1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Think LMI BIOS configuration driver
4 *
5 * Copyright(C) 2019-2021 Lenovo
6 *
7 * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi
8 * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com>
9 * Distributed under the GPL-2.0 license
10 */
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include <linux/acpi.h>
15 #include <linux/array_size.h>
16 #include <linux/errno.h>
17 #include <linux/fs.h>
18 #include <linux/mutex.h>
19 #include <linux/string_helpers.h>
20 #include <linux/types.h>
21 #include <linux/dmi.h>
22 #include <linux/wmi.h>
23 #include "../firmware_attributes_class.h"
24 #include "think-lmi.h"
25
26 static bool debug_support;
27 module_param(debug_support, bool, 0444);
28 MODULE_PARM_DESC(debug_support, "Enable debug command support");
29
30 /*
31 * Name: BiosSetting
32 * Description: Get item name and settings for current LMI instance.
33 * Type: Query
34 * Returns: "Item,Value"
35 * Example: "WakeOnLAN,Enable"
36 */
37 #define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7"
38
39 /*
40 * Name: SetBiosSetting
41 * Description: Change the BIOS setting to the desired value using the SetBiosSetting
42 * class. To save the settings, use the SaveBiosSetting class.
43 * BIOS settings and values are case sensitive.
44 * After making changes to the BIOS settings, you must reboot the computer
45 * before the changes will take effect.
46 * Type: Method
47 * Arguments: "Item,Value,Password,Encoding,KbdLang;"
48 * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;"
49 */
50 #define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1"
51
52 /*
53 * Name: SaveBiosSettings
54 * Description: Save any pending changes in settings.
55 * Type: Method
56 * Arguments: "Password,Encoding,KbdLang;"
57 * Example: "pa55w0rd,ascii,us;"
58 */
59 #define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3"
60
61 /*
62 * Name: BiosPasswordSettings
63 * Description: Return BIOS Password settings
64 * Type: Query
65 * Returns: PasswordMode, PasswordState, MinLength, MaxLength,
66 * SupportedEncoding, SupportedKeyboard
67 */
68 #define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246"
69
70 /*
71 * Name: SetBiosPassword
72 * Description: Change a specific password.
73 * - BIOS settings cannot be changed at the same boot as power-on
74 * passwords (POP) and hard disk passwords (HDP). If you want to change
75 * BIOS settings and POP or HDP, you must reboot the system after changing
76 * one of them.
77 * - A password cannot be set using this method when one does not already
78 * exist. Passwords can only be updated or cleared.
79 * Type: Method
80 * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;"
81 * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;”
82 */
83 #define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7"
84
85 /*
86 * Name: GetBiosSelections
87 * Description: Return a list of valid settings for a given item.
88 * Type: Method
89 * Arguments: "Item"
90 * Returns: "Value1,Value2,Value3,..."
91 * Example:
92 * -> "FlashOverLAN"
93 * <- "Enabled,Disabled"
94 */
95 #define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B"
96
97 /*
98 * Name: DebugCmd
99 * Description: Debug entry method for entering debug commands to the BIOS
100 */
101 #define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1"
102
103 /*
104 * Name: OpcodeIF
105 * Description: Opcode interface which provides the ability to set multiple
106 * parameters and then trigger an action with a final command.
107 * This is particularly useful for simplifying setting passwords.
108 * With this support comes the ability to set System, HDD and NVMe
109 * passwords.
110 * This is currently available on ThinkCenter and ThinkStations platforms
111 */
112 #define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836"
113
114 /*
115 * Name: SetBiosCert
116 * Description: Install BIOS certificate.
117 * Type: Method
118 * Arguments: "Certificate,Password"
119 * You must reboot the computer before the changes will take effect.
120 */
121 #define LENOVO_SET_BIOS_CERT_GUID "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE"
122 #define LENOVO_TC_SET_BIOS_CERT_GUID "955aaf7d-8bc4-4f04-90aa-97469512f167"
123
124 /*
125 * Name: UpdateBiosCert
126 * Description: Update BIOS certificate.
127 * Type: Method
128 * Format: "Certificate,Signature"
129 * You must reboot the computer before the changes will take effect.
130 */
131 #define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE"
132 #define LENOVO_TC_UPDATE_BIOS_CERT_GUID "5f5bbbb2-c72f-4fb8-8129-228eef4fdbed"
133
134 /*
135 * Name: ClearBiosCert
136 * Description: Uninstall BIOS certificate.
137 * Type: Method
138 * Format: "Serial,Signature"
139 * You must reboot the computer before the changes will take effect.
140 */
141 #define LENOVO_CLEAR_BIOS_CERT_GUID "B2BC39A7-78DD-4D71-B059-A510DEC44890"
142 #define LENOVO_TC_CLEAR_BIOS_CERT_GUID "97849cb6-cb44-42d1-a750-26a596a9eec4"
143
144 /*
145 * Name: CertToPassword
146 * Description: Switch from certificate to password authentication.
147 * Type: Method
148 * Format: "Password,Signature"
149 * You must reboot the computer before the changes will take effect.
150 */
151 #define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D"
152 #define LENOVO_TC_CERT_TO_PASSWORD_GUID "ef65480d-38c9-420d-b700-ab3d6c8ebaca"
153
154 /*
155 * Name: SetBiosSettingCert
156 * Description: Set attribute using certificate authentication.
157 * Type: Method
158 * Format: "Item,Value,Signature"
159 */
160 #define LENOVO_SET_BIOS_SETTING_CERT_GUID "34A008CC-D205-4B62-9E67-31DFA8B90003"
161 #define LENOVO_TC_SET_BIOS_SETTING_CERT_GUID "19ecba3b-b318-4192-a89b-43d94bc60cea"
162
163 /*
164 * Name: SaveBiosSettingCert
165 * Description: Save any pending changes in settings.
