1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * Think LMI BIOS configuration driver 4 * 5 * Copyright(C) 2019-2021 Lenovo 6 * 7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi 8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com> 9 * Distributed under the GPL-2.0 license 10 */ 11 12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14#include <linux/acpi.h> 15#include <linux/errno.h> 16#include <linux/fs.h> 17#include <linux/mutex.h> 18#include <linux/string_helpers.h> 19#include <linux/types.h> 20#include <linux/dmi.h> 21#include <linux/wmi.h> 22#include "firmware_attributes_class.h" 23#include "think-lmi.h" 24 25static bool debug_support; 26module_param(debug_support, bool, 0444); 27MODULE_PARM_DESC(debug_support, "Enable debug command support"); 28 29/* 30 * Name: BiosSetting 31 * Description: Get item name and settings for current LMI instance. 32 * Type: Query 33 * Returns: "Item,Value" 34 * Example: "WakeOnLAN,Enable" 35 */ 36#define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7" 37 38/* 39 * Name: SetBiosSetting 40 * Description: Change the BIOS setting to the desired value using the SetBiosSetting 41 * class. To save the settings, use the SaveBiosSetting class. 42 * BIOS settings and values are case sensitive. 43 * After making changes to the BIOS settings, you must reboot the computer 44 * before the changes will take effect. 45 * Type: Method 46 * Arguments: "Item,Value,Password,Encoding,KbdLang;" 47 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;" 48 */ 49#define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1" 50 51/* 52 * Name: SaveBiosSettings 53 * Description: Save any pending changes in settings. 54 * Type: Method 55 * Arguments: "Password,Encoding,KbdLang;" 56 * Example: "pa55w0rd,ascii,us;" 57 */ 58#define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3" 59 60/* 61 * Name: BiosPasswordSettings 62 * Description: Return BIOS Password settings 63 * Type: Query 64 * Returns: PasswordMode, PasswordState, MinLength, MaxLength, 65 * SupportedEncoding, SupportedKeyboard 66 */ 67#define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246" 68 69/* 70 * Name: SetBiosPassword 71 * Description: Change a specific password. 72 * - BIOS settings cannot be changed at the same boot as power-on 73 * passwords (POP) and hard disk passwords (HDP). If you want to change 74 * BIOS settings and POP or HDP, you must reboot the system after changing 75 * one of them. 76 * - A password cannot be set using this method when one does not already 77 * exist. Passwords can only be updated or cleared. 78 * Type: Method 79 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;" 80 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;��� 81 */ 82#define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7" 83 84/* 85 * Name: GetBiosSelections 86 * Description: Return a list of valid settings for a given item. 87 * Type: Method 88 * Arguments: "Item" 89 * Returns: "Value1,Value2,Value3,..." 90 * Example: 91 * -> "FlashOverLAN" 92 * <- "Enabled,Disabled" 93 */ 94#define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B" 95 96/* 97 * Name: DebugCmd 98 * Description: Debug entry method for entering debug commands to the BIOS 99 */ 100#define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1" 101 102/* 103 * Name: OpcodeIF 104 * Description: Opcode interface which provides the ability to set multiple 105 * parameters and then trigger an action with a final command. 106 * This is particularly useful for simplifying setting passwords. 107 * With this support comes the ability to set System, HDD and NVMe 108 * passwords. 109 * This is currently available on ThinkCenter and ThinkStations platforms 110 */ 111#define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836" 112 113/* 114 * Name: SetBiosCert 115 * Description: Install BIOS certificate. 116 * Type: Method 117 * Arguments: "Certificate,Password" 118 * You must reboot the computer before the changes will take effect. 119 */ 120#define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE" 121 122/* 123 * Name: UpdateBiosCert 124 * Description: Update BIOS certificate. 125 * Type: Method 126 * Format: "Certificate,Signature" 127 * You must reboot the computer before the changes will take effect. 128 */ 129#define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE" 130 131/* 132 * Name: ClearBiosCert 133 * Description: Uninstall BIOS certificate. 134 * Type: Method 135 * Format: "Serial,Signature" 136 * You must reboot the computer before the changes will take effect. 137 */ 138#define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890" 139/* 140 * Name: CertToPassword 141 * Description: Switch from certificate to password authentication. 142 * Type: Method 143 * Format: "Password,Signature" 144 * You must reboot the computer before the changes will take effect. 145 */ 146#define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D" 147 148/* 149 * Name: SetBiosSettingCert 150 * Description: Set attribute using certificate authentication. 151 * Type: Method 152 * Format: "Item,Value,Signature" 153 */ 154#define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003" 155 156/* 157 * Name: SaveBiosSettingCert 158 * Description: Save any pending changes in settings. 159 * Type: Method 160 * Format: "Signature" 161 */ 162#define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551" 163 164/* 165 * Name: CertThumbprint 166 * Description: Display Certificate thumbprints 167 * Type: Query 168 * Returns: MD5, SHA1 & SHA256 thumbprints 169 */ 170#define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4" 171 172#define TLMI_POP_PWD BIT(0) /* Supervisor */ 173#define TLMI_PAP_PWD BIT(1) /* Power-on */ 174#define TLMI_HDD_PWD BIT(2) /* HDD/NVME */ 175#define TLMI_SMP_PWD BIT(6) /* System Management */ 176#define TLMI_CERT BIT(7) /* Certificate Based */ 177 178#define to_tlmi_pwd_setting(kobj) container_of(kobj, struct tlmi_pwd_setting, kobj) 179#define to_tlmi_attr_setting(kobj) container_of(kobj, struct tlmi_attr_setting, kobj) 180 181static const struct tlmi_err_codes tlmi_errs[] = { 182 {"Success", 0}, 183 {"Not Supported", -EOPNOTSUPP}, 184 {"Invalid Parameter", -EINVAL}, 185 {"Access Denied", -EACCES}, 186 {"System Busy", -EBUSY}, 187}; 188 189static const char * const encoding_options[] = { 190 [TLMI_ENCODING_ASCII] = "ascii", 191 [TLMI_ENCODING_SCANCODE] = "scancode", 192}; 193static const char * const level_options[] = { 194 [TLMI_LEVEL_USER] = "user", 