1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Think LMI BIOS configuration driver
4 *
5 * Copyright(C) 2019-2021 Lenovo
6 *
7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi
8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com>
9 * Distributed under the GPL-2.0 license
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <linux/acpi.h>
15 #include <linux/array_size.h>
16 #include <linux/errno.h>
17 #include <linux/fs.h>
18 #include <linux/mutex.h>
19 #include <linux/string_helpers.h>
20 #include <linux/types.h>
21 #include <linux/dmi.h>
22 #include <linux/wmi.h>
23 #include "firmware_attributes_class.h"
24 #include "think-lmi.h"
25
26 static bool debug_support;
27 module_param(debug_support, bool, 0444);
28 MODULE_PARM_DESC(debug_support, "Enable debug command support");
29
30 /*
31 * Name: BiosSetting
32 * Description: Get item name and settings for current LMI instance.
33 * Type: Query
34 * Returns: "Item,Value"
35 * Example: "WakeOnLAN,Enable"
36 */
37 #define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7"
38
39 /*
40 * Name: SetBiosSetting
41 * Description: Change the BIOS setting to the desired value using the SetBiosSetting
42 * class. To save the settings, use the SaveBiosSetting class.
43 * BIOS settings and values are case sensitive.
44 * After making changes to the BIOS settings, you must reboot the computer
45 * before the changes will take effect.
46 * Type: Method
47 * Arguments: "Item,Value,Password,Encoding,KbdLang;"
48 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;"
49 */
50 #define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1"
51
52 /*
53 * Name: SaveBiosSettings
54 * Description: Save any pending changes in settings.
55 * Type: Method
56 * Arguments: "Password,Encoding,KbdLang;"
57 * Example: "pa55w0rd,ascii,us;"
58 */
59 #define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3"
60
61 /*
62 * Name: BiosPasswordSettings
63 * Description: Return BIOS Password settings
64 * Type: Query
65 * Returns: PasswordMode, PasswordState, MinLength, MaxLength,
66 * SupportedEncoding, SupportedKeyboard
67 */
68 #define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246"
69
70 /*
71 * Name: SetBiosPassword
72 * Description: Change a specific password.
73 * - BIOS settings cannot be changed at the same boot as power-on
74 * passwords (POP) and hard disk passwords (HDP). If you want to change
75 * BIOS settings and POP or HDP, you must reboot the system after changing
76 * one of them.
77 * - A password cannot be set using this method when one does not already
78 * exist. Passwords can only be updated or cleared.
79 * Type: Method
80 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;"
81 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;”
82 */
83 #define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7"
84
85 /*
86 * Name: GetBiosSelections
87 * Description: Return a list of valid settings for a given item.
88 * Type: Method
89 * Arguments: "Item"
90 * Returns: "Value1,Value2,Value3,..."
91 * Example:
92 * -> "FlashOverLAN"
93 * <- "Enabled,Disabled"
94 */
95 #define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B"
96
97 /*
98 * Name: DebugCmd
99 * Description: Debug entry method for entering debug commands to the BIOS
100 */
101 #define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1"
102
103 /*
104 * Name: OpcodeIF
105 * Description: Opcode interface which provides the ability to set multiple
106 * parameters and then trigger an action with a final command.
107 * This is particularly useful for simplifying setting passwords.
108 * With this support comes the ability to set System, HDD and NVMe
109 * passwords.
110 * This is currently available on ThinkCenter and ThinkStations platforms
111 */
112 #define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836"
113
114 /*
115 * Name: SetBiosCert
116 * Description: Install BIOS certificate.
117 * Type: Method
118 * Arguments: "Certificate,Password"
119 * You must reboot the computer before the changes will take effect.
120 */
121 #define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE"
122
123 /*
124 * Name: UpdateBiosCert
125 * Description: Update BIOS certificate.
126 * Type: Method
127 * Format: "Certificate,Signature"
128 * You must reboot the computer before the changes will take effect.
129 */
130 #define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE"
131
132 /*
133 * Name: ClearBiosCert
134 * Description: Uninstall BIOS certificate.
135 * Type: Method
136 * Format: "Serial,Signature"
137 * You must reboot the computer before the changes will take effect.
138 */
139 #define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890"
140 /*
141 * Name: CertToPassword
142 * Description: Switch from certificate to password authentication.
143 * Type: Method
144 * Format: "Password,Signature"
145 * You must reboot the computer before the changes will take effect.
146 */
147 #define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D"
148
149 /*
150 * Name: SetBiosSettingCert
151 * Description: Set attribute using certificate authentication.
152 * Type: Method
153 * Format: "Item,Value,Signature"
154 */
155 #define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003"
156
157 /*
158 * Name: SaveBiosSettingCert
159 * Description: Save any pending changes in settings.
160 * Type: Method
161 * Format: "Signature"
162 */
163 #define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551"
164
165 /*
166 * Name: CertThumbprint
167 * Description: Display Certificate thumbprints
168 * Type: Query
169 * Returns: MD5, SHA1 & SHA256 thumbprints
170 */
171 #define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4"
172
173 #define TLMI_POP_PWD BIT(0) /* Supervisor */
174 #define TLMI_PAP_PWD BIT(1) /* Power-on */
175 #define TLMI_HDD_PWD BIT(2) /* HDD/NVME */
176 #define TLMI_SMP_PWD BIT(6) /* System Management */
177 #define TLMI_CERT_SVC BIT(7) /* Admin Certificate Based */
178 #define TLMI_CERT_SMC BIT(8) /* System Certificate Based */
179
180 static const struct tlmi_err_codes tlmi_errs[] = {
181 {"Success", 0},
182 {"Not Supported", -EOPNOTSUPP},
183 {"Invalid Parameter", -EINVAL},
184 {"Access Denied", -EACCES},
185 {"System Busy", -EBUSY},
186 };
187
188 static const char * const encoding_options[] = {
189 [TLMI_ENCODING_ASCII] = "ascii",
190 [TLMI_ENCODING_SCANCODE] = "scancode",
191 };
192 static const char * const level_options[] = {
193 [TLMI_LEVEL_USER] = "user",
194 [TLMI_LEVEL_MASTER] = "master",
195 };
196 static struct think_lmi tlmi_priv;
197 static DEFINE_MUTEX(tlmi_mutex);
198
to_tlmi_pwd_setting(struct kobject * kobj)199 static inline struct tlmi_pwd_setting *to_tlmi_pwd_setting(struct kobject *kobj)
200 {
201 return container_of(kobj, struct tlmi_pwd_setting, kobj);
202 }
203
to_tlmi_attr_setting(struct kobject * kobj)204 static inline struct tlmi_attr_setting *to_tlmi_attr_setting(struct kobject *kobj)
205 {
206 return container_of(kobj, struct tlmi_attr_setting, kobj);
207 }
208
209 /* Convert BIOS WMI error string to suitable error code */
tlmi_errstr_to_err(const char * errstr)210 static int tlmi_errstr_to_err(const char *errstr)
211 {
212 int i;
213
214 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) {
215 if (!strcmp(tlmi_errs[i].err_str, errstr))
216 return tlmi_errs[i].err_code;
217 }
218 return -EPERM;
219 }
220
221 /* Extract error string from WMI return buffer */
tlmi_extract_error(const struct acpi_buffer * output)222 static int tlmi_extract_error(const struct acpi_buffer *output)
223 {
224 const union acpi_object *obj;
225
226 obj = output->pointer;
227 if (!obj)
228 return -ENOMEM;
229 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
230 return -EIO;
231
232 return tlmi_errstr_to_err(obj->string.pointer);
233 }
234
235 /* Utility function to execute WMI call to BIOS */
tlmi_simple_call(const char * guid,const char * arg)236 static int tlmi_simple_call(const char *guid, const char *arg)
237 {
238 const struct acpi_buffer input = { strlen(arg), (char *)arg };
239 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
240 acpi_status status;
241 int i, err;
242
243 /*
244 * Duplicated call required to match BIOS workaround for behavior
245 * seen when WMI accessed via scripting on other OS.