166 * Type: Method
167 * Format: "Signature"
168 */
169 #define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551"
170 #define LENOVO_TC_SAVE_BIOS_SETTING_CERT_GUID "0afaf46f-7cca-450a-b455-a826a0bf1af5"
171
172 /*
173 * Name: CertThumbprint
174 * Description: Display Certificate thumbprints
175 * Type: Query
176 * Returns: MD5, SHA1 & SHA256 thumbprints
177 */
178 #define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4"
179
180 #define TLMI_POP_PWD BIT(0) /* Supervisor */
181 #define TLMI_PAP_PWD BIT(1) /* Power-on */
182 #define TLMI_HDD_PWD BIT(2) /* HDD/NVME */
183 #define TLMI_SMP_PWD BIT(6) /* System Management */
184 #define TLMI_CERT_SVC BIT(7) /* Admin Certificate Based */
185 #define TLMI_CERT_SMC BIT(8) /* System Certificate Based */
186
187 static const struct tlmi_cert_guids thinkpad_cert_guid = {
188 .thumbprint = LENOVO_CERT_THUMBPRINT_GUID,
189 .set_bios_setting = LENOVO_SET_BIOS_SETTING_CERT_GUID,
190 .save_bios_setting = LENOVO_SAVE_BIOS_SETTING_CERT_GUID,
191 .cert_to_password = LENOVO_CERT_TO_PASSWORD_GUID,
192 .clear_bios_cert = LENOVO_CLEAR_BIOS_CERT_GUID,
193 .update_bios_cert = LENOVO_UPDATE_BIOS_CERT_GUID,
194 .set_bios_cert = LENOVO_SET_BIOS_CERT_GUID,
195 };
196
197 static const struct tlmi_cert_guids thinkcenter_cert_guid = {
198 .thumbprint = LENOVO_CERT_THUMBPRINT_GUID, /* Same GUID as TP */
199 .set_bios_setting = LENOVO_TC_SET_BIOS_SETTING_CERT_GUID,
200 .save_bios_setting = LENOVO_TC_SAVE_BIOS_SETTING_CERT_GUID,
201 .cert_to_password = LENOVO_TC_CERT_TO_PASSWORD_GUID,
202 .clear_bios_cert = LENOVO_TC_CLEAR_BIOS_CERT_GUID,
203 .update_bios_cert = LENOVO_TC_UPDATE_BIOS_CERT_GUID,
204 .set_bios_cert = LENOVO_TC_SET_BIOS_CERT_GUID,
205 };
206
207 static const struct tlmi_err_codes tlmi_errs[] = {
208 {"Success", 0},
209 {"Set Certificate operation was successful.", 0},
210 {"Not Supported", -EOPNOTSUPP},
211 {"Invalid Parameter", -EINVAL},
212 {"Access Denied", -EACCES},
213 {"System Busy", -EBUSY},
214 {"Set Certificate operation failed with status:Invalid Parameter.", -EINVAL},
215 {"Set Certificate operation failed with status:Invalid certificate type.", -EINVAL},
216 {"Set Certificate operation failed with status:Invalid password format.", -EINVAL},
217 {"Set Certificate operation failed with status:Password retry count exceeded.", -EACCES},
218 {"Set Certificate operation failed with status:Password Invalid.", -EACCES},
219 {"Set Certificate operation failed with status:Operation aborted.", -EBUSY},
220 {"Set Certificate operation failed with status:No free slots to write.", -ENOSPC},
221 {"Set Certificate operation failed with status:Certificate not found.", -EEXIST},
222 {"Set Certificate operation failed with status:Internal error.", -EFAULT},
223 {"Set Certificate operation failed with status:Certificate too large.", -EFBIG},
224 };
225
226 static const char * const encoding_options[] = {
227 [TLMI_ENCODING_ASCII] = "ascii",
228 [TLMI_ENCODING_SCANCODE] = "scancode",
229 };
230 static const char * const level_options[] = {
231 [TLMI_LEVEL_USER] = "user",
232 [TLMI_LEVEL_MASTER] = "master",
233 };
234 static struct think_lmi tlmi_priv;
235 static DEFINE_MUTEX(tlmi_mutex);
236
to_tlmi_pwd_setting(struct kobject * kobj)237 static inline struct tlmi_pwd_setting *to_tlmi_pwd_setting(struct kobject *kobj)
238 {
239 return container_of(kobj, struct tlmi_pwd_setting, kobj);
240 }
241
to_tlmi_attr_setting(struct kobject * kobj)242 static inline struct tlmi_attr_setting *to_tlmi_attr_setting(struct kobject *kobj)
243 {
244 return container_of(kobj, struct tlmi_attr_setting, kobj);
245 }
246
247 /* Convert BIOS WMI error string to suitable error code */
tlmi_errstr_to_err(const char * errstr)248 static int tlmi_errstr_to_err(const char *errstr)
249 {
250 int i;
251
252 for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) {
253 if (!strcmp(tlmi_errs[i].err_str, errstr))
254 return tlmi_errs[i].err_code;
255 }
256 return -EPERM;
257 }
258
259 /* Extract error string from WMI return buffer */
tlmi_extract_error(const struct acpi_buffer * output)260 static int tlmi_extract_error(const struct acpi_buffer *output)
261 {
262 const union acpi_object *obj;
263
264 obj = output->pointer;
265 if (!obj)
266 return -ENOMEM;
267 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
268 return -EIO;
269
270 return tlmi_errstr_to_err(obj->string.pointer);
271 }
272
273 /* Utility function to execute WMI call to BIOS */
tlmi_simple_call(const char * guid,const char * arg)274 static int tlmi_simple_call(const char *guid, const char *arg)
275 {
276 const struct acpi_buffer input = { strlen(arg), (char *)arg };
277 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
278 acpi_status status;
279 int i, err;
280
281 /*
282 * Duplicated call required to match BIOS workaround for behavior
283 * seen when WMI accessed via scripting on other OS.
284 */
285 for (i = 0; i < 2; i++) {
286 /* (re)initialize output buffer to default state */
287 output.length = ACPI_ALLOCATE_BUFFER;
288 output.pointer = NULL;
289
290 status = wmi_evaluate_method(guid, 0, 0, &input, &output);
291 if (ACPI_FAILURE(status)) {
292 kfree(output.pointer);
293 return -EIO;
294 }
295 err = tlmi_extract_error(&output);
296 kfree(output.pointer);
297 if (err)
298 return err;
299 }
300 return 0;
301 }
302
303 /* Extract output string from WMI return value */
tlmi_extract_output_string(union acpi_object * obj,char ** string)304 static int tlmi_extract_output_string(union acpi_object *obj, char **string)
305 {
306 char *s;
307
308 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
309 return -EIO;
310
311 s = kstrdup(obj->string.pointer, GFP_KERNEL);
312 if (!s)
313 return -ENOMEM;
314 *string = s;
315 return 0;
316 }
317
318 /* ------ Core interface functions ------------*/
319
320 /* Get password settings from BIOS */
tlmi_get_pwd_settings(struct tlmi_pwdcfg * pwdcfg)321 static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg)
322 {
323 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
324 const union acpi_object *obj;
325 acpi_status status;
326 int copy_size;
327
328 if (!tlmi_priv.can_get_password_settings)
329 return -EOPNOTSUPP;
330
331 status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0,
332 &output);
333 if (ACPI_FAILURE(status))
334 return -EIO;
335
336 obj = output.pointer;
337 if (!obj)
338 return -ENOMEM;
339 if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) {
340 kfree(obj);
341 return -EIO;
342 }
343 /*
344 * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad.
345 * To make the driver compatible on different brands, we permit it to get
346 * the data in below case.
