drivers/platform/x86/think-lmi.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Think LMI BIOS configuration driver
   4  *
   5  * Copyright(C) 2019-2021 Lenovo
   6  *
   7  * Original code from Thinkpad-wmi project https://github.com/iksaif/thinkpad-wmi
   8  * Copyright(C) 2017 Corentin Chary <corentin.chary@gmail.com>
   9  * Distributed under the GPL-2.0 license
  10  */
  11
  12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14 #include <linux/acpi.h>
  15 #include <linux/errno.h>
  16 #include <linux/fs.h>
  17 #include <linux/mutex.h>
  18 #include <linux/string.h>
  19 #include <linux/types.h>
  20 #include <linux/dmi.h>
  21 #include <linux/wmi.h>
  22 #include "firmware_attributes_class.h"
  23 #include "think-lmi.h"
  24
  25 static bool debug_support;
  26 module_param(debug_support, bool, 0444);
  27 MODULE_PARM_DESC(debug_support, "Enable debug command support");
  28
  29 /*
  30  * Name: BiosSetting
  31  * Description: Get item name and settings for current LMI instance.
  32  * Type: Query
  33  * Returns: "Item,Value"
  34  * Example: "WakeOnLAN,Enable"
  35  */
  36 #define LENOVO_BIOS_SETTING_GUID "51F5230E-9677-46CD-A1CF-C0B23EE34DB7"
  37
  38 /*
  39  * Name: SetBiosSetting
  40  * Description: Change the BIOS setting to the desired value using the SetBiosSetting
  41  *  class. To save the settings, use the SaveBiosSetting class.
  42  *  BIOS settings and values are case sensitive.
  43  *  After making changes to the BIOS settings, you must reboot the computer
  44  *  before the changes will take effect.
  45  * Type: Method
  46  * Arguments: "Item,Value,Password,Encoding,KbdLang;"
  47  * Example: "WakeOnLAN,Disable,pa55w0rd,ascii,us;"
  48  */
  49 #define LENOVO_SET_BIOS_SETTINGS_GUID "98479A64-33F5-4E33-A707-8E251EBBC3A1"
  50
  51 /*
  52  * Name: SaveBiosSettings
  53  * Description: Save any pending changes in settings.
  54  * Type: Method
  55  * Arguments: "Password,Encoding,KbdLang;"
  56  * Example: "pa55w0rd,ascii,us;"
  57  */
  58 #define LENOVO_SAVE_BIOS_SETTINGS_GUID "6A4B54EF-A5ED-4D33-9455-B0D9B48DF4B3"
  59
  60 /*
  61  * Name: BiosPasswordSettings
  62  * Description: Return BIOS Password settings
  63  * Type: Query
  64  * Returns: PasswordMode, PasswordState, MinLength, MaxLength,
  65  *  SupportedEncoding, SupportedKeyboard
  66  */
  67 #define LENOVO_BIOS_PASSWORD_SETTINGS_GUID "8ADB159E-1E32-455C-BC93-308A7ED98246"
  68
  69 /*
  70  * Name: SetBiosPassword
  71  * Description: Change a specific password.
  72  *  - BIOS settings cannot be changed at the same boot as power-on
  73  *    passwords (POP) and hard disk passwords (HDP). If you want to change
  74  *    BIOS settings and POP or HDP, you must reboot the system after changing
  75  *    one of them.
  76  *  - A password cannot be set using this method when one does not already
  77  *    exist. Passwords can only be updated or cleared.
  78  * Type: Method
  79  * Arguments: "PasswordType,CurrentPassword,NewPassword,Encoding,KbdLang;"
  80  * Example: "pop,pa55w0rd,newpa55w0rd,ascii,us;”
  81  */
  82 #define LENOVO_SET_BIOS_PASSWORD_GUID "2651D9FD-911C-4B69-B94E-D0DED5963BD7"
  83
  84 /*
  85  * Name: GetBiosSelections
  86  * Description: Return a list of valid settings for a given item.
  87  * Type: Method
  88  * Arguments: "Item"
  89  * Returns: "Value1,Value2,Value3,..."
  90  * Example:
  91  *  -> "FlashOverLAN"
  92  *  <- "Enabled,Disabled"
  93  */
  94 #define LENOVO_GET_BIOS_SELECTIONS_GUID "7364651A-132F-4FE7-ADAA-40C6C7EE2E3B"
  95
  96 /*
  97  * Name: DebugCmd
  98  * Description: Debug entry method for entering debug commands to the BIOS
  99  */
 100 #define LENOVO_DEBUG_CMD_GUID "7FF47003-3B6C-4E5E-A227-E979824A85D1"
 101
 102 /*
 103  * Name: OpcodeIF
 104  * Description: Opcode interface which provides the ability to set multiple
 105  *  parameters and then trigger an action with a final command.
 106  *  This is particularly useful for simplifying setting passwords.
 107  *  With this support comes the ability to set System, HDD and NVMe
 108  *  passwords.
 109  *  This is currently available on ThinkCenter and ThinkStations platforms
 110  */
 111 #define LENOVO_OPCODE_IF_GUID "DFDDEF2C-57D4-48ce-B196-0FB787D90836"
 112
 113 /*
 114  * Name: SetBiosCert
 115  * Description: Install BIOS certificate.
 116  * Type: Method
 117  * Arguments: "Certificate,Password"
 118  * You must reboot the computer before the changes will take effect.
 119  */
 120 #define LENOVO_SET_BIOS_CERT_GUID    "26861C9F-47E9-44C4-BD8B-DFE7FA2610FE"
 121
 122 /*
 123  * Name: UpdateBiosCert
 124  * Description: Update BIOS certificate.
 125  * Type: Method
 126  * Format: "Certificate,Signature"
 127  * You must reboot the computer before the changes will take effect.
 128  */
 129 #define LENOVO_UPDATE_BIOS_CERT_GUID "9AA3180A-9750-41F7-B9F7-D5D3B1BAC3CE"
 130
 131 /*
 132  * Name: ClearBiosCert
 133  * Description: Uninstall BIOS certificate.
 134  * Type: Method
 135  * Format: "Serial,Signature"
 136  * You must reboot the computer before the changes will take effect.
 137  */
 138 #define LENOVO_CLEAR_BIOS_CERT_GUID  "B2BC39A7-78DD-4D71-B059-A510DEC44890"
 139 /*
 140  * Name: CertToPassword
 141  * Description: Switch from certificate to password authentication.
 142  * Type: Method
 143  * Format: "Password,Signature"
 144  * You must reboot the computer before the changes will take effect.
 145  */
 146 #define LENOVO_CERT_TO_PASSWORD_GUID "0DE8590D-5510-4044-9621-77C227F5A70D"
 147
 148 /*
 149  * Name: SetBiosSettingCert
 150  * Description: Set attribute using certificate authentication.
 151  * Type: Method
 152  * Format: "Item,Value,Signature"
 153  */
 154 #define LENOVO_SET_BIOS_SETTING_CERT_GUID  "34A008CC-D205-4B62-9E67-31DFA8B90003"
 155
 156 /*
 157  * Name: SaveBiosSettingCert
 158  * Description: Save any pending changes in settings.