246 */
247 for (i = 0; i < 2; i++) {
248 /* (re)initialize output buffer to default state */
249 output.length = ACPI_ALLOCATE_BUFFER;
250 output.pointer = NULL;
251
252 status = wmi_evaluate_method(guid, 0, 0, &input, &output);
253 if (ACPI_FAILURE(status)) {
254 kfree(output.pointer);
255 return -EIO;
256 }
257 err = tlmi_extract_error(&output);
258 kfree(output.pointer);
259 if (err)
260 return err;
261 }
262 return 0;
263 }
264
265 /* Extract output string from WMI return value */
tlmi_extract_output_string(union acpi_object * obj,char ** string)266 static int tlmi_extract_output_string(union acpi_object *obj, char **string)
267 {
268 char *s;
269
270 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
271 return -EIO;
272
273 s = kstrdup(obj->string.pointer, GFP_KERNEL);
274 if (!s)
275 return -ENOMEM;
276 *string = s;
277 return 0;
278 }
279
280 /* ------ Core interface functions ------------*/
281
282 /* Get password settings from BIOS */
tlmi_get_pwd_settings(struct tlmi_pwdcfg * pwdcfg)283 static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg)
284 {
285 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
286 const union acpi_object *obj;
287 acpi_status status;
288 int copy_size;
289
290 if (!tlmi_priv.can_get_password_settings)
291 return -EOPNOTSUPP;
292
293 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0,
294 &output);
295 if (ACPI_FAILURE(status))
296 return -EIO;
297
298 obj = output.pointer;
299 if (!obj)
300 return -ENOMEM;
301 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) {
302 kfree(obj);
303 return -EIO;
304 }
305 /*
306 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad.
307 * To make the driver compatible on different brands, we permit it to get
308 * the data in below case.
309 * Settings must have at minimum the core fields available
310 */
311 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) {
312 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length);
313 kfree(obj);
314 return -EIO;
315 }
316
317 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg));
318
319 memcpy(pwdcfg, obj->buffer.pointer, copy_size);
320 kfree(obj);
321
322 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE))
323 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1;
324 return 0;
325 }
326
tlmi_save_bios_settings(const char * password)327 static int tlmi_save_bios_settings(const char *password)
328 {
329 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID,
330 password);
331 }
332
tlmi_opcode_setting(char * setting,const char * value)333 static int tlmi_opcode_setting(char *setting, const char *value)
334 {
335 char *opcode_str;
336 int ret;
337
338 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value);
339 if (!opcode_str)
340 return -ENOMEM;
341
342 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str);
343 kfree(opcode_str);
344 return ret;
345 }
346
tlmi_setting(struct wmi_device * wdev,int item,char ** value)347 static int tlmi_setting(struct wmi_device *wdev, int item, char **value)
348 {
349 union acpi_object *obj;
350 int ret;
351
352 obj = wmidev_block_query(wdev, item);
353 if (!obj)
354 return -EIO;
355
356 ret = tlmi_extract_output_string(obj, value);
357 kfree(obj);
358
359 return ret;
360 }
361
tlmi_get_bios_selections(const char * item,char ** value)362 static int tlmi_get_bios_selections(const char *item, char **value)
363 {
364 const struct acpi_buffer input = { strlen(item), (char *)item };
365 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
366 union acpi_object *obj;
367 acpi_status status;
368 int ret;
369
370 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID,
371 0, 0, &input, &output);
372 if (ACPI_FAILURE(status))
373 return -EIO;
374
375 obj = output.pointer;
376 if (!obj)
377 return -ENODATA;
378
379 ret = tlmi_extract_output_string(obj, value);
380 kfree(obj);
381
382 return ret;
383 }
384
385 /* ---- Authentication sysfs --------------------------------------------------------- */
is_enabled_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)386 static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr,
387 char *buf)
388 {
389 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
390
391 return sysfs_emit(buf, "%d\n", setting->pwd_enabled || setting->cert_installed);
392 }
393
394 static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);
395
current_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)396 static ssize_t current_password_store(struct kobject *kobj,
397 struct kobj_attribute *attr,
398 const char *buf, size_t count)
399 {
400 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
401 size_t pwdlen;
402
403 pwdlen = strlen(buf);
404 /* pwdlen == 0 is allowed to clear the password */
405 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
406 return -EINVAL;
407
408 strscpy(setting->password, buf, setting->maxlen);
409 /* Strip out CR if one is present, setting password won't work if it is present */
410 strreplace(setting->password, '\n', '\0');
411 return count;
412 }
413
414 static struct kobj_attribute auth_current_password = __ATTR_WO(current_password);
415
new_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)416 static ssize_t new_password_store(struct kobject *kobj,
417 struct kobj_attribute *attr,
418 const char *buf, size_t count)
419 {
420 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
421 char *auth_str, *new_pwd;
422 size_t pwdlen;
423 int ret;
424
425 if (!capable(CAP_SYS_ADMIN))
426 return -EPERM;
427
428 if (!tlmi_priv.can_set_bios_password)
429 return -EOPNOTSUPP;
430
431 /* Strip out CR if one is present, setting password won't work if it is present */
432 new_pwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
433 if (!new_pwd)
434 return -ENOMEM;
435
436 /* Use lock in case multiple WMI operations needed */
437 mutex_lock(&tlmi_mutex);
438
439 pwdlen = strlen(new_pwd);
440 /* pwdlen == 0 is allowed to clear the password */
441 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
442 ret = -EINVAL;
443 goto out;
444 }
445
446 /* If opcode support is present use that interface */
447 if (tlmi_priv.opcode_support) {
448 char pwd_type[8];
449
450 /* Special handling required for HDD and NVMe passwords */
451 if (setting == tlmi_priv.pwd_hdd) {
452 if (setting->level == TLMI_LEVEL_USER)
453 sprintf(pwd_type, "uhdp%d", setting->index);
454 else
455 sprintf(pwd_type, "mhdp%d", setting->index);
456 } else if (setting == tlmi_priv.pwd_nvme) {
457 if (setting->level == TLMI_LEVEL_USER)
458 sprintf(pwd_type, "udrp%d", setting->index);
459 else
460 sprintf(pwd_type, "adrp%d", setting->index);
461 } else {
462 sprintf(pwd_type, "%s", setting->pwd_type);
463 }
464
465 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type);
466 if (ret)
467 goto out;
468
469 /*
470 * Note admin password is not always required if SMPControl enabled in BIOS,
471 * So only set if it's configured.