195 [TLMI_LEVEL_MASTER] = "master", 196}; 197static struct think_lmi tlmi_priv; 198static const struct class *fw_attr_class; 199static DEFINE_MUTEX(tlmi_mutex); 200 201/* Convert BIOS WMI error string to suitable error code */ 202static int tlmi_errstr_to_err(const char *errstr) 203{ 204 int i; 205 206 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) { 207 if (!strcmp(tlmi_errs[i].err_str, errstr)) 208 return tlmi_errs[i].err_code; 209 } 210 return -EPERM; 211} 212 213/* Extract error string from WMI return buffer */ 214static int tlmi_extract_error(const struct acpi_buffer *output) 215{ 216 const union acpi_object *obj; 217 218 obj = output->pointer; 219 if (!obj) 220 return -ENOMEM; 221 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 222 return -EIO; 223 224 return tlmi_errstr_to_err(obj->string.pointer); 225} 226 227/* Utility function to execute WMI call to BIOS */ 228static int tlmi_simple_call(const char *guid, const char *arg) 229{ 230 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 231 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 232 acpi_status status; 233 int i, err; 234 235 /* 236 * Duplicated call required to match BIOS workaround for behavior 237 * seen when WMI accessed via scripting on other OS. 238 */ 239 for (i = 0; i < 2; i++) { 240 /* (re)initialize output buffer to default state */ 241 output.length = ACPI_ALLOCATE_BUFFER; 242 output.pointer = NULL; 243 244 status = wmi_evaluate_method(guid, 0, 0, &input, &output); 245 if (ACPI_FAILURE(status)) { 246 kfree(output.pointer); 247 return -EIO; 248 } 249 err = tlmi_extract_error(&output); 250 kfree(output.pointer); 251 if (err) 252 return err; 253 } 254 return 0; 255} 256 257/* Extract output string from WMI return buffer */ 258static int tlmi_extract_output_string(const struct acpi_buffer *output, 259 char **string) 260{ 261 const union acpi_object *obj; 262 char *s; 263 264 obj = output->pointer; 265 if (!obj) 266 return -ENOMEM; 267 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) 268 return -EIO; 269 270 s = kstrdup(obj->string.pointer, GFP_KERNEL); 271 if (!s) 272 return -ENOMEM; 273 *string = s; 274 return 0; 275} 276 277/* ------ Core interface functions ------------*/ 278 279/* Get password settings from BIOS */ 280static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg) 281{ 282 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 283 const union acpi_object *obj; 284 acpi_status status; 285 int copy_size; 286 287 if (!tlmi_priv.can_get_password_settings) 288 return -EOPNOTSUPP; 289 290 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0, 291 &output); 292 if (ACPI_FAILURE(status)) 293 return -EIO; 294 295 obj = output.pointer; 296 if (!obj) 297 return -ENOMEM; 298 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) { 299 kfree(obj); 300 return -EIO; 301 } 302 /* 303 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad. 304 * To make the driver compatible on different brands, we permit it to get 305 * the data in below case. 306 * Settings must have at minimum the core fields available 307 */ 308 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) { 309 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length); 310 kfree(obj); 311 return -EIO; 312 } 313 314 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg)); 315 316 memcpy(pwdcfg, obj->buffer.pointer, copy_size); 317 kfree(obj); 318 319 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE)) 320 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1; 321 return 0; 322} 323 324static int tlmi_save_bios_settings(const char *password) 325{ 326 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID, 327 password); 328} 329 330static int tlmi_opcode_setting(char *setting, const char *value) 331{ 332 char *opcode_str; 333 int ret; 334 335 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value); 336 if (!opcode_str) 337 return -ENOMEM; 338 339 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str); 340 kfree(opcode_str); 341 return ret; 342} 343 344static int tlmi_setting(int item, char **value, const char *guid_string) 345{ 346 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 347 acpi_status status; 348 int ret; 349 350 status = wmi_query_block(guid_string, item, &output); 351 if (ACPI_FAILURE(status)) { 352 kfree(output.pointer); 353 return -EIO; 354 } 355 356 ret = tlmi_extract_output_string(&output, value); 357 kfree(output.pointer); 358 return ret; 359} 360 361static int tlmi_get_bios_selections(const char *item, char **value) 362{ 363 const struct acpi_buffer input = { strlen(item), (char *)item }; 364 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 365 acpi_status status; 366 int ret; 367 368 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID, 369 0, 0, &input, &output); 370 371 if (ACPI_FAILURE(status)) { 372 kfree(output.pointer); 373 return -EIO; 374 } 375 376 ret = tlmi_extract_output_string(&output, value); 377 kfree(output.pointer); 378 return ret; 379} 380 381/* ---- Authentication sysfs --------------------------------------------------------- */ 382static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr, 383 char *buf) 384{ 385 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 386 387 return sysfs_emit(buf, "%d\n", setting->valid); 388} 389 390static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled); 391 392static ssize_t current_password_store(struct kobject *kobj, 393 struct kobj_attribute *attr, 394 const char *buf, size_t count) 395{ 396 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 397 size_t pwdlen; 398 399 pwdlen = strlen(buf); 400 /* pwdlen == 0 is allowed to clear the password */ 401 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) 402 return -EINVAL; 403 404 strscpy(setting->password, buf, setting->maxlen); 405 /* Strip out CR if one is present, setting password won't work if it is present */ 406 strreplace(setting->password, '\n', '\0'); 407 return count; 408} 409 410static struct kobj_attribute auth_current_password = __ATTR_WO(current_password); 411 412static ssize_t new_password_store(struct kobject *kobj, 413 struct kobj_attribute *attr, 414 const char *buf, size_t count) 415{ 416 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 417 char *auth_str, *new_pwd; 418 size_t pwdlen; 419 int ret; 420 421 if (!capable(CAP_SYS_ADMIN)) 422 return -EPERM; 423 424 if (!tlmi_priv.can_set_bios_password) 425 return -EOPNOTSUPP; 426 427 /* Strip out CR if one is present, setting password won't work if it is present */ 428 new_pwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 429 if (!new_pwd) 430 return -ENOMEM; 431 432 /* Use lock in case multiple WMI operations needed */ 433 mutex_lock(&tlmi_mutex); 434 435 pwdlen = strlen(new_pwd); 436 /* pwdlen == 0 is allowed to clear the password */ 437 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) { 438 ret = -EINVAL; 439 goto out; 440 } 441 442 /* If opcode support is present use that interface */ 443 if (tlmi_priv.opcode_support) { 444 char pwd_type[8]; 445 446 /* Special handling required for HDD and NVMe passwords */ 447 if (setting == tlmi_priv.pwd_hdd) { 448 if (setting->level == TLMI_LEVEL_USER) 449 sprintf(pwd_type, "uhdp%d", setting->index); 450 else 451 sprintf(pwd_type, "mhdp%d", setting->index); 452 } else if (setting == tlmi_priv.pwd_nvme) { 453 if (setting->level == TLMI_LEVEL_USER) 454 sprintf(pwd_type, "udrp%d", setting->index); 455 else 456 sprintf(pwd_type, "adrp%d", setting->index); 457 } else { 458 sprintf(pwd_type, "%s", setting->pwd_type); 459 } 460 461 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type); 462 if (ret) 463 goto out; 464 465 if (tlmi_priv.pwd_admin->valid) { 466 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 467 tlmi_priv.pwd_admin->password); 468 if (ret) 469 goto out; 470 } 471 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password); 472 if (ret) 473 goto out; 474 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd); 475 if (ret) 476 goto out; 477 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;"); 478 } else { 479 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */ 480 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;", 481 setting->pwd_type, setting->password, new_pwd, 482 encoding_options[setting->encoding], setting->kbdlang); 483 if (!auth_str) { 484 ret = -ENOMEM; 485 goto out; 486 } 487 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str); 488 kfree(auth_str); 489 } 490out: 491 mutex_unlock(&tlmi_mutex); 492 kfree(new_pwd); 493 return ret ?: count; 494} 495 496static struct kobj_attribute auth_new_password = __ATTR_WO(new_password); 497 498static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 499 char *buf) 500{ 501 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 502 503 return sysfs_emit(buf, "%d\n", setting->minlen); 504} 505 506static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length); 507 508static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr, 509 char *buf) 510{ 511 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 512 513 return sysfs_emit(buf, "%d\n", setting->maxlen); 514} 515static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length); 516 517static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr, 518 char *buf) 519{ 520 return sysfs_emit(buf, "password\n"); 521} 522static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism); 523 524static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr, 525 char *buf) 526{ 527 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 528 529 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]); 530} 531 532static ssize_t encoding_store(struct kobject *kobj, 533 struct kobj_attribute *attr, 534 const char *buf, size_t count) 535{ 536 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 537 int i; 538 539 /* Scan for a matching profile */ 540 i = sysfs_match_string(encoding_options, buf); 541 if (i < 0) 542 return -EINVAL; 543 544 setting->encoding = i; 545 return count; 546} 547 548static struct kobj_attribute auth_encoding = __ATTR_RW(encoding); 549 550static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr, 551 char *buf) 552{ 553 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 554 555 return sysfs_emit(buf, "%s\n", setting->kbdlang); 556} 557 558static ssize_t kbdlang_store(struct kobject *kobj, 559 struct kobj_attribute *attr, 560 const char *buf, size_t count) 561{ 562 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 563 int length; 564 565 /* Calculate length till '\n' or terminating 0 */ 566 length = strchrnul(buf, '\n') - buf; 567 if (!length || length >= TLMI_LANG_MAXLEN) 568 return -EINVAL; 569 570 memcpy(setting->kbdlang, buf, length); 571 setting->kbdlang[length] = '\0'; 572 return count; 573} 574 575static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang); 576 577static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr, 578 char *buf) 579{ 580 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 581 582 return sysfs_emit(buf, "%s\n", setting->role); 583} 584static struct kobj_attribute auth_role = __ATTR_RO(role); 585 586static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr, 587 char *buf) 588{ 589 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 590 591 return sysfs_emit(buf, "%d\n", setting->index); 592} 593 594static ssize_t index_store(struct kobject *kobj, 595 struct kobj_attribute *attr, 596 const char *buf, size_t count) 597{ 598 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 599 int err, val; 600 601 err = kstrtoint(buf, 10, &val); 602 if (err < 0) 603 return err; 604 605 if (val < 0 || val > TLMI_INDEX_MAX) 606 return -EINVAL; 607 608 setting->index = val; 609 return count; 610} 611 612static struct kobj_attribute auth_index = __ATTR_RW(index); 613 614static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr, 615 char *buf) 616{ 617 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 618 619 return sysfs_emit(buf, "%s\n", level_options[setting->level]); 620} 621 622static ssize_t level_store(struct kobject *kobj, 623 struct kobj_attribute *attr, 624 const char *buf, size_t count) 625{ 626 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 627 int i; 628 629 /* Scan for a matching profile */ 630 i = sysfs_match_string(level_options, buf); 631 if (i < 0) 632 return -EINVAL; 633 634 setting->level = i; 635 return count; 636} 637 638static struct kobj_attribute auth_level = __ATTR_RW(level); 639 640static ssize_t cert_thumbprint(char *buf, const char *arg, int count) 641{ 642 const struct acpi_buffer input = { strlen(arg), (char *)arg }; 643 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; 644 const union acpi_object *obj; 645 acpi_status status; 646 647 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output); 648 if (ACPI_FAILURE(status)) { 649 kfree(output.pointer); 650 return -EIO; 651 } 652 obj = output.pointer; 653 if (!obj) 654 return -ENOMEM; 655 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) { 656 kfree(output.pointer); 657 return -EIO; 658 } 659 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer); 660 kfree(output.pointer); 661 662 return count; 663} 664 665static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr, 666 char *buf) 667{ 668 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 669 int count = 0; 670 671 if (!tlmi_priv.certificate_support || !setting->cert_installed) 672 return -EOPNOTSUPP; 673 674 count += cert_thumbprint(buf, "Md5", count); 675 count += cert_thumbprint(buf, "Sha1", count); 676 count += cert_thumbprint(buf, "Sha256", count); 677 return count; 678} 679 680static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint); 681 682static ssize_t cert_to_password_store(struct kobject *kobj, 683 struct kobj_attribute *attr, 684 const char *buf, size_t count) 685{ 686 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 687 char *auth_str, *passwd; 688 int ret; 689 690 if (!capable(CAP_SYS_ADMIN)) 691 return -EPERM; 692 693 if (!tlmi_priv.certificate_support) 694 return -EOPNOTSUPP; 695 696 if (!setting->cert_installed) 697 return -EINVAL; 698 699 if (!setting->signature || !setting->signature[0]) 700 return -EACCES; 701 702 /* Strip out CR if one is present */ 703 passwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 704 if (!passwd) 705 return -ENOMEM; 706 707 /* Format: 'Password,Signature' */ 708 auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature); 709 if (!auth_str) { 710 kfree_sensitive(passwd); 711 return -ENOMEM; 712 } 713 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str); 714 kfree(auth_str); 715 kfree_sensitive(passwd); 716 717 return ret ?: count; 718} 719 720static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password); 721 722static ssize_t certificate_store(struct kobject *kobj, 723 struct kobj_attribute *attr, 724 const char *buf, size_t count) 725{ 726 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 727 char *auth_str, *new_cert; 728 char *guid; 729 int ret; 730 731 if (!capable(CAP_SYS_ADMIN)) 732 return -EPERM; 733 734 if (!tlmi_priv.certificate_support) 735 return -EOPNOTSUPP; 736 737 /* If empty then clear installed certificate */ 738 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */ 739 /* Check that signature is set */ 740 if (!setting->signature || !setting->signature[0]) 741 return -EACCES; 742 743 /* Format: 'serial#, signature' */ 744 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 745 dmi_get_system_info(DMI_PRODUCT_SERIAL), 746 setting->signature); 747 if (!auth_str) 748 return -ENOMEM; 749 750 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str); 751 kfree(auth_str); 752 753 return ret ?: count; 754 } 755 756 /* Strip out CR if one is present */ 757 new_cert = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 758 if (!new_cert) 759 return -ENOMEM; 760 761 if (setting->cert_installed) { 762 /* Certificate is installed so this is an update */ 763 if (!setting->signature || !setting->signature[0]) { 764 kfree(new_cert); 765 return -EACCES; 766 } 767 guid = LENOVO_UPDATE_BIOS_CERT_GUID; 768 /* Format: 'Certificate,Signature' */ 769 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 770 new_cert, setting->signature); 771 } else { 772 /* This is a fresh install */ 773 if (!setting->valid || !setting->password[0]) { 774 kfree(new_cert); 775 return -EACCES; 776 } 777 guid = LENOVO_SET_BIOS_CERT_GUID; 778 /* Format: 'Certificate,Admin-password' */ 779 auth_str = kasprintf(GFP_KERNEL, "%s,%s", 780 new_cert, setting->password); 781 } 782 kfree(new_cert); 783 if (!auth_str) 784 return -ENOMEM; 785 786 ret = tlmi_simple_call(guid, auth_str); 787 kfree(auth_str); 788 789 return ret ?: count; 790} 791 792static struct kobj_attribute auth_certificate = __ATTR_WO(certificate); 793 794static ssize_t signature_store(struct kobject *kobj, 795 struct kobj_attribute *attr, 796 const char *buf, size_t count) 797{ 798 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 799 char *new_signature; 800 801 if (!capable(CAP_SYS_ADMIN)) 802 return -EPERM; 803 804 if (!tlmi_priv.certificate_support) 805 return -EOPNOTSUPP; 806 807 /* Strip out CR if one is present */ 808 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 809 if (!new_signature) 810 return -ENOMEM; 811 812 /* Free any previous signature */ 813 kfree(setting->signature); 814 setting->signature = new_signature; 815 816 return count; 817} 818 819static struct kobj_attribute auth_signature = __ATTR_WO(signature); 820 821static ssize_t save_signature_store(struct kobject *kobj, 822 struct kobj_attribute *attr, 823 const char *buf, size_t count) 824{ 825 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 826 char *new_signature; 827 828 if (!capable(CAP_SYS_ADMIN)) 829 return -EPERM; 830 831 if (!tlmi_priv.certificate_support) 832 return -EOPNOTSUPP; 833 834 /* Strip out CR if one is present */ 835 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 836 if (!new_signature) 837 return -ENOMEM; 838 839 /* Free any previous signature */ 840 kfree(setting->save_signature); 841 setting->save_signature = new_signature; 842 843 return count; 844} 845 846static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature); 847 848static umode_t auth_attr_is_visible(struct kobject *kobj, 849 struct attribute *attr, int n) 850{ 851 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 852 853 /* We only want to display level and index settings on HDD/NVMe */ 854 if (attr == &auth_index.attr || attr == &auth_level.attr) { 855 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme)) 856 return attr->mode; 857 return 0; 858 } 859 860 /* We only display certificates on Admin account, if supported */ 861 if (attr == &auth_certificate.attr || 862 attr == &auth_signature.attr || 863 attr == &auth_save_signature.attr || 864 attr == &auth_cert_thumb.attr || 865 attr == &auth_cert_to_password.attr) { 866 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support) 867 return attr->mode; 868 return 0; 869 } 870 871 /* Don't display un-needed settings if opcode available */ 872 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) && 873 tlmi_priv.opcode_support) 874 return 0; 875 876 return attr->mode; 877} 878 879static struct attribute *auth_attrs[] = { 880 &auth_is_pass_set.attr, 881 &auth_min_pass_length.attr, 882 &auth_max_pass_length.attr, 883 &auth_current_password.attr, 884 &auth_new_password.attr, 885 &auth_role.attr, 886 &auth_mechanism.attr, 887 &auth_encoding.attr, 888 &auth_kbdlang.attr, 889 &auth_index.attr, 890 &auth_level.attr, 891 &auth_certificate.attr, 892 &auth_signature.attr, 893 &auth_save_signature.attr, 894 &auth_cert_thumb.attr, 895 &auth_cert_to_password.attr, 896 NULL 897}; 898 899static const struct attribute_group auth_attr_group = { 900 .is_visible = auth_attr_is_visible, 901 .attrs = auth_attrs, 902}; 903 904/* ---- Attributes sysfs --------------------------------------------------------- */ 905static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr, 906 char *buf) 907{ 908 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 909 910 return sysfs_emit(buf, "%s\n", setting->display_name); 911} 912 913static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 914{ 915 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 916 char *item, *value; 917 int ret; 918 919 ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID); 920 if (ret) 921 return ret; 922 923 /* validate and split from `item,value` -> `value` */ 924 value = strpbrk(item, ","); 925 if (!value || value == item || !strlen(value + 1)) 926 ret = -EINVAL; 927 else { 928 /* On Workstations remove the Options part after the value */ 929 strreplace(value, ';', '\0'); 930 ret = sysfs_emit(buf, "%s\n", value + 1); 931 } 932 kfree(item); 933 934 return ret; 935} 936 937static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 938{ 939 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 940 941 return sysfs_emit(buf, "%s\n", setting->possible_values); 942} 943 944static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr, 945 char *buf) 946{ 947 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 948 949 if (setting->possible_values) { 950 /* Figure out what setting type is as BIOS does not return this */ 951 if (strchr(setting->possible_values, ';')) 952 return sysfs_emit(buf, "enumeration\n"); 953 } 954 /* Anything else is going to be a string */ 955 return sysfs_emit(buf, "string\n"); 956} 957 958static ssize_t current_value_store(struct kobject *kobj, 959 struct kobj_attribute *attr, 960 const char *buf, size_t count) 961{ 962 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 963 char *set_str = NULL, *new_setting = NULL; 964 char *auth_str = NULL; 965 int ret; 966 967 if (!tlmi_priv.can_set_bios_settings) 968 return -EOPNOTSUPP; 969 970 /* 971 * If we are using bulk saves a reboot should be done once save has 972 * been called 973 */ 974 if (tlmi_priv.save_mode == TLMI_SAVE_BULK && tlmi_priv.reboot_required) 975 return -EPERM; 976 977 /* Strip out CR if one is present */ 978 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 979 if (!new_setting) 980 return -ENOMEM; 981 982 /* Use lock in case multiple WMI operations needed */ 983 mutex_lock(&tlmi_mutex); 984 985 /* Check if certificate authentication is enabled and active */ 986 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) { 987 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) { 988 ret = -EINVAL; 989 goto out; 990 } 991 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 992 new_setting, tlmi_priv.pwd_admin->signature); 993 if (!set_str) { 994 ret = -ENOMEM; 995 goto out; 996 } 997 998 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str); 999 if (ret) 1000 goto out; 1001 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) 1002 tlmi_priv.save_required = true; 1003 else 1004 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID, 1005 tlmi_priv.pwd_admin->save_signature); 1006 } else if (tlmi_priv.opcode_support) { 1007 /* 1008 * If opcode support is present use that interface. 1009 * Note - this sets the variable and then the password as separate 1010 * WMI calls. Function tlmi_save_bios_settings will error if the 1011 * password is incorrect. 1012 * Workstation's require the opcode to be set before changing the 1013 * attribute. 1014 */ 1015 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1016 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 1017 tlmi_priv.pwd_admin->password); 1018 if (ret) 1019 goto out; 1020 } 1021 1022 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1023 new_setting); 1024 if (!set_str) { 1025 ret = -ENOMEM; 1026 goto out; 1027 } 1028 1029 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1030 if (ret) 1031 goto out; 1032 1033 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) 1034 tlmi_priv.save_required = true; 1035 else 1036 ret = tlmi_save_bios_settings(""); 1037 } else { /* old non-opcode based authentication method (deprecated) */ 1038 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1039 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1040 tlmi_priv.pwd_admin->password, 1041 encoding_options[tlmi_priv.pwd_admin->encoding], 1042 tlmi_priv.pwd_admin->kbdlang); 1043 if (!auth_str) { 1044 ret = -ENOMEM; 1045 goto out; 1046 } 1047 } 1048 1049 if (auth_str) 1050 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name, 1051 new_setting, auth_str); 1052 else 1053 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name, 1054 new_setting); 1055 if (!set_str) { 1056 ret = -ENOMEM; 1057 goto out; 1058 } 1059 1060 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str); 1061 if (ret) 1062 goto out; 1063 1064 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) { 1065 tlmi_priv.save_required = true; 1066 } else { 1067 if (auth_str) 1068 ret = tlmi_save_bios_settings(auth_str); 1069 else 1070 ret = tlmi_save_bios_settings(""); 1071 } 1072 } 1073 if (!ret && !tlmi_priv.pending_changes) { 1074 tlmi_priv.pending_changes = true; 1075 /* let userland know it may need to check reboot pending again */ 1076 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1077 } 1078out: 1079 mutex_unlock(&tlmi_mutex); 1080 kfree(auth_str); 1081 kfree(set_str); 1082 kfree(new_setting); 1083 return ret ?: count; 1084} 1085 1086static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name); 1087 1088static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values); 1089 1090static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600); 1091 1092static struct kobj_attribute attr_type = __ATTR_RO(type); 1093 1094static umode_t attr_is_visible(struct kobject *kobj, 1095 struct attribute *attr, int n) 1096{ 1097 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1098 1099 /* We don't want to display possible_values attributes if not available */ 1100 if ((attr == &attr_possible_values.attr) && (!setting->possible_values)) 1101 return 0; 1102 1103 return attr->mode; 1104} 1105 1106static struct attribute *tlmi_attrs[] = { 1107 &attr_displ_name.attr, 1108 &attr_current_val.attr, 1109 &attr_possible_values.attr, 1110 &attr_type.attr, 1111 NULL 1112}; 1113 1114static const struct attribute_group tlmi_attr_group = { 1115 .is_visible = attr_is_visible, 1116 .attrs = tlmi_attrs, 1117}; 1118 1119static void tlmi_attr_setting_release(struct kobject *kobj) 1120{ 1121 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj); 1122 1123 kfree(setting->possible_values); 1124 kfree(setting); 1125} 1126 1127static void tlmi_pwd_setting_release(struct kobject *kobj) 1128{ 1129 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); 1130 1131 kfree(setting); 1132} 1133 1134static const struct kobj_type tlmi_attr_setting_ktype = { 1135 .release = &tlmi_attr_setting_release, 1136 .sysfs_ops = &kobj_sysfs_ops, 1137}; 1138 1139static const struct kobj_type tlmi_pwd_setting_ktype = { 1140 .release = &tlmi_pwd_setting_release, 1141 .sysfs_ops = &kobj_sysfs_ops, 1142}; 1143 1144static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr, 1145 char *buf) 1146{ 1147 return sprintf(buf, "%d\n", tlmi_priv.pending_changes); 1148} 1149 1150static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot); 1151 1152static const char * const save_mode_strings[] = { 1153 [TLMI_SAVE_SINGLE] = "single", 1154 [TLMI_SAVE_BULK] = "bulk", 1155 [TLMI_SAVE_SAVE] = "save" 1156}; 1157 1158static ssize_t save_settings_show(struct kobject *kobj, struct kobj_attribute *attr, 1159 char *buf) 1160{ 1161 /* Check that setting is valid */ 1162 if (WARN_ON(tlmi_priv.save_mode < TLMI_SAVE_SINGLE || 1163 tlmi_priv.save_mode > TLMI_SAVE_BULK)) 1164 return -EIO; 1165 return sysfs_emit(buf, "%s\n", save_mode_strings[tlmi_priv.save_mode]); 1166} 1167 1168static ssize_t save_settings_store(struct kobject *kobj, struct kobj_attribute *attr, 1169 const char *buf, size_t count) 1170{ 1171 char *auth_str = NULL; 1172 int ret = 0; 1173 int cmd; 1174 1175 cmd = sysfs_match_string(save_mode_strings, buf); 1176 if (cmd < 0) 1177 return cmd; 1178 1179 /* Use lock in case multiple WMI operations needed */ 1180 mutex_lock(&tlmi_mutex); 1181 1182 switch (cmd) { 1183 case TLMI_SAVE_SINGLE: 1184 case TLMI_SAVE_BULK: 1185 tlmi_priv.save_mode = cmd; 1186 goto out; 1187 case TLMI_SAVE_SAVE: 1188 /* Check if supported*/ 1189 if (!tlmi_priv.can_set_bios_settings || 1190 tlmi_priv.save_mode == TLMI_SAVE_SINGLE) { 1191 ret = -EOPNOTSUPP; 1192 goto out; 1193 } 1194 /* Check there is actually something to save */ 1195 if (!tlmi_priv.save_required) { 1196 ret = -ENOENT; 1197 goto out; 1198 } 1199 /* Check if certificate authentication is enabled and active */ 1200 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) { 1201 if (!tlmi_priv.pwd_admin->signature || 1202 !tlmi_priv.pwd_admin->save_signature) { 1203 ret = -EINVAL; 1204 goto out; 1205 } 1206 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID, 1207 tlmi_priv.pwd_admin->save_signature); 1208 if (ret) 1209 goto out; 1210 } else if (tlmi_priv.opcode_support) { 1211 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1212 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin", 1213 tlmi_priv.pwd_admin->password); 1214 if (ret) 1215 goto out; 1216 } 1217 ret = tlmi_save_bios_settings(""); 1218 } else { /* old non-opcode based authentication method (deprecated) */ 1219 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1220 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1221 tlmi_priv.pwd_admin->password, 1222 encoding_options[tlmi_priv.pwd_admin->encoding], 1223 tlmi_priv.pwd_admin->kbdlang); 1224 if (!auth_str) { 1225 ret = -ENOMEM; 1226 goto out; 1227 } 1228 } 1229 1230 if (auth_str) 1231 ret = tlmi_save_bios_settings(auth_str); 1232 else 1233 ret = tlmi_save_bios_settings(""); 1234 } 1235 tlmi_priv.save_required = false; 1236 tlmi_priv.reboot_required = true; 1237 1238 if (!ret && !tlmi_priv.pending_changes) { 1239 tlmi_priv.pending_changes = true; 1240 /* let userland know it may need to check reboot pending again */ 1241 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1242 } 1243 break; 1244 } 1245out: 1246 mutex_unlock(&tlmi_mutex); 1247 kfree(auth_str); 1248 return ret ?: count; 1249} 1250 1251static struct kobj_attribute save_settings = __ATTR_RW(save_settings); 1252 1253/* ---- Debug interface--------------------------------------------------------- */ 1254static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr, 1255 const char *buf, size_t count) 1256{ 1257 char *set_str = NULL, *new_setting = NULL; 1258 char *auth_str = NULL; 1259 int ret; 1260 1261 if (!tlmi_priv.can_debug_cmd) 1262 return -EOPNOTSUPP; 1263 1264 /* Strip out CR if one is present */ 1265 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); 1266 if (!new_setting) 1267 return -ENOMEM; 1268 1269 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) { 1270 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;", 1271 tlmi_priv.pwd_admin->password, 1272 encoding_options[tlmi_priv.pwd_admin->encoding], 1273 tlmi_priv.pwd_admin->kbdlang); 1274 if (!auth_str) { 1275 ret = -ENOMEM; 1276 goto out; 1277 } 1278 } 1279 1280 if (auth_str) 1281 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str); 1282 else 1283 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting); 1284 if (!set_str) { 1285 ret = -ENOMEM; 1286 goto out; 1287 } 1288 1289 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str); 1290 if (ret) 1291 goto out; 1292 1293 if (!ret && !tlmi_priv.pending_changes) { 1294 tlmi_priv.pending_changes = true; 1295 /* let userland know it may need to check reboot pending again */ 1296 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE); 1297 } 1298out: 1299 kfree(auth_str); 1300 kfree(set_str); 1301 kfree(new_setting); 1302 return ret ?: count; 1303} 1304 1305static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd); 1306 1307/* ---- Initialisation --------------------------------------------------------- */ 1308static void tlmi_release_attr(void) 1309{ 1310 int i; 1311 1312 /* Attribute structures */ 1313 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1314 if (tlmi_priv.setting[i]) { 1315 sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1316 kobject_put(&tlmi_priv.setting[i]->kobj); 1317 } 1318 } 1319 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1320 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr); 1321 1322 if (tlmi_priv.can_debug_cmd && debug_support) 1323 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1324 1325 kset_unregister(tlmi_priv.attribute_kset); 1326 1327 /* Free up any saved signatures */ 1328 