 159  * Type: Method
 160  * Format: "Signature"
 161  */
 162 #define LENOVO_SAVE_BIOS_SETTING_CERT_GUID "C050FB9D-DF5F-4606-B066-9EFC401B2551"
 163
 164 /*
 165  * Name: CertThumbprint
 166  * Description: Display Certificate thumbprints
 167  * Type: Query
 168  * Returns: MD5, SHA1 & SHA256 thumbprints
 169  */
 170 #define LENOVO_CERT_THUMBPRINT_GUID "C59119ED-1C0D-4806-A8E9-59AA318176C4"
 171
 172 #define TLMI_POP_PWD BIT(0) /* Supervisor */
 173 #define TLMI_PAP_PWD BIT(1) /* Power-on */
 174 #define TLMI_HDD_PWD BIT(2) /* HDD/NVME */
 175 #define TLMI_SMP_PWD BIT(6) /* System Management */
 176 #define TLMI_CERT    BIT(7) /* Certificate Based */
 177
 178 #define to_tlmi_pwd_setting(kobj)  container_of(kobj, struct tlmi_pwd_setting, kobj)
 179 #define to_tlmi_attr_setting(kobj)  container_of(kobj, struct tlmi_attr_setting, kobj)
 180
 181 static const struct tlmi_err_codes tlmi_errs[] = {
 182         {"Success", 0},
 183         {"Not Supported", -EOPNOTSUPP},
 184         {"Invalid Parameter", -EINVAL},
 185         {"Access Denied", -EACCES},
 186         {"System Busy", -EBUSY},
 187 };
 188
 189 static const char * const encoding_options[] = {
 190         [TLMI_ENCODING_ASCII] = "ascii",
 191         [TLMI_ENCODING_SCANCODE] = "scancode",
 192 };
 193 static const char * const level_options[] = {
 194         [TLMI_LEVEL_USER] = "user",
 195         [TLMI_LEVEL_MASTER] = "master",
 196 };
 197 static struct think_lmi tlmi_priv;
 198 static struct class *fw_attr_class;
 199 static DEFINE_MUTEX(tlmi_mutex);
 200
 201 /* ------ Utility functions ------------*/
 202 /* Strip out CR if one is present */
 203 static void strip_cr(char *str)
 204 {
 205         char *p = strchrnul(str, '\n');
 206         *p = '\0';
 207 }
 208
 209 /* Convert BIOS WMI error string to suitable error code */
 210 static int tlmi_errstr_to_err(const char *errstr)
 211 {
 212         int i;
 213
 214         for (i = 0; i < sizeof(tlmi_errs)/sizeof(struct tlmi_err_codes); i++) {
 215                 if (!strcmp(tlmi_errs[i].err_str, errstr))
 216                         return tlmi_errs[i].err_code;
 217         }
 218         return -EPERM;
 219 }
 220
 221 /* Extract error string from WMI return buffer */
 222 static int tlmi_extract_error(const struct acpi_buffer *output)
 223 {
 224         const union acpi_object *obj;
 225
 226         obj = output->pointer;
 227         if (!obj)
 228                 return -ENOMEM;
 229         if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
 230                 return -EIO;
 231
 232         return tlmi_errstr_to_err(obj->string.pointer);
 233 }
 234
 235 /* Utility function to execute WMI call to BIOS */
 236 static int tlmi_simple_call(const char *guid, const char *arg)
 237 {
 238         const struct acpi_buffer input = { strlen(arg), (char *)arg };
 239         struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 240         acpi_status status;
 241         int i, err;
 242
 243         /*
 244          * Duplicated call required to match BIOS workaround for behavior
 245          * seen when WMI accessed via scripting on other OS.
 246          */
 247         for (i = 0; i < 2; i++) {
 248                 /* (re)initialize output buffer to default state */
 249                 output.length = ACPI_ALLOCATE_BUFFER;
 250                 output.pointer = NULL;
 251
 252                 status = wmi_evaluate_method(guid, 0, 0, &input, &output);
 253                 if (ACPI_FAILURE(status)) {
 254                         kfree(output.pointer);
 255                         return -EIO;
 256                 }
 257                 err = tlmi_extract_error(&output);
 258                 kfree(output.pointer);
 259                 if (err)
 260                         return err;
 261         }
 262         return 0;
 263 }
 264
 265 /* Extract output string from WMI return buffer */
 266 static int tlmi_extract_output_string(const struct acpi_buffer *output,
 267                                       char **string)
 268 {
 269         const union acpi_object *obj;
 270         char *s;
 271
 272         obj = output->pointer;
 273         if (!obj)
 274                 return -ENOMEM;
 275         if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer)
 276                 return -EIO;
 277
 278         s = kstrdup(obj->string.pointer, GFP_KERNEL);
 279         if (!s)
 280                 return -ENOMEM;
 281         *string = s;
 282         return 0;
 283 }
 284
 285 /* ------ Core interface functions ------------*/
 286
 287 /* Get password settings from BIOS */
 288 static int tlmi_get_pwd_settings(struct tlmi_pwdcfg *pwdcfg)
 289 {
 290         struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 291         const union acpi_object *obj;
 292         acpi_status status;
 293         int copy_size;
 294
 295         if (!tlmi_priv.can_get_password_settings)
 296                 return -EOPNOTSUPP;
 297
 298         status = wmi_query_block(LENOVO_BIOS_PASSWORD_SETTINGS_GUID, 0,
 299                                  &output);
 300         if (ACPI_FAILURE(status))
 301                 return -EIO;
 302
 303         obj = output.pointer;
 304         if (!obj)
 305                 return -ENOMEM;
 306         if (obj->type != ACPI_TYPE_BUFFER || !obj->buffer.pointer) {
 307                 kfree(obj);
 308                 return -EIO;
 309         }
 310         /*
 311          * The size of thinkpad_wmi_pcfg on ThinkStation is larger than ThinkPad.
 312          * To make the driver compatible on different brands, we permit it to get
 313          * the data in below case.