472 * Let BIOS figure it out - we'll get an error if operation is not permitted
473 */
474 if (tlmi_priv.pwd_admin->pwd_enabled && strlen(tlmi_priv.pwd_admin->password)) {
475 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
476 tlmi_priv.pwd_admin->password);
477 if (ret)
478 goto out;
479 }
480 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password);
481 if (ret)
482 goto out;
483 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd);
484 if (ret)
485 goto out;
486 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;");
487 } else {
488 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */
489 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;",
490 setting->pwd_type, setting->password, new_pwd,
491 encoding_options[setting->encoding], setting->kbdlang);
492 if (!auth_str) {
493 ret = -ENOMEM;
494 goto out;
495 }
496 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str);
497 kfree(auth_str);
498 }
499 out:
500 mutex_unlock(&tlmi_mutex);
501 kfree(new_pwd);
502 return ret ?: count;
503 }
504
505 static struct kobj_attribute auth_new_password = __ATTR_WO(new_password);
506
min_password_length_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)507 static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
508 char *buf)
509 {
510 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
511
512 return sysfs_emit(buf, "%d\n", setting->minlen);
513 }
514
515 static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length);
516
max_password_length_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)517 static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
518 char *buf)
519 {
520 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
521
522 return sysfs_emit(buf, "%d\n", setting->maxlen);
523 }
524 static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length);
525
mechanism_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)526 static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr,
527 char *buf)
528 {
529 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
530
531 if (setting->cert_installed)
532 return sysfs_emit(buf, "certificate\n");
533 return sysfs_emit(buf, "password\n");
534 }
535 static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism);
536
encoding_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)537 static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr,
538 char *buf)
539 {
540 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
541
542 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]);
543 }
544
encoding_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)545 static ssize_t encoding_store(struct kobject *kobj,
546 struct kobj_attribute *attr,
547 const char *buf, size_t count)
548 {
549 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
550 int i;
551
552 /* Scan for a matching profile */
553 i = sysfs_match_string(encoding_options, buf);
554 if (i < 0)
555 return -EINVAL;
556
557 setting->encoding = i;
558 return count;
559 }
560
561 static struct kobj_attribute auth_encoding = __ATTR_RW(encoding);
562
kbdlang_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)563 static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr,
564 char *buf)
565 {
566 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
567
568 return sysfs_emit(buf, "%s\n", setting->kbdlang);
569 }
570
kbdlang_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)571 static ssize_t kbdlang_store(struct kobject *kobj,
572 struct kobj_attribute *attr,
573 const char *buf, size_t count)
574 {
575 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
576 int length;
577
578 /* Calculate length till '\n' or terminating 0 */
579 length = strchrnul(buf, '\n') - buf;
580 if (!length || length >= TLMI_LANG_MAXLEN)
581 return -EINVAL;
582
583 memcpy(setting->kbdlang, buf, length);
584 setting->kbdlang[length] = '\0';
585 return count;
586 }
587
588 static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang);
589
role_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)590 static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr,
591 char *buf)
592 {
593 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
594
595 return sysfs_emit(buf, "%s\n", setting->role);
596 }
597 static struct kobj_attribute auth_role = __ATTR_RO(role);
598
index_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)599 static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr,
600 char *buf)
601 {
602 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
603
604 return sysfs_emit(buf, "%d\n", setting->index);
605 }
606
index_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)607 static ssize_t index_store(struct kobject *kobj,
608 struct kobj_attribute *attr,
609 const char *buf, size_t count)
610 {
611 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
612 int err, val;
613
614 err = kstrtoint(buf, 10, &val);
615 if (err < 0)
616 return err;
617
618 if (val < 0 || val > TLMI_INDEX_MAX)
619 return -EINVAL;
620
621 setting->index = val;
622 return count;
623 }
624
625 static struct kobj_attribute auth_index = __ATTR_RW(index);
626
level_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)627 static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr,
628 char *buf)
629 {
630 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
631
632 return sysfs_emit(buf, "%s\n", level_options[setting->level]);
633 }
634
level_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)635 static ssize_t level_store(struct kobject *kobj,
636 struct kobj_attribute *attr,
637 const char *buf, size_t count)
638 {
639 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
640 int i;
641
642 /* Scan for a matching profile */
643 i = sysfs_match_string(level_options, buf);
644 if (i < 0)
645 return -EINVAL;
646
647 setting->level = i;
648 return count;
649 }
650
651 static struct kobj_attribute auth_level = __ATTR_RW(level);
652
cert_command(struct tlmi_pwd_setting * setting,const char * arg1,const char * arg2)653 static char *cert_command(struct tlmi_pwd_setting *setting, const char *arg1, const char *arg2)
654 {
655 /* Prepend with SVC or SMC if multicert supported */
656 if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT)
657 return kasprintf(GFP_KERNEL, "%s,%s,%s",
658 setting == tlmi_priv.pwd_admin ? "SVC" : "SMC",
659 arg1, arg2);
660 else
661 return kasprintf(GFP_KERNEL, "%s,%s", arg1, arg2);
662 }
663
cert_thumbprint(char * buf,const char * arg,int count)664 static ssize_t cert_thumbprint(char *buf, const char *arg, int count)
665 {
666 const struct acpi_buffer input = { strlen(arg), (char *)arg };