347 * Settings must have at minimum the core fields available
348 */
349 if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) {
350 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length);
351 kfree(obj);
352 return -EIO;
353 }
354
355 copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg));
356
357 memcpy(pwdcfg, obj->buffer.pointer, copy_size);
358 kfree(obj);
359
360 if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE))
361 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1;
362 return 0;
363 }
364
tlmi_save_bios_settings(const char * password)365 static int tlmi_save_bios_settings(const char *password)
366 {
367 return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID,
368 password);
369 }
370
tlmi_opcode_setting(char * setting,const char * value)371 static int tlmi_opcode_setting(char *setting, const char *value)
372 {
373 char *opcode_str;
374 int ret;
375
376 opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value);
377 if (!opcode_str)
378 return -ENOMEM;
379
380 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str);
381 kfree(opcode_str);
382 return ret;
383 }
384
tlmi_setting(struct wmi_device * wdev,int item,char ** value)385 static int tlmi_setting(struct wmi_device *wdev, int item, char **value)
386 {
387 union acpi_object *obj;
388 int ret;
389
390 obj = wmidev_block_query(wdev, item);
391 if (!obj)
392 return -EIO;
393
394 ret = tlmi_extract_output_string(obj, value);
395 kfree(obj);
396
397 return ret;
398 }
399
tlmi_get_bios_selections(const char * item,char ** value)400 static int tlmi_get_bios_selections(const char *item, char **value)
401 {
402 const struct acpi_buffer input = { strlen(item), (char *)item };
403 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
404 union acpi_object *obj;
405 acpi_status status;
406 int ret;
407
408 status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID,
409 0, 0, &input, &output);
410 if (ACPI_FAILURE(status))
411 return -EIO;
412
413 obj = output.pointer;
414 if (!obj)
415 return -ENODATA;
416
417 ret = tlmi_extract_output_string(obj, value);
418 kfree(obj);
419
420 return ret;
421 }
422
423 /* ---- Authentication sysfs --------------------------------------------------------- */
is_enabled_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)424 static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr,
425 char *buf)
426 {
427 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
428
429 return sysfs_emit(buf, "%d\n", setting->pwd_enabled || setting->cert_installed);
430 }
431
432 static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);
433
current_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)434 static ssize_t current_password_store(struct kobject *kobj,
435 struct kobj_attribute *attr,
436 const char *buf, size_t count)
437 {
438 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
439 size_t pwdlen;
440
441 /* Strip newline; setting password won't work if one is present. */
442 pwdlen = strchrnul(buf, '\n') - buf;
443 /* pwdlen == 0 is allowed to clear the password */
444 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
445 return -EINVAL;
446
447 strscpy(setting->password, buf, pwdlen + 1);
448 return count;
449 }
450
451 static struct kobj_attribute auth_current_password = __ATTR_WO(current_password);
452
new_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)453 static ssize_t new_password_store(struct kobject *kobj,
454 struct kobj_attribute *attr,
455 const char *buf, size_t count)
456 {
457 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
458 char *auth_str, *new_pwd;
459 size_t pwdlen;
460 int ret;
461
462 if (!capable(CAP_SYS_ADMIN))
463 return -EPERM;
464
465 if (!tlmi_priv.can_set_bios_password)
466 return -EOPNOTSUPP;
467
468 /* Strip out CR if one is present, setting password won't work if it is present */
469 new_pwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
470 if (!new_pwd)
471 return -ENOMEM;
472
473 /* Use lock in case multiple WMI operations needed */
474 mutex_lock(&tlmi_mutex);
475
476 pwdlen = strlen(new_pwd);
477 /* pwdlen == 0 is allowed to clear the password */
478 if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
479 ret = -EINVAL;
480 goto out;
481 }
482
483 /* If opcode support is present use that interface */
484 if (tlmi_priv.opcode_support) {
485 char pwd_type[8];
486
487 /* Special handling required for HDD and NVMe passwords */
488 if (setting == tlmi_priv.pwd_hdd) {
489 if (setting->level == TLMI_LEVEL_USER)
490 sprintf(pwd_type, "uhdp%d", setting->index);
491 else
492 sprintf(pwd_type, "mhdp%d", setting->index);
493 } else if (setting == tlmi_priv.pwd_nvme) {
494 if (setting->level == TLMI_LEVEL_USER)
495 sprintf(pwd_type, "udrp%d", setting->index);
496 else
497 sprintf(pwd_type, "adrp%d", setting->index);
498 } else {
499 sprintf(pwd_type, "%s", setting->pwd_type);
500 }
501
502 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type);
503 if (ret)
504 goto out;
505
506 /*
507 * Note admin password is not always required if SMPControl enabled in BIOS,
508 * So only set if it's configured.
509 * Let BIOS figure it out - we'll get an error if operation is not permitted
510 */
511 if (tlmi_priv.pwd_admin->pwd_enabled && strlen(tlmi_priv.pwd_admin->password)) {
512 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
513 tlmi_priv.pwd_admin->password);
514 if (ret)
515 goto out;
516 }
517 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password);
518 if (ret)
519 goto out;
520 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd);
521 if (ret)
522 goto out;
523 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;");
524 } else {
525 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */
526 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;",
527 setting->pwd_type, setting->password, new_pwd,
528 encoding_options[setting->encoding], setting->kbdlang);
529 if (!auth_str) {
530 ret = -ENOMEM;
531 goto out;
532 }
533 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str);
534 kfree(auth_str);
535 }
536 out:
537 mutex_unlock(&tlmi_mutex);
538 kfree(new_pwd);
539 return ret ?: count;
540 }
541
542 static struct kobj_attribute auth_new_password = __ATTR_WO(new_password);
543
min_password_length_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)544 static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
545 char *buf)
546 {
547 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
548
549 return sysfs_emit(buf, "%d\n", setting->minlen);
550 }
551
552 static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length);
553
max_password_length_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)554 static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
555 char *buf)
556 {
557 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
558
559 return sysfs_emit(buf, "%d\n", setting->maxlen);
560 }
561 static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length);
562
mechanism_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)563 static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr,
564 char *buf)
565 {
566 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
567
568 if (setting->cert_installed)
569 return sysfs_emit(buf, "certificate\n");
570 return sysfs_emit(buf, "password\n");
571 }
572 static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism);
573
encoding_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)574 static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr,
575 char *buf)
576 {
577 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
578
579 return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]);
580 }
581
encoding_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)582 static ssize_t encoding_store(struct kobject *kobj,
583 struct kobj_attribute *attr,
584 const char *buf, size_t count)
585 {
586 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
587 int i;
588
589 /* Scan for a matching profile */
590 i = sysfs_match_string(encoding_options, buf);
591 if (i < 0)
592 return -EINVAL;
593
594 setting->encoding = i;
595 return count;
596 }
597
598 static struct kobj_attribute auth_encoding = __ATTR_RW(encoding);
599
kbdlang_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)600 static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr,
601 char *buf)
602 {
603 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
604
605 return sysfs_emit(buf, "%s\n", setting->kbdlang);
606 }
607
kbdlang_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)608 static ssize_t kbdlang_store(struct kobject *kobj,