 314          * Settings must have at minimum the core fields available
 315          */
 316         if (obj->buffer.length < sizeof(struct tlmi_pwdcfg_core)) {
 317                 pr_warn("Unknown pwdcfg buffer length %d\n", obj->buffer.length);
 318                 kfree(obj);
 319                 return -EIO;
 320         }
 321
 322         copy_size = min_t(size_t, obj->buffer.length, sizeof(struct tlmi_pwdcfg));
 323
 324         memcpy(pwdcfg, obj->buffer.pointer, copy_size);
 325         kfree(obj);
 326
 327         if (WARN_ON(pwdcfg->core.max_length >= TLMI_PWD_BUFSIZE))
 328                 pwdcfg->core.max_length = TLMI_PWD_BUFSIZE - 1;
 329         return 0;
 330 }
 331
 332 static int tlmi_save_bios_settings(const char *password)
 333 {
 334         return tlmi_simple_call(LENOVO_SAVE_BIOS_SETTINGS_GUID,
 335                                 password);
 336 }
 337
 338 static int tlmi_opcode_setting(char *setting, const char *value)
 339 {
 340         char *opcode_str;
 341         int ret;
 342
 343         opcode_str = kasprintf(GFP_KERNEL, "%s:%s;", setting, value);
 344         if (!opcode_str)
 345                 return -ENOMEM;
 346
 347         ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, opcode_str);
 348         kfree(opcode_str);
 349         return ret;
 350 }
 351
 352 static int tlmi_setting(int item, char **value, const char *guid_string)
 353 {
 354         struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 355         acpi_status status;
 356         int ret;
 357
 358         status = wmi_query_block(guid_string, item, &output);
 359         if (ACPI_FAILURE(status)) {
 360                 kfree(output.pointer);
 361                 return -EIO;
 362         }
 363
 364         ret = tlmi_extract_output_string(&output, value);
 365         kfree(output.pointer);
 366         return ret;
 367 }
 368
 369 static int tlmi_get_bios_selections(const char *item, char **value)
 370 {
 371         const struct acpi_buffer input = { strlen(item), (char *)item };
 372         struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 373         acpi_status status;
 374         int ret;
 375
 376         status = wmi_evaluate_method(LENOVO_GET_BIOS_SELECTIONS_GUID,
 377                                      0, 0, &input, &output);
 378
 379         if (ACPI_FAILURE(status)) {
 380                 kfree(output.pointer);
 381                 return -EIO;
 382         }
 383
 384         ret = tlmi_extract_output_string(&output, value);
 385         kfree(output.pointer);
 386         return ret;
 387 }
 388
 389 /* ---- Authentication sysfs --------------------------------------------------------- */
 390 static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr,
 391                                           char *buf)
 392 {
 393         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 394
 395         return sysfs_emit(buf, "%d\n", setting->valid);
 396 }
 397
 398 static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);
 399
 400 static ssize_t current_password_store(struct kobject *kobj,
 401                                       struct kobj_attribute *attr,
 402                                       const char *buf, size_t count)
 403 {
 404         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 405         size_t pwdlen;
 406
 407         pwdlen = strlen(buf);
 408         /* pwdlen == 0 is allowed to clear the password */
 409         if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
 410                 return -EINVAL;
 411
 412         strscpy(setting->password, buf, setting->maxlen);
 413         /* Strip out CR if one is present, setting password won't work if it is present */
 414         strip_cr(setting->password);
 415         return count;
 416 }
 417
 418 static struct kobj_attribute auth_current_password = __ATTR_WO(current_password);
 419
 420 static ssize_t new_password_store(struct kobject *kobj,
 421                                   struct kobj_attribute *attr,
 422                                   const char *buf, size_t count)
 423 {
 424         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 425         char *auth_str, *new_pwd;
 426         size_t pwdlen;
 427         int ret;
 428
 429         if (!capable(CAP_SYS_ADMIN))
 430                 return -EPERM;
 431
 432         if (!tlmi_priv.can_set_bios_password)
 433                 return -EOPNOTSUPP;
 434
 435         new_pwd = kstrdup(buf, GFP_KERNEL);
 436         if (!new_pwd)
 437                 return -ENOMEM;
 438
 439         /* Strip out CR if one is present, setting password won't work if it is present */
 440         strip_cr(new_pwd);
 441
 442         /* Use lock in case multiple WMI operations needed */
 443         mutex_lock(&tlmi_mutex);
 444
 445         pwdlen = strlen(new_pwd);
 446         /* pwdlen == 0 is allowed to clear the password */
 447         if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen))) {
 448                 ret = -EINVAL;
 449                 goto out;
 450         }
 451
 452         /* If opcode support is present use that interface */
 453         if (tlmi_priv.opcode_support) {
 454                 char pwd_type[8];
 455
 456                 /* Special handling required for HDD and NVMe passwords */
 457                 if (setting == tlmi_priv.pwd_hdd) {
 458                         if (setting->level == TLMI_LEVEL_USER)
 459                                 sprintf(pwd_type, "uhdp%d", setting->index);
 460                         else
 461                                 sprintf(pwd_type, "mhdp%d", setting->index);
 462                 } else if (setting == tlmi_priv.pwd_nvme) {
 463                         if (setting->level == TLMI_LEVEL_USER)
 464                                 sprintf(pwd_type, "udrp%d", setting->index);
 465                         else
 466                                 sprintf(pwd_type, "adrp%d", setting->index);
 467                 } else {
 468                         sprintf(pwd_type, "%s", setting->pwd_type);
 469                 }
 470
 471                 ret = tlmi_opcode_setting("WmiOpcodePasswordType", pwd_type);
 472                 if (ret)
 473                         goto out;
 474
 475                 if (tlmi_priv.pwd_admin->valid) {
 476                         ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
 477                                         tlmi_priv.pwd_admin->password);
 478                         if (ret)
 479                                 goto out;
 480                 }
 481                 ret = tlmi_opcode_setting("WmiOpcodePasswordCurrent01", setting->password);
 482                 if (ret)
 483                         goto out;
 484                 ret = tlmi_opcode_setting("WmiOpcodePasswordNew01", new_pwd);
 485                 if (ret)
 486                         goto out;
 487                 ret = tlmi_simple_call(LENOVO_OPCODE_IF_GUID, "WmiOpcodePasswordSetUpdate;");
 488         } else {
 489                 /* Format: 'PasswordType,CurrentPw,NewPw,Encoding,KbdLang;' */
 490                 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s,%s,%s;",
 491                                 setting->pwd_type, setting->password, new_pwd,
 492                                 encoding_options[setting->encoding], setting->kbdlang);
 493                 if (!auth_str) {
 494                         ret = -ENOMEM;
 495                         goto out;
 496                 }
 497                 ret = tlmi_simple_call(LENOVO_SET_BIOS_PASSWORD_GUID, auth_str);
 498                 kfree(auth_str);
 499         }
 500 out:
 501         mutex_unlock(&tlmi_mutex);
 502         kfree(new_pwd);
 503         return ret ?: count;
 504 }
 505
 506 static struct kobj_attribute auth_new_password = __ATTR_WO(new_password);
 507
 508 static ssize_t min_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
 509                          char *buf)
 510 {
 511         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 512
 513         return sysfs_emit(buf, "%d\n", setting->minlen);
 514 }
 515
 516 static struct kobj_attribute auth_min_pass_length = __ATTR_RO(min_password_length);
 517
 518 static ssize_t max_password_length_show(struct kobject *kobj, struct kobj_attribute *attr,
 519                          char *buf)
 520 {
 521         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 522
 523         return sysfs_emit(buf, "%d\n", setting->maxlen);
 524 }
 525 static struct kobj_attribute auth_max_pass_length = __ATTR_RO(max_password_length);
 526
 527 static ssize_t mechanism_show(struct kobject *kobj, struct kobj_attribute *attr,
 528                          char *buf)
 529 {
 530         return sysfs_emit(buf, "password\n");
 531 }
 532 static struct kobj_attribute auth_mechanism = __ATTR_RO(mechanism);
 533
 534 static ssize_t encoding_show(struct kobject *kobj, struct kobj_attribute *attr,
 535                          char *buf)
 536 {
 537         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 538