667 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
668 const union acpi_object *obj;
669 acpi_status status;
670
671 status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output);
672 if (ACPI_FAILURE(status)) {
673 kfree(output.pointer);
674 return -EIO;
675 }
676 obj = output.pointer;
677 if (!obj)
678 return -ENOMEM;
679 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) {
680 kfree(output.pointer);
681 return -EIO;
682 }
683 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer);
684 kfree(output.pointer);
685
686 return count;
687 }
688
689 static char *thumbtypes[] = {"Md5", "Sha1", "Sha256"};
690
certificate_thumbprint_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)691 static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,
692 char *buf)
693 {
694 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
695 unsigned int i;
696 int count = 0;
697 char *wmistr;
698
699 if (!tlmi_priv.certificate_support || !setting->cert_installed)
700 return -EOPNOTSUPP;
701
702 for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
703 if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) {
704 /* Format: 'SVC | SMC, Thumbtype' */
705 wmistr = kasprintf(GFP_KERNEL, "%s,%s",
706 setting == tlmi_priv.pwd_admin ? "SVC" : "SMC",
707 thumbtypes[i]);
708 } else {
709 /* Format: 'Thumbtype' */
710 wmistr = kasprintf(GFP_KERNEL, "%s", thumbtypes[i]);
711 }
712 if (!wmistr)
713 return -ENOMEM;
714 count += cert_thumbprint(buf, wmistr, count);
715 kfree(wmistr);
716 }
717
718 return count;
719 }
720
721 static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint);
722
cert_to_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)723 static ssize_t cert_to_password_store(struct kobject *kobj,
724 struct kobj_attribute *attr,
725 const char *buf, size_t count)
726 {
727 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
728 char *auth_str, *passwd;
729 int ret;
730
731 if (!capable(CAP_SYS_ADMIN))
732 return -EPERM;
733
734 if (!tlmi_priv.certificate_support)
735 return -EOPNOTSUPP;
736
737 if (!setting->cert_installed)
738 return -EINVAL;
739
740 if (!setting->signature || !setting->signature[0])
741 return -EACCES;
742
743 /* Strip out CR if one is present */
744 passwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
745 if (!passwd)
746 return -ENOMEM;
747
748 /* Format: 'Password,Signature' */
749 auth_str = cert_command(setting, passwd, setting->signature);
750 if (!auth_str) {
751 kfree_sensitive(passwd);
752 return -ENOMEM;
753 }
754 ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str);
755 kfree(auth_str);
756 kfree_sensitive(passwd);
757
758 return ret ?: count;
759 }
760
761 static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password);
762
763 enum cert_install_mode {
764 TLMI_CERT_INSTALL,
765 TLMI_CERT_UPDATE,
766 };
767
certificate_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)768 static ssize_t certificate_store(struct kobject *kobj,
769 struct kobj_attribute *attr,
770 const char *buf, size_t count)
771 {
772 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
773 enum cert_install_mode install_mode = TLMI_CERT_INSTALL;
774 char *auth_str, *new_cert;
775 char *signature;
776 char *guid;
777 int ret;
778
779 if (!capable(CAP_SYS_ADMIN))
780 return -EPERM;
781
782 if (!tlmi_priv.certificate_support)
783 return -EOPNOTSUPP;
784
785 /* If empty then clear installed certificate */
786 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */
787 /* Check that signature is set */
788 if (!setting->signature || !setting->signature[0])
789 return -EACCES;
790
791 /* Format: 'serial#, signature' */
792 auth_str = cert_command(setting,
793 dmi_get_system_info(DMI_PRODUCT_SERIAL),
794 setting->signature);
795 if (!auth_str)
796 return -ENOMEM;
797
798 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str);
799 kfree(auth_str);
800
801 return ret ?: count;
802 }
803
804 /* Strip out CR if one is present */
805 new_cert = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
806 if (!new_cert)
807 return -ENOMEM;
808
809 if (setting->cert_installed) {
810 /* Certificate is installed so this is an update */
811 install_mode = TLMI_CERT_UPDATE;
812 /* If admin account enabled - need to use its signature */
813 if (tlmi_priv.pwd_admin->pwd_enabled)
814 signature = tlmi_priv.pwd_admin->signature;
815 else
816 signature = setting->signature;
817 } else { /* Cert install */
818 /* Check if SMC and SVC already installed */
819 if ((setting == tlmi_priv.pwd_system) && tlmi_priv.pwd_admin->cert_installed) {
820 /* This gets treated as a cert update */
821 install_mode = TLMI_CERT_UPDATE;
822 signature = tlmi_priv.pwd_admin->signature;
823 } else { /* Regular cert install */
824 install_mode = TLMI_CERT_INSTALL;
825 signature = setting->signature;
826 }
827 }
828
829 if (install_mode == TLMI_CERT_UPDATE) {
830 /* This is a certificate update */
831 if (!signature || !signature[0]) {
832 kfree(new_cert);
833 return -EACCES;
834 }
835 guid = LENOVO_UPDATE_BIOS_CERT_GUID;
836 /* Format: 'Certificate,Signature' */
837 auth_str = cert_command(setting, new_cert, signature);
838 } else {
839 /* This is a fresh install */
840 /* To set admin cert, a password must be enabled */
841 if ((setting == tlmi_priv.pwd_admin) &&
842 (!setting->pwd_enabled || !setting->password[0])) {
843 kfree(new_cert);
844 return -EACCES;
845 }
846 guid = LENOVO_SET_BIOS_CERT_GUID;
847 /* Format: 'Certificate, password' */
848 auth_str = cert_command(setting, new_cert, setting->password);
849 }
850 kfree(new_cert);
851 if (!auth_str)
852 return -ENOMEM;
853
854 ret = tlmi_simple_call(guid, auth_str);
855 kfree(auth_str);
856
857 return ret ?: count;
858 }
859
860 static struct kobj_attribute auth_certificate = __ATTR_WO(certificate);
861
signature_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)862 static ssize_t signature_store(struct kobject *kobj,
863 struct kobj_attribute *attr,
864 const char *buf, size_t count)
865 {
866 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
867 char *new_signature;
868
869 if (!capable(CAP_SYS_ADMIN))
870 return -EPERM;
871
872 if (!tlmi_priv.certificate_support)
873 return -EOPNOTSUPP;
874
875 /* Strip out CR if one is present */
876 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
877 if (!new_signature)
878 return -ENOMEM;
879
880 /* Free any previous signature */
881 kfree(setting->signature);
882 setting->signature = new_signature;
883
884 return count;
885 }
886
887 static struct kobj_attribute auth_signature = __ATTR_WO(signature);