609 struct kobj_attribute *attr,
610 const char *buf, size_t count)
611 {
612 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
613 int length;
614
615 /* Calculate length till '\n' or terminating 0 */
616 length = strchrnul(buf, '\n') - buf;
617 if (!length || length >= TLMI_LANG_MAXLEN)
618 return -EINVAL;
619
620 memcpy(setting->kbdlang, buf, length);
621 setting->kbdlang[length] = '\0';
622 return count;
623 }
624
625 static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang);
626
role_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)627 static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr,
628 char *buf)
629 {
630 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
631
632 return sysfs_emit(buf, "%s\n", setting->role);
633 }
634 static struct kobj_attribute auth_role = __ATTR_RO(role);
635
index_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)636 static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr,
637 char *buf)
638 {
639 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
640
641 return sysfs_emit(buf, "%d\n", setting->index);
642 }
643
index_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)644 static ssize_t index_store(struct kobject *kobj,
645 struct kobj_attribute *attr,
646 const char *buf, size_t count)
647 {
648 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
649 int err, val;
650
651 err = kstrtoint(buf, 10, &val);
652 if (err < 0)
653 return err;
654
655 if (val < 0 || val > TLMI_INDEX_MAX)
656 return -EINVAL;
657
658 setting->index = val;
659 return count;
660 }
661
662 static struct kobj_attribute auth_index = __ATTR_RW(index);
663
level_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)664 static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr,
665 char *buf)
666 {
667 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
668
669 return sysfs_emit(buf, "%s\n", level_options[setting->level]);
670 }
671
level_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)672 static ssize_t level_store(struct kobject *kobj,
673 struct kobj_attribute *attr,
674 const char *buf, size_t count)
675 {
676 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
677 int i;
678
679 /* Scan for a matching profile */
680 i = sysfs_match_string(level_options, buf);
681 if (i < 0)
682 return -EINVAL;
683
684 setting->level = i;
685 return count;
686 }
687
688 static struct kobj_attribute auth_level = __ATTR_RW(level);
689
cert_command(struct tlmi_pwd_setting * setting,const char * arg1,const char * arg2)690 static char *cert_command(struct tlmi_pwd_setting *setting, const char *arg1, const char *arg2)
691 {
692 /* Prepend with SVC or SMC if multicert supported */
693 if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT)
694 return kasprintf(GFP_KERNEL, "%s,%s,%s",
695 setting == tlmi_priv.pwd_admin ? "SVC" : "SMC",
696 arg1, arg2);
697 else
698 return kasprintf(GFP_KERNEL, "%s,%s", arg1, arg2);
699 }
700
cert_thumbprint(char * buf,const char * arg,int count)701 static ssize_t cert_thumbprint(char *buf, const char *arg, int count)
702 {
703 const struct acpi_buffer input = { strlen(arg), (char *)arg };
704 struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
705 const union acpi_object *obj;
706 acpi_status status;
707
708 if (!tlmi_priv.cert_guid->thumbprint)
709 return -EOPNOTSUPP;
710
711 /* Older ThinkCenter BIOS may not have support */
712 if (!wmi_has_guid(tlmi_priv.cert_guid->thumbprint))
713 return -EOPNOTSUPP;
714
715 status = wmi_evaluate_method(tlmi_priv.cert_guid->thumbprint, 0, 0, &input, &output);
716 if (ACPI_FAILURE(status)) {
717 kfree(output.pointer);
718 return -EIO;
719 }
720 obj = output.pointer;
721 if (!obj)
722 return -ENOMEM;
723 if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) {
724 kfree(output.pointer);
725 return -EIO;
726 }
727 count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer);
728 kfree(output.pointer);
729
730 return count;
731 }
732
733 static char *thumbtypes[] = {"Md5", "Sha1", "Sha256"};
734
certificate_thumbprint_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)735 static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,
736 char *buf)
737 {
738 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
739 unsigned int i;
740 int count = 0;
741 char *wmistr;
742
743 if (!tlmi_priv.certificate_support || !setting->cert_installed)
744 return -EOPNOTSUPP;
745
746 for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
747 ssize_t ret;
748
749 if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) {
750 /* Format: 'SVC | SMC, Thumbtype' */
751 wmistr = kasprintf(GFP_KERNEL, "%s,%s",
752 setting == tlmi_priv.pwd_admin ? "SVC" : "SMC",
753 thumbtypes[i]);
754 } else {
755 /* Format: 'Thumbtype' */
756 wmistr = kasprintf(GFP_KERNEL, "%s", thumbtypes[i]);
757 }
758 if (!wmistr)
759 return -ENOMEM;
760
761 ret = cert_thumbprint(buf, wmistr, count);
762 kfree(wmistr);
763 if (ret < 0)
764 return ret;
765 count = ret;
766 }
767
768 return count;
769 }
770
771 static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint);
772
cert_to_password_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)773 static ssize_t cert_to_password_store(struct kobject *kobj,
774 struct kobj_attribute *attr,
775 const char *buf, size_t count)
776 {
777 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
778 char *auth_str, *passwd;
779 int ret;
780
781 if (!capable(CAP_SYS_ADMIN))
782 return -EPERM;
783
784 if (!tlmi_priv.certificate_support)
785 return -EOPNOTSUPP;
786
787 if (!setting->cert_installed)
788 return -EINVAL;
789
790 if (!setting->signature || !setting->signature[0])
791 return -EACCES;
792
793 /* Strip out CR if one is present */
794 passwd = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
795 if (!passwd)
796 return -ENOMEM;
797
798 /* Format: 'Password,Signature' */
799 auth_str = cert_command(setting, passwd, setting->signature);
800 if (!auth_str) {
801 kfree_sensitive(passwd);
802 return -ENOMEM;
803 }
804 ret = tlmi_simple_call(tlmi_priv.cert_guid->cert_to_password, auth_str);
805 kfree(auth_str);
806 kfree_sensitive(passwd);
807
808 return ret ?: count;
809 }
810
811 static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password);
812
813 enum cert_install_mode {
814 TLMI_CERT_INSTALL,
815 TLMI_CERT_UPDATE,
816 };
817
certificate_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)818 static ssize_t certificate_store(struct kobject *kobj,
819 struct kobj_attribute *attr,
820 const char *buf, size_t count)
821 {
822 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
823 enum cert_install_mode install_mode = TLMI_CERT_INSTALL;
824 char *auth_str, *new_cert;
825 const char *serial;
826 char *signature;
827 const char *guid;
828 int ret;
829
830 if (!capable(CAP_SYS_ADMIN))
831 return -EPERM;
832
833 if (!tlmi_priv.certificate_support)
834 return -EOPNOTSUPP;
835
836 /* If empty then clear installed certificate */
837 if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */
838 /* Check that signature is set */
839 if (!setting->signature || !setting->signature[0])
840 return -EACCES;
841
842 /* Format: 'serial#, signature' */
843 serial = dmi_get_system_info(DMI_PRODUCT_SERIAL);
844 if (!serial)
845 return -ENODEV;
846 auth_str = cert_command(setting, serial, setting->signature);
847 if (!auth_str)
848 return -ENOMEM;
849
850 ret = tlmi_simple_call(tlmi_priv.cert_guid->clear_bios_cert, auth_str);
851 kfree(auth_str);
852
853 return ret ?: count;
854 }
855
856 /* Strip out CR if one is present */
857 new_cert = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
858 if (!new_cert)
859 return -ENOMEM;
860
861 if (setting->cert_installed) {
862 /* Certificate is installed so this is an update */
863 install_mode = TLMI_CERT_UPDATE;
864 /* If admin account enabled - need to use its signature */
865 if (tlmi_priv.pwd_admin->pwd_enabled)
866 signature = tlmi_priv.pwd_admin->signature;
867 else
868 signature = setting->signature;
869 } else { /* Cert install */
870 /* Check if SMC and SVC already installed */
871 if ((setting == tlmi_priv.pwd_system) && tlmi_priv.pwd_admin->cert_installed) {
872 /* This gets treated as a cert update */
873 install_mode = TLMI_CERT_UPDATE;
874 signature = tlmi_priv.pwd_admin->signature;
875 } else { /* Regular cert install */
876 install_mode = TLMI_CERT_INSTALL;
877 signature = setting->signature;
878 }
879 }
880
881 if (install_mode == TLMI_CERT_UPDATE) {
882 /* This is a certificate update */
883 if (!signature || !signature[0]) {
884 kfree(new_cert);