 539         return sysfs_emit(buf, "%s\n", encoding_options[setting->encoding]);
 540 }
 541
 542 static ssize_t encoding_store(struct kobject *kobj,
 543                                   struct kobj_attribute *attr,
 544                                   const char *buf, size_t count)
 545 {
 546         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 547         int i;
 548
 549         /* Scan for a matching profile */
 550         i = sysfs_match_string(encoding_options, buf);
 551         if (i < 0)
 552                 return -EINVAL;
 553
 554         setting->encoding = i;
 555         return count;
 556 }
 557
 558 static struct kobj_attribute auth_encoding = __ATTR_RW(encoding);
 559
 560 static ssize_t kbdlang_show(struct kobject *kobj, struct kobj_attribute *attr,
 561                          char *buf)
 562 {
 563         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 564
 565         return sysfs_emit(buf, "%s\n", setting->kbdlang);
 566 }
 567
 568 static ssize_t kbdlang_store(struct kobject *kobj,
 569                                   struct kobj_attribute *attr,
 570                                   const char *buf, size_t count)
 571 {
 572         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 573         int length;
 574
 575         /* Calculate length till '\n' or terminating 0 */
 576         length = strchrnul(buf, '\n') - buf;
 577         if (!length || length >= TLMI_LANG_MAXLEN)
 578                 return -EINVAL;
 579
 580         memcpy(setting->kbdlang, buf, length);
 581         setting->kbdlang[length] = '\0';
 582         return count;
 583 }
 584
 585 static struct kobj_attribute auth_kbdlang = __ATTR_RW(kbdlang);
 586
 587 static ssize_t role_show(struct kobject *kobj, struct kobj_attribute *attr,
 588                          char *buf)
 589 {
 590         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 591
 592         return sysfs_emit(buf, "%s\n", setting->role);
 593 }
 594 static struct kobj_attribute auth_role = __ATTR_RO(role);
 595
 596 static ssize_t index_show(struct kobject *kobj, struct kobj_attribute *attr,
 597                          char *buf)
 598 {
 599         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 600
 601         return sysfs_emit(buf, "%d\n", setting->index);
 602 }
 603
 604 static ssize_t index_store(struct kobject *kobj,
 605                                   struct kobj_attribute *attr,
 606                                   const char *buf, size_t count)
 607 {
 608         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 609         int err, val;
 610
 611         err = kstrtoint(buf, 10, &val);
 612         if (err < 0)
 613                 return err;
 614
 615         if (val < 0 || val > TLMI_INDEX_MAX)
 616                 return -EINVAL;
 617
 618         setting->index = val;
 619         return count;
 620 }
 621
 622 static struct kobj_attribute auth_index = __ATTR_RW(index);
 623
 624 static ssize_t level_show(struct kobject *kobj, struct kobj_attribute *attr,
 625                          char *buf)
 626 {
 627         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 628
 629         return sysfs_emit(buf, "%s\n", level_options[setting->level]);
 630 }
 631
 632 static ssize_t level_store(struct kobject *kobj,
 633                                   struct kobj_attribute *attr,
 634                                   const char *buf, size_t count)
 635 {
 636         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 637         int i;
 638
 639         /* Scan for a matching profile */
 640         i = sysfs_match_string(level_options, buf);
 641         if (i < 0)
 642                 return -EINVAL;
 643
 644         setting->level = i;
 645         return count;
 646 }
 647
 648 static struct kobj_attribute auth_level = __ATTR_RW(level);
 649
 650 static ssize_t cert_thumbprint(char *buf, const char *arg, int count)
 651 {
 652         const struct acpi_buffer input = { strlen(arg), (char *)arg };
 653         struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
 654         const union acpi_object *obj;
 655         acpi_status status;
 656
 657         status = wmi_evaluate_method(LENOVO_CERT_THUMBPRINT_GUID, 0, 0, &input, &output);
 658         if (ACPI_FAILURE(status)) {
 659                 kfree(output.pointer);
 660                 return -EIO;
 661         }
 662         obj = output.pointer;
 663         if (!obj)
 664                 return -ENOMEM;
 665         if (obj->type != ACPI_TYPE_STRING || !obj->string.pointer) {
 666                 kfree(output.pointer);
 667                 return -EIO;
 668         }
 669         count += sysfs_emit_at(buf, count, "%s : %s\n", arg, (char *)obj->string.pointer);
 670         kfree(output.pointer);
 671
 672         return count;
 673 }
 674
 675 static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,
 676                          char *buf)
 677 {
 678         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 679         int count = 0;
 680
 681         if (!tlmi_priv.certificate_support || !setting->cert_installed)
 682                 return -EOPNOTSUPP;
 683
 684         count += cert_thumbprint(buf, "Md5", count);
 685         count += cert_thumbprint(buf, "Sha1", count);
 686         count += cert_thumbprint(buf, "Sha256", count);
 687         return count;
 688 }
 689
 690 static struct kobj_attribute auth_cert_thumb = __ATTR_RO(certificate_thumbprint);
 691
 692 static ssize_t cert_to_password_store(struct kobject *kobj,
 693                                   struct kobj_attribute *attr,
 694                                   const char *buf, size_t count)
 695 {
 696         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 697         char *auth_str, *passwd;
 698         int ret;
 699
 700         if (!capable(CAP_SYS_ADMIN))
 701                 return -EPERM;
 702
 703         if (!tlmi_priv.certificate_support)
 704                 return -EOPNOTSUPP;
 705
 706         if (!setting->cert_installed)
 707                 return -EINVAL;
 708
 709         if (!setting->signature || !setting->signature[0])
 710                 return -EACCES;
 711
 712         passwd = kstrdup(buf, GFP_KERNEL);
 713         if (!passwd)
 714                 return -ENOMEM;
 715
 716         /* Strip out CR if one is present */
 717         strip_cr(passwd);
 718
 719         /* Format: 'Password,Signature' */
 720         auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature);
 721         if (!auth_str) {
 722                 kfree_sensitive(passwd);
 723                 return -ENOMEM;
 724         }
 725         ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str);
 726         kfree(auth_str);
 727         kfree_sensitive(passwd);
 728
 729         return ret ?: count;
 730 }
 731
 732 static struct kobj_attribute auth_cert_to_password = __ATTR_WO(cert_to_password);
 733
 734 static ssize_t certificate_store(struct kobject *kobj,
 735                                   struct kobj_attribute *attr,
 736                                   const char *buf, size_t count)
 737 {
 738         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 739         char *auth_str, *new_cert;
 740         char *guid;
 741         int ret;
 742
 743         if (!capable(CAP_SYS_ADMIN))
 744                 return -EPERM;
 745
 746         if (!tlmi_priv.certificate_support)
 747                 return -EOPNOTSUPP;
 748
 749         /* If empty then clear installed certificate */
 750         if ((buf[0] == '\0') || (buf[0] == '\n')) { /* Clear installed certificate */
 751                 /* Check that signature is set */
 752                 if (!setting->signature || !setting->signature[0])
 753                         return -EACCES;
 754
 755                 /* Format: 'serial#, signature' */
 756                 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
 757                                 dmi_get_system_info(DMI_PRODUCT_SERIAL),
 758                                 setting->signature);
 759                 if (!auth_str)
 760                         return -ENOMEM;
 761
 762                 ret = tlmi_simple_call(LENOVO_CLEAR_BIOS_CERT_GUID, auth_str);
 763                 kfree(auth_str);
 764
 765                 return ret ?: count;
 766         }
 767
 768         new_cert = kstrdup(buf, GFP_KERNEL);
 769         if (!new_cert)
 770                 return -ENOMEM;
 771         /* Strip out CR if one is present */
 772         strip_cr(new_cert);
 773
 774         if (setting->cert_installed) {
 775                 /* Certificate is installed so this is an update */
 776                 if (!setting->signature || !setting->signature[0]) {
 777                         kfree(new_cert);
 778                         return -EACCES;
 779                 }
 780                 guid = LENOVO_UPDATE_BIOS_CERT_GUID;
 781                 /* Format: 'Certificate,Signature' */
 782                 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
 783                                 new_cert, setting->signature);