888
save_signature_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)889 static ssize_t save_signature_store(struct kobject *kobj,
890 struct kobj_attribute *attr,
891 const char *buf, size_t count)
892 {
893 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
894 char *new_signature;
895
896 if (!capable(CAP_SYS_ADMIN))
897 return -EPERM;
898
899 if (!tlmi_priv.certificate_support)
900 return -EOPNOTSUPP;
901
902 /* Strip out CR if one is present */
903 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
904 if (!new_signature)
905 return -ENOMEM;
906
907 /* Free any previous signature */
908 kfree(setting->save_signature);
909 setting->save_signature = new_signature;
910
911 return count;
912 }
913
914 static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature);
915
auth_attr_is_visible(struct kobject * kobj,struct attribute * attr,int n)916 static umode_t auth_attr_is_visible(struct kobject *kobj,
917 struct attribute *attr, int n)
918 {
919 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
920
921 /* We only want to display level and index settings on HDD/NVMe */
922 if (attr == &auth_index.attr || attr == &auth_level.attr) {
923 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme))
924 return attr->mode;
925 return 0;
926 }
927
928 /* We only display certificates, if supported */
929 if (attr == &auth_certificate.attr ||
930 attr == &auth_signature.attr ||
931 attr == &auth_save_signature.attr ||
932 attr == &auth_cert_thumb.attr ||
933 attr == &auth_cert_to_password.attr) {
934 if (tlmi_priv.certificate_support) {
935 if (setting == tlmi_priv.pwd_admin)
936 return attr->mode;
937 if ((tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) &&
938 (setting == tlmi_priv.pwd_system))
939 return attr->mode;
940 }
941 return 0;
942 }
943
944 /* Don't display un-needed settings if opcode available */
945 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) &&
946 tlmi_priv.opcode_support)
947 return 0;
948
949 return attr->mode;
950 }
951
952 static struct attribute *auth_attrs[] = {
953 &auth_is_pass_set.attr,
954 &auth_min_pass_length.attr,
955 &auth_max_pass_length.attr,
956 &auth_current_password.attr,
957 &auth_new_password.attr,
958 &auth_role.attr,
959 &auth_mechanism.attr,
960 &auth_encoding.attr,
961 &auth_kbdlang.attr,
962 &auth_index.attr,
963 &auth_level.attr,
964 &auth_certificate.attr,
965 &auth_signature.attr,
966 &auth_save_signature.attr,
967 &auth_cert_thumb.attr,
968 &auth_cert_to_password.attr,
969 NULL
970 };
971
972 static const struct attribute_group auth_attr_group = {
973 .is_visible = auth_attr_is_visible,
974 .attrs = auth_attrs,
975 };
976 __ATTRIBUTE_GROUPS(auth_attr);
977
978 /* ---- Attributes sysfs --------------------------------------------------------- */
display_name_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)979 static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,
980 char *buf)
981 {
982 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
983
984 return sysfs_emit(buf, "%s\n", setting->display_name);
985 }
986
current_value_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)987 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
988 {
989 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
990 char *item, *value;
991 int ret;
992
993 ret = tlmi_setting(setting->wdev, setting->index, &item);
994 if (ret)
995 return ret;
996
997 /* validate and split from `item,value` -> `value` */
998 value = strpbrk(item, ",");
999 if (!value || value == item || !strlen(value + 1))
1000 ret = -EINVAL;
1001 else {
1002 /* On Workstations remove the Options part after the value */
1003 strreplace(value, ';', '\0');
1004 ret = sysfs_emit(buf, "%s\n", value + 1);
1005 }
1006 kfree(item);
1007
1008 return ret;
1009 }
1010
possible_values_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1011 static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
1012 {
1013 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1014
1015 return sysfs_emit(buf, "%s\n", setting->possible_values);
1016 }
1017
type_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1018 static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
1019 char *buf)
1020 {
1021 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1022
1023 if (setting->possible_values) {
1024 /* Figure out what setting type is as BIOS does not return this */
1025 if (strchr(setting->possible_values, ';'))
1026 return sysfs_emit(buf, "enumeration\n");
1027 }
1028 /* Anything else is going to be a string */
1029 return sysfs_emit(buf, "string\n");
1030 }
1031
current_value_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1032 static ssize_t current_value_store(struct kobject *kobj,
1033 struct kobj_attribute *attr,
1034 const char *buf, size_t count)
1035 {
1036 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1037 char *set_str = NULL, *new_setting = NULL;
1038 char *auth_str = NULL;
1039 int ret;
1040
1041 if (!tlmi_priv.can_set_bios_settings)
1042 return -EOPNOTSUPP;
1043
1044 /*
1045 * If we are using bulk saves a reboot should be done once save has
1046 * been called
1047 */
1048 if (tlmi_priv.save_mode == TLMI_SAVE_BULK && tlmi_priv.reboot_required)
1049 return -EPERM;
1050
1051 /* Strip out CR if one is present */
1052 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
1053 if (!new_setting)
1054 return -ENOMEM;
1055
1056 /* Use lock in case multiple WMI operations needed */
1057 mutex_lock(&tlmi_mutex);
1058
1059 /* Check if certificate authentication is enabled and active */
1060 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1061 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
1062 ret = -EINVAL;
1063 goto out;
1064 }
1065 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
1066 new_setting, tlmi_priv.pwd_admin->signature);
1067 if (!set_str) {
1068 ret = -ENOMEM;
1069 goto out;
1070 }
1071
1072 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str);
1073 if (ret)
1074 goto out;
1075 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)
1076 tlmi_priv.save_required = true;
1077 else
1078 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,
1079 tlmi_priv.pwd_admin->save_signature);
1080 } else if (tlmi_priv.opcode_support) {
1081 /*
1082 * If opcode support is present use that interface.
1083 * Note - this sets the variable and then the password as separate
1084 * WMI calls. Function tlmi_save_bios_settings will error if the
1085 * password is incorrect.
1086 * Workstation's require the opcode to be set before changing the
1087 * attribute.