885 return -EACCES;
886 }
887 guid = tlmi_priv.cert_guid->update_bios_cert;
888 /* Format: 'Certificate,Signature' */
889 auth_str = cert_command(setting, new_cert, signature);
890 } else {
891 /* This is a fresh install */
892 /* To set admin cert, a password must be enabled */
893 if ((setting == tlmi_priv.pwd_admin) &&
894 (!setting->pwd_enabled || !setting->password[0])) {
895 kfree(new_cert);
896 return -EACCES;
897 }
898 guid = tlmi_priv.cert_guid->set_bios_cert;
899 if (tlmi_priv.thinkcenter_mode) {
900 /* Format: 'Certificate, password, encoding, kbdlang' */
901 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s", new_cert,
902 setting->password,
903 encoding_options[setting->encoding],
904 setting->kbdlang);
905 } else {
906 /* Format: 'Certificate, password' */
907 auth_str = cert_command(setting, new_cert, setting->password);
908 }
909 }
910 kfree(new_cert);
911 if (!auth_str)
912 return -ENOMEM;
913
914 ret = tlmi_simple_call(guid, auth_str);
915 kfree(auth_str);
916
917 return ret ?: count;
918 }
919
920 static struct kobj_attribute auth_certificate = __ATTR_WO(certificate);
921
signature_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)922 static ssize_t signature_store(struct kobject *kobj,
923 struct kobj_attribute *attr,
924 const char *buf, size_t count)
925 {
926 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
927 char *new_signature;
928
929 if (!capable(CAP_SYS_ADMIN))
930 return -EPERM;
931
932 if (!tlmi_priv.certificate_support)
933 return -EOPNOTSUPP;
934
935 /* Strip out CR if one is present */
936 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
937 if (!new_signature)
938 return -ENOMEM;
939
940 /* Free any previous signature */
941 kfree(setting->signature);
942 setting->signature = new_signature;
943
944 return count;
945 }
946
947 static struct kobj_attribute auth_signature = __ATTR_WO(signature);
948
save_signature_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)949 static ssize_t save_signature_store(struct kobject *kobj,
950 struct kobj_attribute *attr,
951 const char *buf, size_t count)
952 {
953 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
954 char *new_signature;
955
956 if (!capable(CAP_SYS_ADMIN))
957 return -EPERM;
958
959 if (!tlmi_priv.certificate_support)
960 return -EOPNOTSUPP;
961
962 /* Strip out CR if one is present */
963 new_signature = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
964 if (!new_signature)
965 return -ENOMEM;
966
967 /* Free any previous signature */
968 kfree(setting->save_signature);
969 setting->save_signature = new_signature;
970
971 return count;
972 }
973
974 static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature);
975
auth_attr_is_visible(struct kobject * kobj,struct attribute * attr,int n)976 static umode_t auth_attr_is_visible(struct kobject *kobj,
977 struct attribute *attr, int n)
978 {
979 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
980
981 /* We only want to display level and index settings on HDD/NVMe */
982 if (attr == &auth_index.attr || attr == &auth_level.attr) {
983 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme))
984 return attr->mode;
985 return 0;
986 }
987
988 /* We only display certificates, if supported */
989 if (attr == &auth_certificate.attr ||
990 attr == &auth_signature.attr ||
991 attr == &auth_save_signature.attr ||
992 attr == &auth_cert_thumb.attr ||
993 attr == &auth_cert_to_password.attr) {
994 if (tlmi_priv.certificate_support) {
995 if (setting == tlmi_priv.pwd_admin)
996 return attr->mode;
997 if ((tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) &&
998 (setting == tlmi_priv.pwd_system))
999 return attr->mode;
1000 }
1001 return 0;
1002 }
1003
1004 /* Don't display un-needed settings if opcode available */
1005 if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) &&
1006 tlmi_priv.opcode_support)
1007 return 0;
1008
1009 return attr->mode;
1010 }
1011
1012 static struct attribute *auth_attrs[] = {
1013 &auth_is_pass_set.attr,
1014 &auth_min_pass_length.attr,
1015 &auth_max_pass_length.attr,
1016 &auth_current_password.attr,
1017 &auth_new_password.attr,
1018 &auth_role.attr,
1019 &auth_mechanism.attr,
1020 &auth_encoding.attr,
1021 &auth_kbdlang.attr,
1022 &auth_index.attr,
1023 &auth_level.attr,
1024 &auth_certificate.attr,
1025 &auth_signature.attr,
1026 &auth_save_signature.attr,
1027 &auth_cert_thumb.attr,
1028 &auth_cert_to_password.attr,
1029 NULL
1030 };
1031
1032 static const struct attribute_group auth_attr_group = {
1033 .is_visible = auth_attr_is_visible,
1034 .attrs = auth_attrs,
1035 };
1036 __ATTRIBUTE_GROUPS(auth_attr);
1037
1038 /* ---- Attributes sysfs --------------------------------------------------------- */
display_name_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1039 static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,
1040 char *buf)
1041 {
1042 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1043
1044 return sysfs_emit(buf, "%s\n", setting->display_name);
1045 }
1046
current_value_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1047 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
1048 {
1049 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1050 char *item, *value;
1051 int ret;
1052
1053 ret = tlmi_setting(setting->wdev, setting->index, &item);
1054 if (ret)
1055 return ret;
1056
1057 /* validate and split from `item,value` -> `value` */
1058 value = strpbrk(item, ",");
1059 if (!value || value == item || !strlen(value + 1))
1060 ret = -EINVAL;
1061 else {
1062 /* On Workstations remove the Options part after the value */
1063 strreplace(value, ';', '\0');
1064 ret = sysfs_emit(buf, "%s\n", value + 1);
1065 }
1066 kfree(item);
1067
1068 return ret;
1069 }
1070
possible_values_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1071 static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
1072 {
1073 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1074
1075 return sysfs_emit(buf, "%s\n", setting->possible_values);
1076 }
1077
type_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1078 static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
1079 char *buf)
1080 {
1081 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1082
1083 if (setting->possible_values) {
1084 /* Figure out what setting type is as BIOS does not return this */
1085 if (strchr(setting->possible_values, ';'))
1086 return sysfs_emit(buf, "enumeration\n");
1087 }
1088 /* Anything else is going to be a string */
1089 return sysfs_emit(buf, "string\n");
1090 }
1091
current_value_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1092 static ssize_t current_value_store(struct kobject *kobj,
1093 struct kobj_attribute *attr,
1094 const char *buf, size_t count)
1095 {
1096 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1097 char *set_str = NULL, *new_setting = NULL;
1098 char *auth_str = NULL;
1099 int ret;
1100
1101 if (!tlmi_priv.can_set_bios_settings)
1102 return -EOPNOTSUPP;
1103
1104 /*
1105 * If we are using bulk saves a reboot should be done once save has
1106 * been called
1107 */
1108 if (tlmi_priv.save_mode == TLMI_SAVE_BULK && tlmi_priv.reboot_required)
1109 return -EPERM;
1110
1111 /* Strip out CR if one is present */
1112 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
1113 if (!new_setting)
1114 return -ENOMEM;
1115
1116 /* Use lock in case multiple WMI operations needed */
1117 mutex_lock(&tlmi_mutex);
1118
1119 /* Check if certificate authentication is enabled and active */
1120 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1121 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
1122 ret = -EINVAL;
1123 goto out;
1124 }
1125 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
1126 new_setting, tlmi_priv.pwd_admin->signature);
1127 if (!set_str) {
1128 ret = -ENOMEM;
1129 goto out;
1130 }
1131
1132 ret = tlmi_simple_call(tlmi_priv.cert_guid->set_bios_setting, set_str);
1133 if (ret)
1134 goto out;
1135 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)
1136 tlmi_priv.save_required = true;
1137 else
1138 ret = tlmi_simple_call(tlmi_priv.cert_guid->save_bios_setting,
1139 tlmi_priv.pwd_admin->save_signature);
1140 } else if (tlmi_priv.opcode_support) {
1141 /*
1142 * If opcode support is present use that interface.
1143 * Note - this sets the variable and then the password as separate
1144 * WMI calls. Function tlmi_save_bios_settings will error if the
1145 * password is incorrect.
1146 * Workstation's require the opcode to be set before changing the
1147 * attribute.