 784         } else {
 785                 /* This is a fresh install */
 786                 if (!setting->valid || !setting->password[0]) {
 787                         kfree(new_cert);
 788                         return -EACCES;
 789                 }
 790                 guid = LENOVO_SET_BIOS_CERT_GUID;
 791                 /* Format: 'Certificate,Admin-password' */
 792                 auth_str = kasprintf(GFP_KERNEL, "%s,%s",
 793                                 new_cert, setting->password);
 794         }
 795         kfree(new_cert);
 796         if (!auth_str)
 797                 return -ENOMEM;
 798
 799         ret = tlmi_simple_call(guid, auth_str);
 800         kfree(auth_str);
 801
 802         return ret ?: count;
 803 }
 804
 805 static struct kobj_attribute auth_certificate = __ATTR_WO(certificate);
 806
 807 static ssize_t signature_store(struct kobject *kobj,
 808                                   struct kobj_attribute *attr,
 809                                   const char *buf, size_t count)
 810 {
 811         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 812         char *new_signature;
 813
 814         if (!capable(CAP_SYS_ADMIN))
 815                 return -EPERM;
 816
 817         if (!tlmi_priv.certificate_support)
 818                 return -EOPNOTSUPP;
 819
 820         new_signature = kstrdup(buf, GFP_KERNEL);
 821         if (!new_signature)
 822                 return -ENOMEM;
 823
 824         /* Strip out CR if one is present */
 825         strip_cr(new_signature);
 826
 827         /* Free any previous signature */
 828         kfree(setting->signature);
 829         setting->signature = new_signature;
 830
 831         return count;
 832 }
 833
 834 static struct kobj_attribute auth_signature = __ATTR_WO(signature);
 835
 836 static ssize_t save_signature_store(struct kobject *kobj,
 837                                   struct kobj_attribute *attr,
 838                                   const char *buf, size_t count)
 839 {
 840         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 841         char *new_signature;
 842
 843         if (!capable(CAP_SYS_ADMIN))
 844                 return -EPERM;
 845
 846         if (!tlmi_priv.certificate_support)
 847                 return -EOPNOTSUPP;
 848
 849         new_signature = kstrdup(buf, GFP_KERNEL);
 850         if (!new_signature)
 851                 return -ENOMEM;
 852
 853         /* Strip out CR if one is present */
 854         strip_cr(new_signature);
 855
 856         /* Free any previous signature */
 857         kfree(setting->save_signature);
 858         setting->save_signature = new_signature;
 859
 860         return count;
 861 }
 862
 863 static struct kobj_attribute auth_save_signature = __ATTR_WO(save_signature);
 864
 865 static umode_t auth_attr_is_visible(struct kobject *kobj,
 866                                              struct attribute *attr, int n)
 867 {
 868         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
 869
 870         /* We only want to display level and index settings on HDD/NVMe */
 871         if (attr == &auth_index.attr || attr == &auth_level.attr) {
 872                 if ((setting == tlmi_priv.pwd_hdd) || (setting == tlmi_priv.pwd_nvme))
 873                         return attr->mode;
 874                 return 0;
 875         }
 876
 877         /* We only display certificates on Admin account, if supported */
 878         if (attr == &auth_certificate.attr ||
 879             attr == &auth_signature.attr ||
 880             attr == &auth_save_signature.attr ||
 881             attr == &auth_cert_thumb.attr ||
 882             attr == &auth_cert_to_password.attr) {
 883                 if ((setting == tlmi_priv.pwd_admin) && tlmi_priv.certificate_support)
 884                         return attr->mode;
 885                 return 0;
 886         }
 887
 888         /* Don't display un-needed settings if opcode available */
 889         if ((attr == &auth_encoding.attr || attr == &auth_kbdlang.attr) &&
 890             tlmi_priv.opcode_support)
 891                 return 0;
 892
 893         return attr->mode;
 894 }
 895
 896 static struct attribute *auth_attrs[] = {
 897         &auth_is_pass_set.attr,
 898         &auth_min_pass_length.attr,
 899         &auth_max_pass_length.attr,
 900         &auth_current_password.attr,
 901         &auth_new_password.attr,
 902         &auth_role.attr,
 903         &auth_mechanism.attr,
 904         &auth_encoding.attr,
 905         &auth_kbdlang.attr,
 906         &auth_index.attr,
 907         &auth_level.attr,
 908         &auth_certificate.attr,
 909         &auth_signature.attr,
 910         &auth_save_signature.attr,
 911         &auth_cert_thumb.attr,
 912         &auth_cert_to_password.attr,
 913         NULL
 914 };
 915
 916 static const struct attribute_group auth_attr_group = {
 917         .is_visible = auth_attr_is_visible,
 918         .attrs = auth_attrs,
 919 };
 920
 921 /* ---- Attributes sysfs --------------------------------------------------------- */
 922 static ssize_t display_name_show(struct kobject *kobj, struct kobj_attribute *attr,
 923                 char *buf)
 924 {
 925         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 926
 927         return sysfs_emit(buf, "%s\n", setting->display_name);
 928 }
 929
 930 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
 931 {
 932         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 933         char *item, *value, *p;
 934         int ret;
 935
 936         ret = tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID);
 937         if (ret)
 938                 return ret;
 939
 940         /* validate and split from `item,value` -> `value` */
 941         value = strpbrk(item, ",");
 942         if (!value || value == item || !strlen(value + 1))
 943                 ret = -EINVAL;
 944         else {
 945                 /* On Workstations remove the Options part after the value */
 946                 p = strchrnul(value, ';');
 947                 *p = '\0';
 948                 ret = sysfs_emit(buf, "%s\n", value + 1);
 949         }
 950         kfree(item);
 951
 952         return ret;
 953 }
 954
 955 static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
 956 {
 957         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 958
 959         return sysfs_emit(buf, "%s\n", setting->possible_values);
 960 }
 961
 962 static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
 963                 char *buf)
 964 {
 965         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 966
 967         if (setting->possible_values) {
 968                 /* Figure out what setting type is as BIOS does not return this */
 969                 if (strchr(setting->possible_values, ';'))
 970                         return sysfs_emit(buf, "enumeration\n");
 971         }
 972         /* Anything else is going to be a string */
 973         return sysfs_emit(buf, "string\n");
 974 }
 975
 976 static ssize_t current_value_store(struct kobject *kobj,
 977                 struct kobj_attribute *attr,
 978                 const char *buf, size_t count)
 979 {
 980         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 981         char *set_str = NULL, *new_setting = NULL;
 982         char *auth_str = NULL;
 983         int ret;
 984
 985         if (!tlmi_priv.can_set_bios_settings)
 986                 return -EOPNOTSUPP;
 987
 988         new_setting = kstrdup(buf, GFP_KERNEL);
 989         if (!new_setting)
 990                 return -ENOMEM;
 991
 992         /* Strip out CR if one is present */
 993         strip_cr(new_setting);
 994
 995         /* Use lock in case multiple WMI operations needed */
 996         mutex_lock(&tlmi_mutex);
 997
 998         /* Check if certificate authentication is enabled and active */
 999         if (tlmi_priv.certificate_support && tlmi_priv.pwd_admin->cert_installed) {
1000                 if (!tlmi_priv.pwd_admin->signature || !tlmi_priv.pwd_admin->save_signature) {
1001                         ret = -EINVAL;
1002                         goto out;
1003                 }
1004                 set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
1005                                         new_setting, tlmi_priv.pwd_admin->signature);
1006                 if (!set_str) {
1007                         ret = -ENOMEM;
1008                         goto out;
1009                 }
1010
1011                 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTING_CERT_GUID, set_str);
1012                 if (ret)
1013                         goto out;
1014                 ret = tlmi_simple_call(LENOVO_SAVE_BIOS_SETTING_CERT_GUID,
1015                                 tlmi_priv.pwd_admin->save_signature);
1016                 if (ret)
1017                         goto out;
1018         } else if (tlmi_priv.opcode_support) {
1019                 /*
1020                  * If opcode support is present use that interface.