1088 */
1089 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1090 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1091 tlmi_priv.pwd_admin->password);
1092 if (ret)
1093 goto out;
1094 }
1095
1096 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
1097 new_setting);
1098 if (!set_str) {
1099 ret = -ENOMEM;
1100 goto out;
1101 }
1102
1103 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1104 if (ret)
1105 goto out;
1106
1107 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)
1108 tlmi_priv.save_required = true;
1109 else
1110 ret = tlmi_save_bios_settings("");
1111 } else { /* old non-opcode based authentication method (deprecated) */
1112 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1113 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1114 tlmi_priv.pwd_admin->password,
1115 encoding_options[tlmi_priv.pwd_admin->encoding],
1116 tlmi_priv.pwd_admin->kbdlang);
1117 if (!auth_str) {
1118 ret = -ENOMEM;
1119 goto out;
1120 }
1121 }
1122
1123 if (auth_str)
1124 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
1125 new_setting, auth_str);
1126 else
1127 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
1128 new_setting);
1129 if (!set_str) {
1130 ret = -ENOMEM;
1131 goto out;
1132 }
1133
1134 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1135 if (ret)
1136 goto out;
1137
1138 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) {
1139 tlmi_priv.save_required = true;
1140 } else {
1141 if (auth_str)
1142 ret = tlmi_save_bios_settings(auth_str);
1143 else
1144 ret = tlmi_save_bios_settings("");
1145 }
1146 }
1147 if (!ret && !tlmi_priv.pending_changes) {
1148 tlmi_priv.pending_changes = true;
1149 /* let userland know it may need to check reboot pending again */
1150 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1151 }
1152 out:
1153 mutex_unlock(&tlmi_mutex);
1154 kfree(auth_str);
1155 kfree(set_str);
1156 kfree(new_setting);
1157 return ret ?: count;
1158 }
1159
1160 static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name);
1161
1162 static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);
1163
1164 static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);
1165
1166 static struct kobj_attribute attr_type = __ATTR_RO(type);
1167
attr_is_visible(struct kobject * kobj,struct attribute * attr,int n)1168 static umode_t attr_is_visible(struct kobject *kobj,
1169 struct attribute *attr, int n)
1170 {
1171 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1172
1173 /* We don't want to display possible_values attributes if not available */
1174 if ((attr == &attr_possible_values.attr) && (!setting->possible_values))
1175 return 0;
1176
1177 return attr->mode;
1178 }
1179
1180 static struct attribute *tlmi_attrs[] = {
1181 &attr_displ_name.attr,
1182 &attr_current_val.attr,
1183 &attr_possible_values.attr,
1184 &attr_type.attr,
1185 NULL
1186 };
1187
1188 static const struct attribute_group tlmi_attr_group = {
1189 .is_visible = attr_is_visible,
1190 .attrs = tlmi_attrs,
1191 };
1192 __ATTRIBUTE_GROUPS(tlmi_attr);
1193
tlmi_attr_setting_release(struct kobject * kobj)1194 static void tlmi_attr_setting_release(struct kobject *kobj)
1195 {
1196 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1197
1198 kfree(setting->possible_values);
1199 kfree(setting);
1200 }
1201
tlmi_pwd_setting_release(struct kobject * kobj)1202 static void tlmi_pwd_setting_release(struct kobject *kobj)
1203 {
1204 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
1205
1206 kfree(setting);
1207 }
1208
1209 static const struct kobj_type tlmi_attr_setting_ktype = {
1210 .release = &tlmi_attr_setting_release,
1211 .sysfs_ops = &kobj_sysfs_ops,
1212 .default_groups = tlmi_attr_groups,
1213 };
1214
1215 static const struct kobj_type tlmi_pwd_setting_ktype = {
1216 .release = &tlmi_pwd_setting_release,
1217 .sysfs_ops = &kobj_sysfs_ops,
1218 .default_groups = auth_attr_groups,
1219 };
1220
pending_reboot_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1221 static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,
1222 char *buf)
1223 {
1224 return sprintf(buf, "%d\n", tlmi_priv.pending_changes);
1225 }
1226
1227 static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);
1228
1229 static const char * const save_mode_strings[] = {
1230 [TLMI_SAVE_SINGLE] = "single",
1231 [TLMI_SAVE_BULK] = "bulk",
1232 [TLMI_SAVE_SAVE] = "save"
1233 };
1234
save_settings_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1235 static ssize_t save_settings_show(struct kobject *kobj, struct kobj_attribute *attr,
1236 char *buf)
1237 {
1238 /* Check that setting is valid */
1239 if (WARN_ON(tlmi_priv.save_mode < TLMI_SAVE_SINGLE ||
1240 tlmi_priv.save_mode > TLMI_SAVE_BULK))
1241 return -EIO;
1242 return sysfs_emit(buf, "%s\n", save_mode_strings[tlmi_priv.save_mode]);
1243 }
1244
save_settings_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1245 static ssize_t save_settings_store(struct kobject *kobj, struct kobj_attribute *attr,
1246 const char *buf, size_t count)
1247 {
1248 char *auth_str = NULL;
1249 int ret = 0;
1250 int cmd;
1251
1252 cmd = sysfs_match_string(save_mode_strings, buf);
1253 if (cmd < 0)
1254 return cmd;
1255
1256 /* Use lock in case multiple WMI operations needed */
1257 mutex_lock(&tlmi_mutex);
1258
1259 switch (cmd) {
1260 case TLMI_SAVE_SINGLE:
1261 case TLMI_SAVE_BULK:
1262 tlmi_priv.save_mode = cmd;
1263 goto out;
1264 case TLMI_SAVE_SAVE:
1265 /* Check if supported*/
1266 if (!tlmi_priv.can_set_bios_settings ||
1267 tlmi_priv.save_mode == TLMI_SAVE_SINGLE) {
1268 ret = -EOPNOTSUPP;
1269 goto out;
1270 }
1271 /* Check there is actually something to save */
1272 if (!tlmi_priv.save_required) {
1273 ret = -ENOENT;
1274 goto out;
1275 }
1276 /* Check if certificate authentication is enabled and active */
1277 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1278 if (!tlmi_priv.pwd_admin->signature ||
1279 !tlmi_priv.pwd_admin->save_signature) {
1280 ret = -EINVAL;
1281 goto out;
1282 }
1283 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,
1284 tlmi_priv.pwd_admin->save_signature);
1285 if (ret)
1286 goto out;
1287 } else if (tlmi_priv.opcode_support) {
1288 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1289 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1290 tlmi_priv.pwd_admin->password);
1291 if (ret)
1292 goto out;
1293 }
1294 ret = tlmi_save_bios_settings("");
1295 } else { /* old non-opcode based authentication method (deprecated) */
1296 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1297 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1298 tlmi_priv.pwd_admin->password,
1299 encoding_options[tlmi_priv.pwd_admin->encoding],
1300 tlmi_priv.pwd_admin->kbdlang);
1301 if (!auth_str) {
1302 ret = -ENOMEM;
1303 goto out;
1304 }
1305 }
1306
1307 if (auth_str)
1308 ret = tlmi_save_bios_settings(auth_str);
1309 else
1310 ret = tlmi_save_bios_settings("");
1311 }
1312 tlmi_priv.save_required = false;
1313 tlmi_priv.reboot_required = true;
1314
1315 if (!ret && !tlmi_priv.pending_changes) {
1316 tlmi_priv.pending_changes = true;
1317 /* let userland know it may need to check reboot pending again */
1318 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1319 }
1320 break;
1321 }
1322 out:
1323 mutex_unlock(&tlmi_mutex);
1324 kfree(auth_str);
1325 return ret ?: count;
1326 }
1327
1328 static struct kobj_attribute save_settings = __ATTR_RW(save_settings);
1329
1330 /* ---- Debug interface--------------------------------------------------------- */
debug_cmd_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1331 static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr,
1332 const char *buf, size_t count)
1333 {
1334 char *set_str = NULL, *new_setting = NULL;
1335 char *auth_str = NULL;
1336 int ret;
1337
1338 if (!tlmi_priv.can_debug_cmd)