1148 */
1149 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1150 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1151 tlmi_priv.pwd_admin->password);
1152 if (ret)
1153 goto out;
1154 }
1155
1156 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
1157 new_setting);
1158 if (!set_str) {
1159 ret = -ENOMEM;
1160 goto out;
1161 }
1162
1163 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1164 if (ret)
1165 goto out;
1166
1167 if (tlmi_priv.save_mode == TLMI_SAVE_BULK)
1168 tlmi_priv.save_required = true;
1169 else
1170 ret = tlmi_save_bios_settings("");
1171 } else { /* old non-opcode based authentication method (deprecated) */
1172 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1173 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1174 tlmi_priv.pwd_admin->password,
1175 encoding_options[tlmi_priv.pwd_admin->encoding],
1176 tlmi_priv.pwd_admin->kbdlang);
1177 if (!auth_str) {
1178 ret = -ENOMEM;
1179 goto out;
1180 }
1181 }
1182
1183 if (auth_str)
1184 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
1185 new_setting, auth_str);
1186 else
1187 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
1188 new_setting);
1189 if (!set_str) {
1190 ret = -ENOMEM;
1191 goto out;
1192 }
1193
1194 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1195 if (ret)
1196 goto out;
1197
1198 if (tlmi_priv.save_mode == TLMI_SAVE_BULK) {
1199 tlmi_priv.save_required = true;
1200 } else {
1201 if (auth_str)
1202 ret = tlmi_save_bios_settings(auth_str);
1203 else
1204 ret = tlmi_save_bios_settings("");
1205 }
1206 }
1207 if (!ret && !tlmi_priv.pending_changes) {
1208 tlmi_priv.pending_changes = true;
1209 /* let userland know it may need to check reboot pending again */
1210 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1211 }
1212 out:
1213 mutex_unlock(&tlmi_mutex);
1214 kfree(auth_str);
1215 kfree(set_str);
1216 kfree(new_setting);
1217 return ret ?: count;
1218 }
1219
1220 static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name);
1221
1222 static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);
1223
1224 static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);
1225
1226 static struct kobj_attribute attr_type = __ATTR_RO(type);
1227
attr_is_visible(struct kobject * kobj,struct attribute * attr,int n)1228 static umode_t attr_is_visible(struct kobject *kobj,
1229 struct attribute *attr, int n)
1230 {
1231 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1232
1233 /* We don't want to display possible_values attributes if not available */
1234 if ((attr == &attr_possible_values.attr) && (!setting->possible_values))
1235 return 0;
1236
1237 return attr->mode;
1238 }
1239
1240 static struct attribute *tlmi_attrs[] = {
1241 &attr_displ_name.attr,
1242 &attr_current_val.attr,
1243 &attr_possible_values.attr,
1244 &attr_type.attr,
1245 NULL
1246 };
1247
1248 static const struct attribute_group tlmi_attr_group = {
1249 .is_visible = attr_is_visible,
1250 .attrs = tlmi_attrs,
1251 };
1252 __ATTRIBUTE_GROUPS(tlmi_attr);
1253
tlmi_attr_setting_release(struct kobject * kobj)1254 static void tlmi_attr_setting_release(struct kobject *kobj)
1255 {
1256 struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1257
1258 kfree(setting->possible_values);
1259 kfree(setting);
1260 }
1261
tlmi_pwd_setting_release(struct kobject * kobj)1262 static void tlmi_pwd_setting_release(struct kobject *kobj)
1263 {
1264 struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
1265
1266 kfree(setting);
1267 }
1268
1269 static const struct kobj_type tlmi_attr_setting_ktype = {
1270 .release = &tlmi_attr_setting_release,
1271 .sysfs_ops = &kobj_sysfs_ops,
1272 .default_groups = tlmi_attr_groups,
1273 };
1274
1275 static const struct kobj_type tlmi_pwd_setting_ktype = {
1276 .release = &tlmi_pwd_setting_release,
1277 .sysfs_ops = &kobj_sysfs_ops,
1278 .default_groups = auth_attr_groups,
1279 };
1280
pending_reboot_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1281 static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,
1282 char *buf)
1283 {
1284 return sprintf(buf, "%d\n", tlmi_priv.pending_changes);
1285 }
1286
1287 static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);
1288
1289 static const char * const save_mode_strings[] = {
1290 [TLMI_SAVE_SINGLE] = "single",
1291 [TLMI_SAVE_BULK] = "bulk",
1292 [TLMI_SAVE_SAVE] = "save"
1293 };
1294
save_settings_show(struct kobject * kobj,struct kobj_attribute * attr,char * buf)1295 static ssize_t save_settings_show(struct kobject *kobj, struct kobj_attribute *attr,
1296 char *buf)
1297 {
1298 /* Check that setting is valid */
1299 if (WARN_ON(tlmi_priv.save_mode < TLMI_SAVE_SINGLE ||
1300 tlmi_priv.save_mode > TLMI_SAVE_BULK))
1301 return -EIO;
1302 return sysfs_emit(buf, "%s\n", save_mode_strings[tlmi_priv.save_mode]);
1303 }
1304
save_settings_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1305 static ssize_t save_settings_store(struct kobject *kobj, struct kobj_attribute *attr,
1306 const char *buf, size_t count)
1307 {
1308 char *auth_str = NULL;
1309 int ret = 0;
1310 int cmd;
1311
1312 cmd = sysfs_match_string(save_mode_strings, buf);
1313 if (cmd < 0)
1314 return cmd;
1315
1316 /* Use lock in case multiple WMI operations needed */
1317 mutex_lock(&tlmi_mutex);
1318
1319 switch (cmd) {
1320 case TLMI_SAVE_SINGLE:
1321 case TLMI_SAVE_BULK:
1322 tlmi_priv.save_mode = cmd;
1323 goto out;
1324 case TLMI_SAVE_SAVE:
1325 /* Check if supported*/
1326 if (!tlmi_priv.can_set_bios_settings ||
1327 tlmi_priv.save_mode == TLMI_SAVE_SINGLE) {
1328 ret = -EOPNOTSUPP;
1329 goto out;
1330 }
1331 /* Check there is actually something to save */
1332 if (!tlmi_priv.save_required) {
1333 ret = -ENOENT;
1334 goto out;
1335 }
1336 /* Check if certificate authentication is enabled and active */
1337 if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1338 if (!tlmi_priv.pwd_admin->signature ||
1339 !tlmi_priv.pwd_admin->save_signature) {
1340 ret = -EINVAL;
1341 goto out;
1342 }
1343 ret = tlmi_simple_call(tlmi_priv.cert_guid->save_bios_setting,
1344 tlmi_priv.pwd_admin->save_signature);
1345 if (ret)
1346 goto out;
1347 } else if (tlmi_priv.opcode_support) {
1348 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1349 ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1350 tlmi_priv.pwd_admin->password);
1351 if (ret)
1352 goto out;
1353 }
1354 ret = tlmi_save_bios_settings("");
1355 } else { /* old non-opcode based authentication method (deprecated) */
1356 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1357 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1358 tlmi_priv.pwd_admin->password,
1359 encoding_options[tlmi_priv.pwd_admin->encoding],
1360 tlmi_priv.pwd_admin->kbdlang);
1361 if (!auth_str) {
1362 ret = -ENOMEM;
1363 goto out;
1364 }
1365 }
1366
1367 if (auth_str)
1368 ret = tlmi_save_bios_settings(auth_str);
1369 else
1370 ret = tlmi_save_bios_settings("");
1371 }
1372 tlmi_priv.save_required = false;
1373 tlmi_priv.reboot_required = true;
1374
1375 if (!ret && !tlmi_priv.pending_changes) {
1376 tlmi_priv.pending_changes = true;
1377 /* let userland know it may need to check reboot pending again */
1378 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1379 }
1380 break;
1381 }
1382 out:
1383 mutex_unlock(&tlmi_mutex);
1384 kfree(auth_str);
1385 return ret ?: count;
1386 }
1387
1388 static struct kobj_attribute save_settings = __ATTR_RW(save_settings);
1389
1390 /* ---- Debug interface--------------------------------------------------------- */
debug_cmd_store(struct kobject * kobj,struct kobj_attribute * attr,const char * buf,size_t count)1391 static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr,
1392 const char *buf, size_t count)
1393 {
1394 char *set_str = NULL, *new_setting = NULL;
1395 char *auth_str = NULL;
1396 int ret;
1397
1398 if (!tlmi_priv.can_debug_cmd)
1399 return -EOPNOTSUPP;
1400
1401 /* Strip out CR if one is present */
1402 new_setting = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
1403 if (!new_setting)
1404 return -ENOMEM;
1405
1406 if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
1407 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1408 tlmi_priv.pwd_admin->password,