1021                  * Note - this sets the variable and then the password as separate
1022                  * WMI calls. Function tlmi_save_bios_settings will error if the
1023                  * password is incorrect.
1024                  */
1025                 set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
1026                                     new_setting);
1027                 if (!set_str) {
1028                         ret = -ENOMEM;
1029                         goto out;
1030                 }
1031
1032                 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1033                 if (ret)
1034                         goto out;
1035
1036                 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1037                         ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
1038                                                   tlmi_priv.pwd_admin->password);
1039                         if (ret)
1040                                 goto out;
1041                 }
1042
1043                 ret = tlmi_save_bios_settings("");
1044         } else { /* old non-opcode based authentication method (deprecated) */
1045                 if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1046                         auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1047                                         tlmi_priv.pwd_admin->password,
1048                                         encoding_options[tlmi_priv.pwd_admin->encoding],
1049                                         tlmi_priv.pwd_admin->kbdlang);
1050                         if (!auth_str) {
1051                                 ret = -ENOMEM;
1052                                 goto out;
1053                         }
1054                 }
1055
1056                 if (auth_str)
1057                         set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
1058                                         new_setting, auth_str);
1059                 else
1060                         set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
1061                                         new_setting);
1062                 if (!set_str) {
1063                         ret = -ENOMEM;
1064                         goto out;
1065                 }
1066
1067                 ret = tlmi_simple_call(LENOVO_SET_BIOS_SETTINGS_GUID, set_str);
1068                 if (ret)
1069                         goto out;
1070
1071                 if (auth_str)
1072                         ret = tlmi_save_bios_settings(auth_str);
1073                 else
1074                         ret = tlmi_save_bios_settings("");
1075         }
1076         if (!ret && !tlmi_priv.pending_changes) {
1077                 tlmi_priv.pending_changes = true;
1078                 /* let userland know it may need to check reboot pending again */
1079                 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1080         }
1081 out:
1082         mutex_unlock(&tlmi_mutex);
1083         kfree(auth_str);
1084         kfree(set_str);
1085         kfree(new_setting);
1086         return ret ?: count;
1087 }
1088
1089 static struct kobj_attribute attr_displ_name = __ATTR_RO(display_name);
1090
1091 static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);
1092
1093 static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);
1094
1095 static struct kobj_attribute attr_type = __ATTR_RO(type);
1096
1097 static umode_t attr_is_visible(struct kobject *kobj,
1098                                              struct attribute *attr, int n)
1099 {
1100         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1101
1102         /* We don't want to display possible_values attributes if not available */
1103         if ((attr == &attr_possible_values.attr) && (!setting->possible_values))
1104                 return 0;
1105
1106         return attr->mode;
1107 }
1108
1109 static struct attribute *tlmi_attrs[] = {
1110         &attr_displ_name.attr,
1111         &attr_current_val.attr,
1112         &attr_possible_values.attr,
1113         &attr_type.attr,
1114         NULL
1115 };
1116
1117 static const struct attribute_group tlmi_attr_group = {
1118         .is_visible = attr_is_visible,
1119         .attrs = tlmi_attrs,
1120 };
1121
1122 static void tlmi_attr_setting_release(struct kobject *kobj)
1123 {
1124         struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
1125
1126         kfree(setting->possible_values);
1127         kfree(setting);
1128 }
1129
1130 static void tlmi_pwd_setting_release(struct kobject *kobj)
1131 {
1132         struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
1133
1134         kfree(setting);
1135 }
1136
1137 static const struct kobj_type tlmi_attr_setting_ktype = {
1138         .release        = &tlmi_attr_setting_release,
1139         .sysfs_ops      = &kobj_sysfs_ops,
1140 };
1141
1142 static const struct kobj_type tlmi_pwd_setting_ktype = {
1143         .release        = &tlmi_pwd_setting_release,
1144         .sysfs_ops      = &kobj_sysfs_ops,
1145 };
1146
1147 static ssize_t pending_reboot_show(struct kobject *kobj, struct kobj_attribute *attr,
1148                                    char *buf)
1149 {
1150         return sprintf(buf, "%d\n", tlmi_priv.pending_changes);
1151 }
1152
1153 static struct kobj_attribute pending_reboot = __ATTR_RO(pending_reboot);
1154
1155 /* ---- Debug interface--------------------------------------------------------- */
1156 static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr,
1157                                 const char *buf, size_t count)
1158 {
1159         char *set_str = NULL, *new_setting = NULL;
1160         char *auth_str = NULL;
1161         int ret;
1162
1163         if (!tlmi_priv.can_debug_cmd)
1164                 return -EOPNOTSUPP;
1165
1166         new_setting = kstrdup(buf, GFP_KERNEL);
1167         if (!new_setting)
1168                 return -ENOMEM;
1169
1170         /* Strip out CR if one is present */
1171         strip_cr(new_setting);
1172
1173         if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
1174                 auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
1175                                 tlmi_priv.pwd_admin->password,
1176                                 encoding_options[tlmi_priv.pwd_admin->encoding],
1177                                 tlmi_priv.pwd_admin->kbdlang);
1178                 if (!auth_str) {
1179                         ret = -ENOMEM;
1180                         goto out;
1181                 }
1182         }
1183
1184         if (auth_str)
1185                 set_str = kasprintf(GFP_KERNEL, "%s,%s", new_setting, auth_str);
1186         else
1187                 set_str = kasprintf(GFP_KERNEL, "%s;", new_setting);
1188         if (!set_str) {
1189                 ret = -ENOMEM;
1190                 goto out;
1191         }
1192
1193         ret = tlmi_simple_call(LENOVO_DEBUG_CMD_GUID, set_str);
1194         if (ret)
1195                 goto out;
1196
1197         if (!ret && !tlmi_priv.pending_changes) {
1198                 tlmi_priv.pending_changes = true;
1199                 /* let userland know it may need to check reboot pending again */
1200                 kobject_uevent(&tlmi_priv.class_dev->kobj, KOBJ_CHANGE);
1201         }
1202 out:
1203         kfree(auth_str);
1204         kfree(set_str);
1205         kfree(new_setting);
1206         return ret ?: count;
1207 }
1208
1209 static struct kobj_attribute debug_cmd = __ATTR_WO(debug_cmd);
1210
1211 /* ---- Initialisation --------------------------------------------------------- */
1212 static void tlmi_release_attr(void)
1213 {
1214         int i;
1215
1216         /* Attribute structures */
1217         for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1218                 if (tlmi_priv.setting[i]) {
1219                         sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
1220                         kobject_put(&tlmi_priv.setting[i]->kobj);
1221                 }
1222         }
1223         sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1224         if (tlmi_priv.can_debug_cmd && debug_support)
1225                 sysfs_remove_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1226
1227         kset_unregister(tlmi_priv.attribute_kset);
1228
1229         /* Free up any saved signatures */
1230         kfree(tlmi_priv.pwd_admin->signature);
1231         kfree(tlmi_priv.pwd_admin->save_signature);
1232
1233         /* Authentication structures */