1339 return -EOPNOTSUPP;
1340
1341 /* Strip out CR if one is present */
1342 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
1343 if (!new_setting)
1344 return -ENOMEM;
1345
1346 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1347 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1348 tlmi_priv.pwd_admin->password,
1349 encoding_options[tlmi_priv.pwd_admin->encoding],
1350 tlmi_priv.pwd_admin->kbdlang);
1351 if (!auth_str) {
1352 ret = -ENOMEM;
1353 goto out;
1354 }
1355 }
1356
1357 if (auth_str)
1358 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str);
1359 else
1360 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting);
1361 if (!set_str) {
1362 ret = -ENOMEM;
1363 goto out;
1364 }
1365
1366 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str);
1367 if (ret)
1368 goto out;
1369
1370 if (!ret && !tlmi_priv.pending_changes) {
1371 tlmi_priv.pending_changes = true;
1372 /* let userland know it may need to check reboot pending again */
1373 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1374 }
1375 out:
1376 kfree(auth_str);
1377 kfree(set_str);
1378 kfree(new_setting);
1379 return ret ?: count;
1380 }
1381
1382 static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);
1383
1384 /* ---- Initialisation --------------------------------------------------------- */
tlmi_release_attr(void)1385 static void tlmi_release_attr(void)
1386 {
1387 struct kobject *pos, *n;
1388
1389 /* Attribute structures */
1390 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1391 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);
1392
1393 if (tlmi_priv.can_debug_cmd && debug_support)
1394 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1395
1396 list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry)
1397 kobject_put(pos);
1398
1399 kset_unregister(tlmi_priv.attribute_kset);
1400
1401 /* Free up any saved signatures */
1402 kfree(tlmi_priv.pwd_admin->signature);
1403 kfree(tlmi_priv.pwd_admin->save_signature);
1404
1405 /* Authentication structures */
1406 list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
1407 kobject_put(pos);
1408
1409 kset_unregister(tlmi_priv.authentication_kset);
1410 }
1411
tlmi_validate_setting_name(struct kset * attribute_kset,char * name)1412 static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)
1413 {
1414 struct kobject *duplicate;
1415
1416 if (!strcmp(name, "Reserved"))
1417 return -EINVAL;
1418
1419 duplicate = kset_find_obj(attribute_kset, name);
1420 if (duplicate) {
1421 pr_debug("Duplicate attribute name found - %s\n", name);
1422 /* kset_find_obj() returns a reference */
1423 kobject_put(duplicate);
1424 return -EBUSY;
1425 }
1426
1427 return 0;
1428 }
1429
tlmi_sysfs_init(void)1430 static int tlmi_sysfs_init(void)
1431 {
1432 int i, ret;
1433
1434 tlmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0),
1435 NULL, "%s", "thinklmi");
1436 if (IS_ERR(tlmi_priv.class_dev)) {
1437 ret = PTR_ERR(tlmi_priv.class_dev);
1438 goto fail_class_created;
1439 }
1440
1441 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL,
1442 &tlmi_priv.class_dev->kobj);
1443 if (!tlmi_priv.attribute_kset) {
1444 ret = -ENOMEM;
1445 goto fail_device_created;
1446 }
1447
1448 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
1449 &tlmi_priv.class_dev->kobj);
1450 if (!tlmi_priv.authentication_kset) {
1451 kset_unregister(tlmi_priv.attribute_kset);
1452 ret = -ENOMEM;
1453 goto fail_device_created;
1454 }
1455
1456 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1457 /* Check if index is a valid setting - skip if it isn't */
1458 if (!tlmi_priv.setting[i])
1459 continue;
1460
1461 /* check for duplicate or reserved values */
1462 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
1463 tlmi_priv.setting[i]->display_name) < 0) {
1464 kfree(tlmi_priv.setting[i]->possible_values);
1465 kfree(tlmi_priv.setting[i]);
1466 tlmi_priv.setting[i] = NULL;
1467 continue;
1468 }
1469
1470 /* Build attribute */
1471 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
1472 ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype,
1473 NULL, "%s", tlmi_priv.setting[i]->display_name);
1474 if (ret)
1475 goto fail_create_attr;
1476 }
1477
1478 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1479 if (ret)
1480 goto fail_create_attr;
1481
1482 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);
1483 if (ret)
1484 goto fail_create_attr;
1485
1486 if (tlmi_priv.can_debug_cmd && debug_support) {
1487 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1488 if (ret)
1489 goto fail_create_attr;
1490 }
1491
1492 /* Create authentication entries */
1493 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
1494 ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype,
1495 NULL, "%s", "Admin");
1496 if (ret)
1497 goto fail_create_attr;
1498
1499 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
1500 ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
1501 NULL, "%s", "Power-on");
1502 if (ret)
1503 goto fail_create_attr;
1504
1505 if (tlmi_priv.opcode_support) {
1506 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
1507 ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
1508 NULL, "%s", "System");
1509 if (ret)
1510 goto fail_create_attr;
1511
1512 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
1513 ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
1514 NULL, "%s", "HDD");
1515 if (ret)
1516 goto fail_create_attr;
1517
1518 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
1519 ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
1520 NULL, "%s", "NVMe");
1521 if (ret)
1522 goto fail_create_attr;
1523 }
1524
1525 return ret;
1526
1527 fail_create_attr:
1528 tlmi_release_attr();
1529 fail_device_created:
1530 device_unregister(tlmi_priv.class_dev);
1531 fail_class_created:
1532 return ret;
1533 }
1534
1535 /* ---- Base Driver -------------------------------------------------------- */
tlmi_create_auth(const char * pwd_type,const char * pwd_role)1536 static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,
1537 const char *pwd_role)
1538 {
1539 struct tlmi_pwd_setting *new_pwd;
1540
1541 new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL);
1542 if (!new_pwd)
1543 return NULL;
1544
1545 strscpy(new_pwd->kbdlang, "us");
1546 new_pwd->encoding = TLMI_ENCODING_ASCII;
1547 new_pwd->pwd_type = pwd_type;
1548 new_pwd->role = pwd_role;
1549 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length;
1550 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
1551 new_pwd->index = 0;
1552
1553 return new_pwd;
1554 }
1555
tlmi_analyze(struct wmi_device * wdev)1556 static int tlmi_analyze(struct wmi_device *wdev)
1557 {
1558 int i, ret;
1559
1560 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) &&
1561 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID))
1562 tlmi_priv.can_set_bios_settings = true;
1563
1564 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID))
1565 tlmi_priv.can_get_bios_selections = true;
1566
1567 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID))
1568 tlmi_priv.can_set_bios_password = true;
1569
1570 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID))
1571 tlmi_priv.can_get_password_settings = true;
1572
1573 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID))
1574 tlmi_priv.can_debug_cmd = true;
1575
1576 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID))
1577 tlmi_priv.opcode_support = true;
1578
1579 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) &&
1580 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) &&
1581 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID))
1582 tlmi_priv.certificate_support = true;
1583
1584 /*
1585 * Try to find the number of valid settings of this machine
1586 * and use it to create sysfs attributes.