1409 encoding_options[tlmi_priv.pwd_admin->encoding],
1410 tlmi_priv.pwd_admin->kbdlang);
1411 if (!auth_str) {
1412 ret = -ENOMEM;
1413 goto out;
1414 }
1415 }
1416
1417 if (auth_str)
1418 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str);
1419 else
1420 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting);
1421 if (!set_str) {
1422 ret = -ENOMEM;
1423 goto out;
1424 }
1425
1426 ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str);
1427 if (ret)
1428 goto out;
1429
1430 if (!ret && !tlmi_priv.pending_changes) {
1431 tlmi_priv.pending_changes = true;
1432 /* let userland know it may need to check reboot pending again */
1433 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1434 }
1435 out:
1436 kfree(auth_str);
1437 kfree(set_str);
1438 kfree(new_setting);
1439 return ret ?: count;
1440 }
1441
1442 static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);
1443
1444 /* ---- Initialisation --------------------------------------------------------- */
tlmi_release_attr(void)1445 static void tlmi_release_attr(void)
1446 {
1447 struct kobject *pos, *n;
1448
1449 /* Attribute structures */
1450 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1451 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);
1452
1453 if (tlmi_priv.can_debug_cmd && debug_support)
1454 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1455
1456 list_for_each_entry_safe(pos, n, &tlmi_priv.attribute_kset->list, entry)
1457 kobject_put(pos);
1458
1459 kset_unregister(tlmi_priv.attribute_kset);
1460
1461 /* Free up any saved signatures */
1462 kfree(tlmi_priv.pwd_admin->signature);
1463 kfree(tlmi_priv.pwd_admin->save_signature);
1464 if (tlmi_priv.pwd_system) {
1465 kfree(tlmi_priv.pwd_system->signature);
1466 kfree(tlmi_priv.pwd_system->save_signature);
1467 }
1468
1469 /* Authentication structures */
1470 list_for_each_entry_safe(pos, n, &tlmi_priv.authentication_kset->list, entry)
1471 kobject_put(pos);
1472
1473 kset_unregister(tlmi_priv.authentication_kset);
1474 }
1475
tlmi_validate_setting_name(struct kset * attribute_kset,char * name)1476 static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name)
1477 {
1478 struct kobject *duplicate;
1479
1480 if (!strcmp(name, "Reserved"))
1481 return -EINVAL;
1482
1483 duplicate = kset_find_obj(attribute_kset, name);
1484 if (duplicate) {
1485 pr_debug("Duplicate attribute name found - %s\n", name);
1486 /* kset_find_obj() returns a reference */
1487 kobject_put(duplicate);
1488 return -EBUSY;
1489 }
1490
1491 return 0;
1492 }
1493
tlmi_sysfs_init(void)1494 static int tlmi_sysfs_init(void)
1495 {
1496 int i, ret;
1497
1498 tlmi_priv.class_dev = device_create(&firmware_attributes_class, NULL, MKDEV(0, 0),
1499 NULL, "%s", "thinklmi");
1500 if (IS_ERR(tlmi_priv.class_dev)) {
1501 ret = PTR_ERR(tlmi_priv.class_dev);
1502 goto fail_class_created;
1503 }
1504
1505 tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL,
1506 &tlmi_priv.class_dev->kobj);
1507 if (!tlmi_priv.attribute_kset) {
1508 ret = -ENOMEM;
1509 goto fail_device_created;
1510 }
1511
1512 tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
1513 &tlmi_priv.class_dev->kobj);
1514 if (!tlmi_priv.authentication_kset) {
1515 kset_unregister(tlmi_priv.attribute_kset);
1516 ret = -ENOMEM;
1517 goto fail_device_created;
1518 }
1519
1520 for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1521 /* Check if index is a valid setting - skip if it isn't */
1522 if (!tlmi_priv.setting[i])
1523 continue;
1524
1525 /* check for duplicate or reserved values */
1526 if (tlmi_validate_setting_name(tlmi_priv.attribute_kset,
1527 tlmi_priv.setting[i]->display_name) < 0) {
1528 kfree(tlmi_priv.setting[i]->possible_values);
1529 kfree(tlmi_priv.setting[i]);
1530 tlmi_priv.setting[i] = NULL;
1531 continue;
1532 }
1533
1534 /* Build attribute */
1535 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
1536 ret = kobject_init_and_add(&tlmi_priv.setting[i]->kobj, &tlmi_attr_setting_ktype,
1537 NULL, "%s", tlmi_priv.setting[i]->display_name);
1538 if (ret)
1539 goto fail_create_attr;
1540 }
1541
1542 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1543 if (ret)
1544 goto fail_create_attr;
1545
1546 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &save_settings.attr);
1547 if (ret)
1548 goto fail_create_attr;
1549
1550 if (tlmi_priv.can_debug_cmd && debug_support) {
1551 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1552 if (ret)
1553 goto fail_create_attr;
1554 }
1555
1556 /* Create authentication entries */
1557 tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
1558 ret = kobject_init_and_add(&tlmi_priv.pwd_admin->kobj, &tlmi_pwd_setting_ktype,
1559 NULL, "%s", "Admin");
1560 if (ret)
1561 goto fail_create_attr;
1562
1563 tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
1564 ret = kobject_init_and_add(&tlmi_priv.pwd_power->kobj, &tlmi_pwd_setting_ktype,
1565 NULL, "%s", "Power-on");
1566 if (ret)
1567 goto fail_create_attr;
1568
1569 if (tlmi_priv.opcode_support) {
1570 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
1571 ret = kobject_init_and_add(&tlmi_priv.pwd_system->kobj, &tlmi_pwd_setting_ktype,
1572 NULL, "%s", "System");
1573 if (ret)
1574 goto fail_create_attr;
1575
1576 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
1577 ret = kobject_init_and_add(&tlmi_priv.pwd_hdd->kobj, &tlmi_pwd_setting_ktype,
1578 NULL, "%s", "HDD");
1579 if (ret)
1580 goto fail_create_attr;
1581
1582 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
1583 ret = kobject_init_and_add(&tlmi_priv.pwd_nvme->kobj, &tlmi_pwd_setting_ktype,
1584 NULL, "%s", "NVMe");
1585 if (ret)
1586 goto fail_create_attr;
1587 }
1588
1589 return ret;
1590
1591 fail_create_attr:
1592 tlmi_release_attr();
1593 fail_device_created:
1594 device_unregister(tlmi_priv.class_dev);
1595 fail_class_created:
1596 return ret;
1597 }
1598
1599 /* ---- Base Driver -------------------------------------------------------- */
tlmi_create_auth(const char * pwd_type,const char * pwd_role)1600 static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,
1601 const char *pwd_role)
1602 {
1603 struct tlmi_pwd_setting *new_pwd;
1604
1605 new_pwd = kzalloc_obj(struct tlmi_pwd_setting);
1606 if (!new_pwd)
1607 return NULL;
1608
1609 strscpy(new_pwd->kbdlang, "us");
1610 new_pwd->encoding = TLMI_ENCODING_ASCII;
1611 new_pwd->pwd_type = pwd_type;
1612 new_pwd->role = pwd_role;
1613 new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length;
1614 new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
1615 new_pwd->index = 0;
1616
1617 return new_pwd;
1618 }
1619
tlmi_analyze(struct wmi_device * wdev)1620 static int tlmi_analyze(struct wmi_device *wdev)
1621 {
1622 int i, ret;
1623
1624 if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) &&
1625 wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID))
1626 tlmi_priv.can_set_bios_settings = true;
1627
1628 if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID))
1629 tlmi_priv.can_get_bios_selections = true;
1630
1631 if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID))
1632 tlmi_priv.can_set_bios_password = true;
1633
1634 if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID))
1635 tlmi_priv.can_get_password_settings = true;
1636
1637 if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID))
1638 tlmi_priv.can_debug_cmd = true;
1639
1640 if (wmi_has_guid(LENOVO_OPCODE_IF_GUID))
1641 tlmi_priv.opcode_support = true;
1642
1643 if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) &&
1644 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) &&
1645 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID))
1646 tlmi_priv.certificate_support = true;
1647
1648 /* ThinkCenter uses different GUIDs for certificate support */
1649 if (wmi_has_guid(LENOVO_TC_SET_BIOS_CERT_GUID) &&
1650 wmi_has_guid(LENOVO_TC_SET_BIOS_SETTING_CERT_GUID) &&
1651 wmi_has_guid(LENOVO_TC_SAVE_BIOS_SETTING_CERT_GUID)) {
1652 tlmi_priv.certificate_support = true;
1653 tlmi_priv.thinkcenter_mode = true;
1654 pr_info("ThinkCenter modified support being used\n");
1655 }
1656
1657 /*
1658 * Try to find the number of valid settings of this machine
1659 * and use it to create sysfs attributes.