kfree(tlmi_priv.pwd_admin->signature); 1329 kfree(tlmi_priv.pwd_admin->save_signature); 1330 1331 /* Authentication structures */ 1332 sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1333 kobject_put(&tlmi_priv.pwd_admin->kobj); 1334 sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1335 kobject_put(&tlmi_priv.pwd_power->kobj); 1336 1337 if (tlmi_priv.opcode_support) { 1338 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1339 kobject_put(&tlmi_priv.pwd_system->kobj); 1340 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1341 kobject_put(&tlmi_priv.pwd_hdd->kobj); 1342 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1343 kobject_put(&tlmi_priv.pwd_nvme->kobj); 1344 } 1345 1346 kset_unregister(tlmi_priv.authentication_kset); 1347} 1348 1349static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name) 1350{ 1351 struct kobject *duplicate; 1352 1353 if (!strcmp(name, "Reserved")) 1354 return -EINVAL; 1355 1356 duplicate = kset_find_obj(attribute_kset, name); 1357 if (duplicate) { 1358 pr_debug("Duplicate attribute name found - %s\n", name); 1359 /* kset_find_obj() returns a reference */ 1360 kobject_put(duplicate); 1361 return -EBUSY; 1362 } 1363 1364 return 0; 1365} 1366 1367static int tlmi_sysfs_init(void) 1368{ 1369 int i, ret; 1370 1371 ret = fw_attributes_class_get(&fw_attr_class); 1372 if (ret) 1373 return ret; 1374 1375 tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0), 1376 NULL, "%s", "thinklmi"); 1377 if (IS_ERR(tlmi_priv.class_dev)) { 1378 ret = PTR_ERR(tlmi_priv.class_dev); 1379 goto fail_class_created; 1380 } 1381 1382 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL, 1383 &tlmi_priv.class_dev->kobj); 1384 if (!tlmi_priv.attribute_kset) { 1385 ret = -ENOMEM; 1386 goto fail_device_created; 1387 } 1388 1389 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) { 1390 /* Check if index is a valid setting - skip if it isn't */ 1391 if (!tlmi_priv.setting[i]) 1392 continue; 1393 1394 /* check for duplicate or reserved values */ 1395 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset, 1396 tlmi_priv.setting[i]->display_name) < 0) { 1397 kfree(tlmi_priv.setting[i]->possible_values); 1398 kfree(tlmi_priv.setting[i]); 1399 tlmi_priv.setting[i] = NULL; 1400 continue; 1401 } 1402 1403 /* Build attribute */ 1404 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset; 1405 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL, 1406 "%s", tlmi_priv.setting[i]->display_name); 1407 if (ret) 1408 goto fail_create_attr; 1409 1410 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group); 1411 if (ret) 1412 goto fail_create_attr; 1413 } 1414 1415 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr); 1416 if (ret) 1417 goto fail_create_attr; 1418 1419 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr); 1420 if (ret) 1421 goto fail_create_attr; 1422 1423 if (tlmi_priv.can_debug_cmd && debug_support) { 1424 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr); 1425 if (ret) 1426 goto fail_create_attr; 1427 } 1428 1429 /* Create authentication entries */ 1430 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL, 1431 &tlmi_priv.class_dev->kobj); 1432 if (!tlmi_priv.authentication_kset) { 1433 ret = -ENOMEM; 1434 goto fail_create_attr; 1435 } 1436 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset; 1437 ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin"); 1438 if (ret) 1439 goto fail_create_attr; 1440 1441 ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group); 1442 if (ret) 1443 goto fail_create_attr; 1444 1445 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset; 1446 ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on"); 1447 if (ret) 1448 goto fail_create_attr; 1449 1450 ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group); 1451 if (ret) 1452 goto fail_create_attr; 1453 1454 if (tlmi_priv.opcode_support) { 1455 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset; 1456 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System"); 1457 if (ret) 1458 goto fail_create_attr; 1459 1460 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group); 1461 if (ret) 1462 goto fail_create_attr; 1463 1464 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset; 1465 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD"); 1466 if (ret) 1467 goto fail_create_attr; 1468 1469 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group); 1470 if (ret) 1471 goto fail_create_attr; 1472 1473 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset; 1474 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe"); 1475 if (ret) 1476 goto fail_create_attr; 1477 1478 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group); 1479 if (ret) 1480 goto fail_create_attr; 1481 } 1482 1483 return ret; 1484 1485fail_create_attr: 1486 tlmi_release_attr(); 1487fail_device_created: 1488 device_destroy(fw_attr_class, MKDEV(0, 0)); 1489fail_class_created: 1490 fw_attributes_class_put(); 1491 return ret; 1492} 1493 1494/* ---- Base Driver -------------------------------------------------------- */ 1495static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type, 1496 const char *pwd_role) 1497{ 1498 struct tlmi_pwd_setting *new_pwd; 1499 1500 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL); 1501 if (!new_pwd) 1502 return NULL; 1503 1504 strscpy(new_pwd->kbdlang, "us", TLMI_LANG_MAXLEN); 1505 new_pwd->encoding = TLMI_ENCODING_ASCII; 1506 new_pwd->pwd_type = pwd_type; 1507 new_pwd->role = pwd_role; 1508 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length; 1509 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length; 1510 new_pwd->index = 0; 1511 1512 kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype); 1513 1514 return new_pwd; 1515} 1516 1517static int tlmi_analyze(void) 1518{ 1519 int i, ret; 1520 1521 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) && 1522 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID)) 1523 tlmi_priv.can_set_bios_settings = true; 1524 1525 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID)) 1526 tlmi_priv.can_get_bios_selections = true; 1527 1528 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID)) 1529 tlmi_priv.can_set_bios_password = true; 1530 1531 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID)) 1532 tlmi_priv.can_get_password_settings = true; 1533 1534 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID)) 1535 tlmi_priv.can_debug_cmd = true; 1536 1537 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID)) 1538 tlmi_priv.opcode_support = true; 1539 1540 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) && 1541 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) && 1542 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID)) 1543 tlmi_priv.certificate_support = true; 1544 1545 /* 1546 * Try to find the number of valid settings of this machine 1547 * and use it to create sysfs attributes. 