlmi_priv.pwdcfg.ext.nvme_user_password ||1682 tlmi_priv.pwdcfg.ext.nvme_master_password) {1683 tlmi_priv.pwd_nvme->valid = true;1684 if (tlmi_priv.pwdcfg.ext.nvme_master_password)1685 tlmi_priv.pwd_nvme->index =1686 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;1687 else1688 tlmi_priv.pwd_nvme->index =1689 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1;1690 }1691 }1692 }1693 1694 if (tlmi_priv.certificate_support &&1695 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT))1696 tlmi_priv.pwd_admin->cert_installed = true;1697 1698 return 0;1699 1700fail_clear_attr:1701 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {1702 if (tlmi_priv.setting[i]) {1703 kfree(tlmi_priv.setting[i]->possible_values);1704 kfree(tlmi_priv.setting[i]);1705 }1706 }1707 kfree(tlmi_priv.pwd_admin);1708 kfree(tlmi_priv.pwd_power);1709 kfree(tlmi_priv.pwd_system);1710 kfree(tlmi_priv.pwd_hdd);1711 kfree(tlmi_priv.pwd_nvme);1712 return ret;1713}1714 1715static void tlmi_remove(struct wmi_device *wdev)1716{1717 tlmi_release_attr();1718 device_destroy(fw_attr_class, MKDEV(0, 0));1719 fw_attributes_class_put();1720}1721 1722static int tlmi_probe(struct wmi_device *wdev, const void *context)1723{1724 int ret;1725 1726 ret = tlmi_analyze();1727 if (ret)1728 return ret;1729 1730 return tlmi_sysfs_init();1731}1732 1733static const struct wmi_device_id tlmi_id_table[] = {1734 { .guid_string = LENOVO_BIOS_SETTING_GUID },1735 { }1736};1737MODULE_DEVICE_TABLE(wmi, tlmi_id_table);1738 1739static struct wmi_driver tlmi_driver = {1740 .driver = {1741 .name = "think-lmi",1742 },1743 .id_table = tlmi_id_table,1744 .probe = tlmi_probe,1745 .remove = tlmi_remove,1746};1747 1748MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>");1749MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>");1750MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>");1751MODULE_DESCRIPTION("ThinkLMI Driver");1752MODULE_LICENSE("GPL");1753 1754module_wmi_driver(tlmi_driver);1755