1587 */
1588 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1589 struct tlmi_attr_setting *setting;
1590 char *item = NULL;
1591
1592 tlmi_priv.setting[i] = NULL;
1593 ret = tlmi_setting(wdev, i, &item);
1594 if (ret)
1595 break;
1596 if (!item)
1597 break;
1598 if (!*item) {
1599 kfree(item);
1600 continue;
1601 }
1602
1603 /* Remove the value part */
1604 strreplace(item, ',', '\0');
1605
1606 /* Create a setting entry */
1607 setting = kzalloc(sizeof(*setting), GFP_KERNEL);
1608 if (!setting) {
1609 ret = -ENOMEM;
1610 kfree(item);
1611 goto fail_clear_attr;
1612 }
1613 setting->wdev = wdev;
1614 setting->index = i;
1615
1616 strscpy(setting->name, item);
1617 /* It is not allowed to have '/' for file name. Convert it into '\'. */
1618 strreplace(item, '/', '\\');
1619 strscpy(setting->display_name, item);
1620
1621 /* If BIOS selections supported, load those */
1622 if (tlmi_priv.can_get_bios_selections) {
1623 ret = tlmi_get_bios_selections(setting->name,
1624 &setting->possible_values);
1625 if (ret || !setting->possible_values)
1626 pr_info("Error retrieving possible values for %d : %s\n",
1627 i, setting->display_name);
1628 } else {
1629 /*
1630 * Older Thinkstations don't support the bios_selections API.
1631 * Instead they store this as a [Optional:Option1,Option2] section of the
1632 * name string.
1633 * Try and pull that out if it's available.
1634 */
1635 char *optitem, *optstart, *optend;
1636
1637 if (!tlmi_setting(setting->wdev, setting->index, &optitem)) {
1638 optstart = strstr(optitem, "[Optional:");
1639 if (optstart) {
1640 optstart += strlen("[Optional:");
1641 optend = strstr(optstart, "]");
1642 if (optend)
1643 setting->possible_values =
1644 kstrndup(optstart, optend - optstart,
1645 GFP_KERNEL);
1646 }
1647 kfree(optitem);
1648 }
1649 }
1650 /*
1651 * firmware-attributes requires that possible_values are separated by ';' but
1652 * Lenovo FW uses ','. Replace appropriately.
1653 */
1654 if (setting->possible_values)
1655 strreplace(setting->possible_values, ',', ';');
1656
1657 tlmi_priv.setting[i] = setting;
1658 kfree(item);
1659 }
1660
1661 /* Create password setting structure */
1662 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg);
1663 if (ret)
1664 goto fail_clear_attr;
1665
1666 /* All failures below boil down to kmalloc failures */
1667 ret = -ENOMEM;
1668
1669 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin");
1670 if (!tlmi_priv.pwd_admin)
1671 goto fail_clear_attr;
1672
1673 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)
1674 tlmi_priv.pwd_admin->pwd_enabled = true;
1675
1676 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");
1677 if (!tlmi_priv.pwd_power)
1678 goto fail_clear_attr;
1679
1680 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)
1681 tlmi_priv.pwd_power->pwd_enabled = true;
1682
1683 if (tlmi_priv.opcode_support) {
1684 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
1685 if (!tlmi_priv.pwd_system)
1686 goto fail_clear_attr;
1687
1688 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
1689 tlmi_priv.pwd_system->pwd_enabled = true;
1690
1691 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
1692 if (!tlmi_priv.pwd_hdd)
1693 goto fail_clear_attr;
1694
1695 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme");
1696 if (!tlmi_priv.pwd_nvme)
1697 goto fail_clear_attr;
1698
1699 /* Set default hdd/nvme index to 1 as there is no device 0 */
1700 tlmi_priv.pwd_hdd->index = 1;
1701 tlmi_priv.pwd_nvme->index = 1;
1702
1703 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) {
1704 /* Check if PWD is configured and set index to first drive found */
1705 if (tlmi_priv.pwdcfg.ext.hdd_user_password ||
1706 tlmi_priv.pwdcfg.ext.hdd_master_password) {
1707 tlmi_priv.pwd_hdd->pwd_enabled = true;
1708 if (tlmi_priv.pwdcfg.ext.hdd_master_password)
1709 tlmi_priv.pwd_hdd->index =
1710 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;
1711 else
1712 tlmi_priv.pwd_hdd->index =
1713 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1;
1714 }
1715 if (tlmi_priv.pwdcfg.ext.nvme_user_password ||
1716 tlmi_priv.pwdcfg.ext.nvme_master_password) {
1717 tlmi_priv.pwd_nvme->pwd_enabled = true;
1718 if (tlmi_priv.pwdcfg.ext.nvme_master_password)
1719 tlmi_priv.pwd_nvme->index =
1720 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;
1721 else
1722 tlmi_priv.pwd_nvme->index =
1723 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1;
1724 }
1725 }
1726 }
1727
1728 if (tlmi_priv.certificate_support) {
1729 tlmi_priv.pwd_admin->cert_installed =
1730 tlmi_priv.pwdcfg.core.password_state & TLMI_CERT_SVC;
1731 tlmi_priv.pwd_system->cert_installed =
1732 tlmi_priv.pwdcfg.core.password_state & TLMI_CERT_SMC;
1733 }
1734 return 0;
1735
1736 fail_clear_attr:
1737 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1738 if (tlmi_priv.setting[i]) {
1739 kfree(tlmi_priv.setting[i]->possible_values);
1740 kfree(tlmi_priv.setting[i]);
1741 }
1742 }
1743 kfree(tlmi_priv.pwd_admin);
1744 kfree(tlmi_priv.pwd_power);
1745 kfree(tlmi_priv.pwd_system);
1746 kfree(tlmi_priv.pwd_hdd);
1747 kfree(tlmi_priv.pwd_nvme);
1748 return ret;
1749 }
1750
tlmi_remove(struct wmi_device * wdev)1751 static void tlmi_remove(struct wmi_device *wdev)
1752 {
1753 tlmi_release_attr();
1754 device_unregister(tlmi_priv.class_dev);
1755 }
1756
tlmi_probe(struct wmi_device * wdev,const void * context)1757 static int tlmi_probe(struct wmi_device *wdev, const void *context)
1758 {
1759 int ret;
1760
1761 ret = tlmi_analyze(wdev);
1762 if (ret)
1763 return ret;
1764
1765 return tlmi_sysfs_init();
1766 }
1767
1768 static const struct wmi_device_id tlmi_id_table[] = {
1769 { .guid_string = LENOVO_BIOS_SETTING_GUID },
1770 { }
1771 };
1772 MODULE_DEVICE_TABLE(wmi, tlmi_id_table);
1773
1774 static struct wmi_driver tlmi_driver = {
1775 .driver = {
1776 .name = "think-lmi",
1777 },
1778 .id_table = tlmi_id_table,
1779 .probe = tlmi_probe,
1780 .remove = tlmi_remove,
1781 };
1782
1783 MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>");
1784 MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>");
1785 MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>");
1786 MODULE_DESCRIPTION("ThinkLMI Driver");
1787 MODULE_LICENSE("GPL");
1788
1789 module_wmi_driver(tlmi_driver);
1790