1234         sysfs_remove_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
1235         kobject_put(&tlmi_priv.pwd_admin->kobj);
1236         sysfs_remove_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
1237         kobject_put(&tlmi_priv.pwd_power->kobj);
1238
1239         if (tlmi_priv.opcode_support) {
1240                 sysfs_remove_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
1241                 kobject_put(&tlmi_priv.pwd_system->kobj);
1242                 sysfs_remove_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
1243                 kobject_put(&tlmi_priv.pwd_hdd->kobj);
1244                 sysfs_remove_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
1245                 kobject_put(&tlmi_priv.pwd_nvme->kobj);
1246         }
1247
1248         kset_unregister(tlmi_priv.authentication_kset);
1249 }
1250
1251 static int tlmi_sysfs_init(void)
1252 {
1253         int i, ret;
1254
1255         ret = fw_attributes_class_get(&fw_attr_class);
1256         if (ret)
1257                 return ret;
1258
1259         tlmi_priv.class_dev = device_create(fw_attr_class, NULL, MKDEV(0, 0),
1260                         NULL, "%s", "thinklmi");
1261         if (IS_ERR(tlmi_priv.class_dev)) {
1262                 ret = PTR_ERR(tlmi_priv.class_dev);
1263                 goto fail_class_created;
1264         }
1265
1266         tlmi_priv.attribute_kset = kset_create_and_add("attributes", NULL,
1267                         &tlmi_priv.class_dev->kobj);
1268         if (!tlmi_priv.attribute_kset) {
1269                 ret = -ENOMEM;
1270                 goto fail_device_created;
1271         }
1272
1273         for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
1274                 /* Check if index is a valid setting - skip if it isn't */
1275                 if (!tlmi_priv.setting[i])
1276                         continue;
1277
1278                 /* check for duplicate or reserved values */
1279                 if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->display_name) ||
1280                     !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) {
1281                         pr_debug("duplicate or reserved attribute name found - %s\n",
1282                                 tlmi_priv.setting[i]->display_name);
1283                         kfree(tlmi_priv.setting[i]->possible_values);
1284                         kfree(tlmi_priv.setting[i]);
1285                         tlmi_priv.setting[i] = NULL;
1286                         continue;
1287                 }
1288
1289                 /* Build attribute */
1290                 tlmi_priv.setting[i]->kobj.kset = tlmi_priv.attribute_kset;
1291                 ret = kobject_add(&tlmi_priv.setting[i]->kobj, NULL,
1292                                   "%s", tlmi_priv.setting[i]->display_name);
1293                 if (ret)
1294                         goto fail_create_attr;
1295
1296                 ret = sysfs_create_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
1297                 if (ret)
1298                         goto fail_create_attr;
1299         }
1300
1301         ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &pending_reboot.attr);
1302         if (ret)
1303                 goto fail_create_attr;
1304
1305         if (tlmi_priv.can_debug_cmd && debug_support) {
1306                 ret = sysfs_create_file(&tlmi_priv.attribute_kset->kobj, &debug_cmd.attr);
1307                 if (ret)
1308                         goto fail_create_attr;
1309         }
1310
1311         /* Create authentication entries */
1312         tlmi_priv.authentication_kset = kset_create_and_add("authentication", NULL,
1313                                                                 &tlmi_priv.class_dev->kobj);
1314         if (!tlmi_priv.authentication_kset) {
1315                 ret = -ENOMEM;
1316                 goto fail_create_attr;
1317         }
1318         tlmi_priv.pwd_admin->kobj.kset = tlmi_priv.authentication_kset;
1319         ret = kobject_add(&tlmi_priv.pwd_admin->kobj, NULL, "%s", "Admin");
1320         if (ret)
1321                 goto fail_create_attr;
1322
1323         ret = sysfs_create_group(&tlmi_priv.pwd_admin->kobj, &auth_attr_group);
1324         if (ret)
1325                 goto fail_create_attr;
1326
1327         tlmi_priv.pwd_power->kobj.kset = tlmi_priv.authentication_kset;
1328         ret = kobject_add(&tlmi_priv.pwd_power->kobj, NULL, "%s", "Power-on");
1329         if (ret)
1330                 goto fail_create_attr;
1331
1332         ret = sysfs_create_group(&tlmi_priv.pwd_power->kobj, &auth_attr_group);
1333         if (ret)
1334                 goto fail_create_attr;
1335
1336         if (tlmi_priv.opcode_support) {
1337                 tlmi_priv.pwd_system->kobj.kset = tlmi_priv.authentication_kset;
1338                 ret = kobject_add(&tlmi_priv.pwd_system->kobj, NULL, "%s", "System");
1339                 if (ret)
1340                         goto fail_create_attr;
1341
1342                 ret = sysfs_create_group(&tlmi_priv.pwd_system->kobj, &auth_attr_group);
1343                 if (ret)
1344                         goto fail_create_attr;
1345
1346                 tlmi_priv.pwd_hdd->kobj.kset = tlmi_priv.authentication_kset;
1347                 ret = kobject_add(&tlmi_priv.pwd_hdd->kobj, NULL, "%s", "HDD");
1348                 if (ret)
1349                         goto fail_create_attr;
1350
1351                 ret = sysfs_create_group(&tlmi_priv.pwd_hdd->kobj, &auth_attr_group);
1352                 if (ret)
1353                         goto fail_create_attr;
1354
1355                 tlmi_priv.pwd_nvme->kobj.kset = tlmi_priv.authentication_kset;
1356                 ret = kobject_add(&tlmi_priv.pwd_nvme->kobj, NULL, "%s", "NVMe");
1357                 if (ret)
1358                         goto fail_create_attr;
1359
1360                 ret = sysfs_create_group(&tlmi_priv.pwd_nvme->kobj, &auth_attr_group);
1361                 if (ret)
1362                         goto fail_create_attr;
1363         }
1364
1365         return ret;
1366
1367 fail_create_attr:
1368         tlmi_release_attr();
1369 fail_device_created:
1370         device_destroy(fw_attr_class, MKDEV(0, 0));
1371 fail_class_created:
1372         fw_attributes_class_put();
1373         return ret;
1374 }
1375
1376 /* ---- Base Driver -------------------------------------------------------- */
1377 static struct tlmi_pwd_setting *tlmi_create_auth(const char *pwd_type,
1378                             const char *pwd_role)
1379 {
1380         struct tlmi_pwd_setting *new_pwd;
1381
1382         new_pwd = kzalloc(sizeof(struct tlmi_pwd_setting), GFP_KERNEL);
1383         if (!new_pwd)
1384                 return NULL;
1385
1386         strscpy(new_pwd->kbdlang, "us", TLMI_LANG_MAXLEN);
1387         new_pwd->encoding = TLMI_ENCODING_ASCII;
1388         new_pwd->pwd_type = pwd_type;
1389         new_pwd->role = pwd_role;
1390         new_pwd->minlen = tlmi_priv.pwdcfg.core.min_length;
1391         new_pwd->maxlen = tlmi_priv.pwdcfg.core.max_length;
1392         new_pwd->index = 0;
1393
1394         kobject_init(&new_pwd->kobj, &tlmi_pwd_setting_ktype);
1395
1396         return new_pwd;
1397 }
1398
1399 static int tlmi_analyze(void)
1400 {
1401         int i, ret;
1402
1403         if (wmi_has_guid(LENOVO_SET_BIOS_SETTINGS_GUID) &&
1404             wmi_has_guid(LENOVO_SAVE_BIOS_SETTINGS_GUID))
1405                 tlmi_priv.can_set_bios_settings = true;
1406
1407         if (wmi_has_guid(LENOVO_GET_BIOS_SELECTIONS_GUID))
1408                 tlmi_priv.can_get_bios_selections = true;
1409
1410         if (wmi_has_guid(LENOVO_SET_BIOS_PASSWORD_GUID))
1411                 tlmi_priv.can_set_bios_password = true;
1412
1413         if (wmi_has_guid(LENOVO_BIOS_PASSWORD_SETTINGS_GUID))
1414                 tlmi_priv.can_get_password_settings = true;
1415
1416         if (wmi_has_guid(LENOVO_DEBUG_CMD_GUID))
1417                 tlmi_priv.can_debug_cmd = true;
1418
1419         if (wmi_has_guid(LENOVO_OPCODE_IF_GUID))
1420                 tlmi_priv.opcode_support = true;
1421
1422         if (wmi_has_guid(LENOVO_SET_BIOS_CERT_GUID) &&
1423                 wmi_has_guid(LENOVO_SET_BIOS_SETTING_CERT_GUID) &&
1424                 wmi_has_guid(LENOVO_SAVE_BIOS_SETTING_CERT_GUID))
1425                 tlmi_priv.certificate_support = true;
1426
1427         /*
1428          * Try to find the number of valid settings of this machine
1429          * and use it to create sysfs attributes.