1660 */
1661 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1662 struct tlmi_attr_setting *setting;
1663 char *item = NULL;
1664
1665 tlmi_priv.setting[i] = NULL;
1666 ret = tlmi_setting(wdev, i, &item);
1667 if (ret)
1668 break;
1669 if (!item)
1670 break;
1671 if (!*item) {
1672 kfree(item);
1673 continue;
1674 }
1675
1676 /* Remove the value part */
1677 strreplace(item, ',', '\0');
1678
1679 /* Create a setting entry */
1680 setting = kzalloc_obj(*setting);
1681 if (!setting) {
1682 ret = -ENOMEM;
1683 kfree(item);
1684 goto fail_clear_attr;
1685 }
1686 setting->wdev = wdev;
1687 setting->index = i;
1688
1689 strscpy(setting->name, item);
1690 /* It is not allowed to have '/' for file name. Convert it into '\'. */
1691 strreplace(item, '/', '\\');
1692 strscpy(setting->display_name, item);
1693
1694 /* If BIOS selections supported, load those */
1695 if (tlmi_priv.can_get_bios_selections) {
1696 ret = tlmi_get_bios_selections(setting->name,
1697 &setting->possible_values);
1698 if (ret || !setting->possible_values)
1699 pr_info("Error retrieving possible values for %d : %s\n",
1700 i, setting->display_name);
1701 } else {
1702 /*
1703 * Older Thinkstations don't support the bios_selections API.
1704 * Instead they store this as a [Optional:Option1,Option2] section of the
1705 * name string.
1706 * Try and pull that out if it's available.
1707 */
1708 char *optitem, *optstart, *optend;
1709
1710 if (!tlmi_setting(setting->wdev, setting->index, &optitem)) {
1711 optstart = strstr(optitem, "[Optional:");
1712 if (optstart) {
1713 optstart += strlen("[Optional:");
1714 optend = strstr(optstart, "]");
1715 if (optend)
1716 setting->possible_values =
1717 kstrndup(optstart, optend - optstart,
1718 GFP_KERNEL);
1719 }
1720 kfree(optitem);
1721 }
1722 }
1723 /*
1724 * firmware-attributes requires that possible_values are separated by ';' but
1725 * Lenovo FW uses ','. Replace appropriately.
1726 */
1727 if (setting->possible_values)
1728 strreplace(setting->possible_values, ',', ';');
1729
1730 tlmi_priv.setting[i] = setting;
1731 kfree(item);
1732 }
1733
1734 /* Create password setting structure */
1735 ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg);
1736 if (ret)
1737 goto fail_clear_attr;
1738
1739 /* All failures below boil down to kmalloc failures */
1740 ret = -ENOMEM;
1741
1742 tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin");
1743 if (!tlmi_priv.pwd_admin)
1744 goto fail_clear_attr;
1745
1746 if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)
1747 tlmi_priv.pwd_admin->pwd_enabled = true;
1748
1749 tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");
1750 if (!tlmi_priv.pwd_power)
1751 goto fail_clear_attr;
1752
1753 if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)
1754 tlmi_priv.pwd_power->pwd_enabled = true;
1755
1756 if (tlmi_priv.opcode_support) {
1757 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
1758 if (!tlmi_priv.pwd_system)
1759 goto fail_clear_attr;
1760
1761 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
1762 tlmi_priv.pwd_system->pwd_enabled = true;
1763
1764 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
1765 if (!tlmi_priv.pwd_hdd)
1766 goto fail_clear_attr;
1767
1768 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme");
1769 if (!tlmi_priv.pwd_nvme)
1770 goto fail_clear_attr;
1771
1772 /* Set default hdd/nvme index to 1 as there is no device 0 */
1773 tlmi_priv.pwd_hdd->index = 1;
1774 tlmi_priv.pwd_nvme->index = 1;
1775
1776 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) {
1777 /* Check if PWD is configured and set index to first drive found */
1778 if (tlmi_priv.pwdcfg.ext.hdd_user_password ||
1779 tlmi_priv.pwdcfg.ext.hdd_master_password) {
1780 tlmi_priv.pwd_hdd->pwd_enabled = true;
1781 if (tlmi_priv.pwdcfg.ext.hdd_master_password)
1782 tlmi_priv.pwd_hdd->index =
1783 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;
1784 else
1785 tlmi_priv.pwd_hdd->index =
1786 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1;
1787 }
1788 if (tlmi_priv.pwdcfg.ext.nvme_user_password ||
1789 tlmi_priv.pwdcfg.ext.nvme_master_password) {
1790 tlmi_priv.pwd_nvme->pwd_enabled = true;
1791 if (tlmi_priv.pwdcfg.ext.nvme_master_password)
1792 tlmi_priv.pwd_nvme->index =
1793 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;
1794 else
1795 tlmi_priv.pwd_nvme->index =
1796 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1;
1797 }
1798 }
1799 }
1800
1801 if (tlmi_priv.certificate_support) {
1802 if (tlmi_priv.thinkcenter_mode) {
1803 tlmi_priv.cert_guid = &thinkcenter_cert_guid;
1804 tlmi_priv.pwd_admin->cert_installed = tlmi_priv.pwdcfg.core.password_mode;
1805 } else {
1806 tlmi_priv.cert_guid = &thinkpad_cert_guid;
1807 tlmi_priv.pwd_admin->cert_installed =
1808 tlmi_priv.pwdcfg.core.password_state & TLMI_CERT_SVC;
1809 tlmi_priv.pwd_system->cert_installed =
1810 tlmi_priv.pwdcfg.core.password_state & TLMI_CERT_SMC;
1811 }
1812 }
1813 return 0;
1814
1815 fail_clear_attr:
1816 for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1817 if (tlmi_priv.setting[i]) {
1818 kfree(tlmi_priv.setting[i]->possible_values);
1819 kfree(tlmi_priv.setting[i]);
1820 }
1821 }
1822 kfree(tlmi_priv.pwd_admin);
1823 kfree(tlmi_priv.pwd_power);
1824 kfree(tlmi_priv.pwd_system);
1825 kfree(tlmi_priv.pwd_hdd);
1826 kfree(tlmi_priv.pwd_nvme);
1827 return ret;
1828 }
1829
tlmi_remove(struct wmi_device * wdev)1830 static void tlmi_remove(struct wmi_device *wdev)
1831 {
1832 tlmi_release_attr();
1833 device_unregister(tlmi_priv.class_dev);
1834 }
1835
tlmi_probe(struct wmi_device * wdev,const void * context)1836 static int tlmi_probe(struct wmi_device *wdev, const void *context)
1837 {
1838 int ret;
1839
1840 ret = tlmi_analyze(wdev);
1841 if (ret)
1842 return ret;
1843
1844 return tlmi_sysfs_init();
1845 }
1846
1847 static const struct wmi_device_id tlmi_id_table[] = {
1848 { .guid_string = LENOVO_BIOS_SETTING_GUID },
1849 { }
1850 };
1851 MODULE_DEVICE_TABLE(wmi, tlmi_id_table);
1852
1853 static struct wmi_driver tlmi_driver = {
1854 .driver = {
1855 .name = "think-lmi",
1856 },
1857 .id_table = tlmi_id_table,
1858 .probe = tlmi_probe,
1859 .remove = tlmi_remove,
1860 };
1861
1862 MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>");
1863 MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>");
1864 MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>");
1865 MODULE_DESCRIPTION("ThinkLMI Driver");
1866 MODULE_LICENSE("GPL");
1867
1868 module_wmi_driver(tlmi_driver);
1869