1548 */ 1549 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1550 struct tlmi_attr_setting *setting; 1551 char *item = NULL; 1552 1553 tlmi_priv.setting[i] = NULL; 1554 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID); 1555 if (ret) 1556 break; 1557 if (!item) 1558 break; 1559 if (!*item) { 1560 kfree(item); 1561 continue; 1562 } 1563 1564 /* It is not allowed to have '/' for file name. Convert it into '\'. */ 1565 strreplace(item, '/', '\\'); 1566 1567 /* Remove the value part */ 1568 strreplace(item, ',', '\0'); 1569 1570 /* Create a setting entry */ 1571 setting = kzalloc(sizeof(*setting), GFP_KERNEL); 1572 if (!setting) { 1573 ret = -ENOMEM; 1574 kfree(item); 1575 goto fail_clear_attr; 1576 } 1577 setting->index = i; 1578 strscpy(setting->display_name, item, TLMI_SETTINGS_MAXLEN); 1579 /* If BIOS selections supported, load those */ 1580 if (tlmi_priv.can_get_bios_selections) { 1581 ret = tlmi_get_bios_selections(setting->display_name, 1582 &setting->possible_values); 1583 if (ret || !setting->possible_values) 1584 pr_info("Error retrieving possible values for %d : %s\n", 1585 i, setting->display_name); 1586 } else { 1587 /* 1588 * Older Thinkstations don't support the bios_selections API. 1589 * Instead they store this as a [Optional:Option1,Option2] section of the 1590 * name string. 1591 * Try and pull that out if it's available. 1592 */ 1593 char *optitem, *optstart, *optend; 1594 1595 if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) { 1596 optstart = strstr(optitem, "[Optional:"); 1597 if (optstart) { 1598 optstart += strlen("[Optional:"); 1599 optend = strstr(optstart, "]"); 1600 if (optend) 1601 setting->possible_values = 1602 kstrndup(optstart, optend - optstart, 1603 GFP_KERNEL); 1604 } 1605 kfree(optitem); 1606 } 1607 } 1608 /* 1609 * firmware-attributes requires that possible_values are separated by ';' but 1610 * Lenovo FW uses ','. Replace appropriately. 1611 */ 1612 if (setting->possible_values) 1613 strreplace(setting->possible_values, ',', ';'); 1614 1615 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype); 1616 tlmi_priv.setting[i] = setting; 1617 kfree(item); 1618 } 1619 1620 /* Create password setting structure */ 1621 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg); 1622 if (ret) 1623 goto fail_clear_attr; 1624 1625 /* All failures below boil down to kmalloc failures */ 1626 ret = -ENOMEM; 1627 1628 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin"); 1629 if (!tlmi_priv.pwd_admin) 1630 goto fail_clear_attr; 1631 1632 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD) 1633 tlmi_priv.pwd_admin->valid = true; 1634 1635 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on"); 1636 if (!tlmi_priv.pwd_power) 1637 goto fail_clear_attr; 1638 1639 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD) 1640 tlmi_priv.pwd_power->valid = true; 1641 1642 if (tlmi_priv.opcode_support) { 1643 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system"); 1644 if (!tlmi_priv.pwd_system) 1645 goto fail_clear_attr; 1646 1647 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD) 1648 tlmi_priv.pwd_system->valid = true; 1649 1650 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd"); 1651 if (!tlmi_priv.pwd_hdd) 1652 goto fail_clear_attr; 1653 1654 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme"); 1655 if (!tlmi_priv.pwd_nvme) 1656 goto fail_clear_attr; 1657 1658 /* Set default hdd/nvme index to 1 as there is no device 0 */ 1659 tlmi_priv.pwd_hdd->index = 1; 1660 tlmi_priv.pwd_nvme->index = 1; 1661 1662 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) { 1663 /* Check if PWD is configured and set index to first drive found */ 1664 if (tlmi_priv.pwdcfg.ext.hdd_user_password || 1665 tlmi_priv.pwdcfg.ext.hdd_master_password) { 1666 tlmi_priv.pwd_hdd->valid = true; 1667 if (tlmi_priv.pwdcfg.ext.hdd_master_password) 1668 tlmi_priv.pwd_hdd->index = 1669 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1; 1670 else 1671 tlmi_priv.pwd_hdd->index = 1672 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1; 1673 } 1674 if (tlmi_priv.pwdcfg.ext.nvme_user_password || 1675 tlmi_priv.pwdcfg.ext.nvme_master_password) { 1676 tlmi_priv.pwd_nvme->valid = true; 1677 if (tlmi_priv.pwdcfg.ext.nvme_master_password) 1678 tlmi_priv.pwd_nvme->index = 1679 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1; 1680 else 1681 tlmi_priv.pwd_nvme->index = 1682 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1; 1683 } 1684 } 1685 } 1686 1687 if (tlmi_priv.certificate_support && 1688 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT)) 1689 tlmi_priv.pwd_admin->cert_installed = true; 1690 1691 return 0; 1692 1693fail_clear_attr: 1694 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) { 1695 if (tlmi_priv.setting[i]) { 1696 kfree(tlmi_priv.setting[i]->possible_values); 1697 kfree(tlmi_priv.setting[i]); 1698 } 1699 } 1700 kfree(tlmi_priv.pwd_admin); 1701 kfree(tlmi_priv.pwd_power); 1702 kfree(tlmi_priv.pwd_system); 1703 kfree(tlmi_priv.pwd_hdd); 1704 kfree(tlmi_priv.pwd_nvme); 1705 return ret; 1706} 1707 1708static void tlmi_remove(struct wmi_device *wdev) 1709{ 1710 tlmi_release_attr(); 1711 device_destroy(fw_attr_class, MKDEV(0, 0)); 1712 fw_attributes_class_put(); 1713} 1714 1715static int tlmi_probe(struct wmi_device *wdev, const void *context) 1716{ 1717 int ret; 1718 1719 ret = tlmi_analyze(); 1720 if (ret) 1721 return ret; 1722 1723 return tlmi_sysfs_init(); 1724} 1725 1726static const struct wmi_device_id tlmi_id_table[] = { 1727 { .guid_string = LENOVO_BIOS_SETTING_GUID }, 1728 { } 1729}; 1730MODULE_DEVICE_TABLE(wmi, tlmi_id_table); 1731 1732static struct wmi_driver tlmi_driver = { 1733 .driver = { 1734 .name = "think-lmi", 1735 }, 1736 .id_table = tlmi_id_table, 1737 .probe = tlmi_probe, 1738 .remove = tlmi_remove, 1739}; 1740 1741MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>"); 1742MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>"); 1743MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>"); 1744MODULE_DESCRIPTION("ThinkLMI Driver"); 1745MODULE_LICENSE("GPL"); 1746 1747module_wmi_driver(tlmi_driver); 1748