1430          */
1431         for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1432                 struct tlmi_attr_setting *setting;
1433                 char *item = NULL;
1434                 char *p;
1435
1436                 tlmi_priv.setting[i] = NULL;
1437                 ret = tlmi_setting(i, &item, LENOVO_BIOS_SETTING_GUID);
1438                 if (ret)
1439                         break;
1440                 if (!item)
1441                         break;
1442                 if (!*item) {
1443                         kfree(item);
1444                         continue;
1445                 }
1446
1447                 /* It is not allowed to have '/' for file name. Convert it into '\'. */
1448                 strreplace(item, '/', '\\');
1449
1450                 /* Remove the value part */
1451                 p = strchrnul(item, ',');
1452                 *p = '\0';
1453
1454                 /* Create a setting entry */
1455                 setting = kzalloc(sizeof(*setting), GFP_KERNEL);
1456                 if (!setting) {
1457                         ret = -ENOMEM;
1458                         kfree(item);
1459                         goto fail_clear_attr;
1460                 }
1461                 setting->index = i;
1462                 strscpy(setting->display_name, item, TLMI_SETTINGS_MAXLEN);
1463                 /* If BIOS selections supported, load those */
1464                 if (tlmi_priv.can_get_bios_selections) {
1465                         ret = tlmi_get_bios_selections(setting->display_name,
1466                                         &setting->possible_values);
1467                         if (ret || !setting->possible_values)
1468                                 pr_info("Error retrieving possible values for %d : %s\n",
1469                                                 i, setting->display_name);
1470                 } else {
1471                         /*
1472                          * Older Thinkstations don't support the bios_selections API.
1473                          * Instead they store this as a [Optional:Option1,Option2] section of the
1474                          * name string.
1475                          * Try and pull that out if it's available.
1476                          */
1477                         char *optitem, *optstart, *optend;
1478
1479                         if (!tlmi_setting(setting->index, &optitem, LENOVO_BIOS_SETTING_GUID)) {
1480                                 optstart = strstr(optitem, "[Optional:");
1481                                 if (optstart) {
1482                                         optstart += strlen("[Optional:");
1483                                         optend = strstr(optstart, "]");
1484                                         if (optend)
1485                                                 setting->possible_values =
1486                                                         kstrndup(optstart, optend - optstart,
1487                                                                         GFP_KERNEL);
1488                                 }
1489                                 kfree(optitem);
1490                         }
1491                 }
1492                 /*
1493                  * firmware-attributes requires that possible_values are separated by ';' but
1494                  * Lenovo FW uses ','. Replace appropriately.
1495                  */
1496                 if (setting->possible_values)
1497                         strreplace(setting->possible_values, ',', ';');
1498
1499                 kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
1500                 tlmi_priv.setting[i] = setting;
1501                 kfree(item);
1502         }
1503
1504         /* Create password setting structure */
1505         ret = tlmi_get_pwd_settings(&tlmi_priv.pwdcfg);
1506         if (ret)
1507                 goto fail_clear_attr;
1508
1509         /* All failures below boil down to kmalloc failures */
1510         ret = -ENOMEM;
1511
1512         tlmi_priv.pwd_admin = tlmi_create_auth("pap", "bios-admin");
1513         if (!tlmi_priv.pwd_admin)
1514                 goto fail_clear_attr;
1515
1516         if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)
1517                 tlmi_priv.pwd_admin->valid = true;
1518
1519         tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");
1520         if (!tlmi_priv.pwd_power)
1521                 goto fail_clear_attr;
1522
1523         if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)
1524                 tlmi_priv.pwd_power->valid = true;
1525
1526         if (tlmi_priv.opcode_support) {
1527                 tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
1528                 if (!tlmi_priv.pwd_system)
1529                         goto fail_clear_attr;
1530
1531                 if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
1532                         tlmi_priv.pwd_system->valid = true;
1533
1534                 tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
1535                 if (!tlmi_priv.pwd_hdd)
1536                         goto fail_clear_attr;
1537
1538                 tlmi_priv.pwd_nvme = tlmi_create_auth("nvm", "nvme");
1539                 if (!tlmi_priv.pwd_nvme)
1540                         goto fail_clear_attr;
1541
1542                 /* Set default hdd/nvme index to 1 as there is no device 0 */
1543                 tlmi_priv.pwd_hdd->index = 1;
1544                 tlmi_priv.pwd_nvme->index = 1;
1545
1546                 if (tlmi_priv.pwdcfg.core.password_state & TLMI_HDD_PWD) {
1547                         /* Check if PWD is configured and set index to first drive found */
1548                         if (tlmi_priv.pwdcfg.ext.hdd_user_password ||
1549                                         tlmi_priv.pwdcfg.ext.hdd_master_password) {
1550                                 tlmi_priv.pwd_hdd->valid = true;
1551                                 if (tlmi_priv.pwdcfg.ext.hdd_master_password)
1552                                         tlmi_priv.pwd_hdd->index =
1553                                                 ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;
1554                                 else
1555                                         tlmi_priv.pwd_hdd->index =
1556                                                 ffs(tlmi_priv.pwdcfg.ext.hdd_user_password) - 1;
1557                         }
1558                         if (tlmi_priv.pwdcfg.ext.nvme_user_password ||
1559                                         tlmi_priv.pwdcfg.ext.nvme_master_password) {
1560                                 tlmi_priv.pwd_nvme->valid = true;
1561                                 if (tlmi_priv.pwdcfg.ext.nvme_master_password)
1562                                         tlmi_priv.pwd_nvme->index =
1563                                                 ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;
1564                                 else
1565                                         tlmi_priv.pwd_nvme->index =
1566                                                 ffs(tlmi_priv.pwdcfg.ext.nvme_user_password) - 1;
1567                         }
1568                 }
1569         }
1570
1571         if (tlmi_priv.certificate_support &&
1572                 (tlmi_priv.pwdcfg.core.password_state & TLMI_CERT))
1573                 tlmi_priv.pwd_admin->cert_installed = true;
1574
1575         return 0;
1576
1577 fail_clear_attr:
1578         for (i = 0; i < TLMI_SETTINGS_COUNT; ++i) {
1579                 if (tlmi_priv.setting[i]) {
1580                         kfree(tlmi_priv.setting[i]->possible_values);
1581                         kfree(tlmi_priv.setting[i]);
1582                 }
1583         }
1584         kfree(tlmi_priv.pwd_admin);
1585         kfree(tlmi_priv.pwd_power);
1586         kfree(tlmi_priv.pwd_system);
1587         kfree(tlmi_priv.pwd_hdd);
1588         kfree(tlmi_priv.pwd_nvme);
1589         return ret;
1590 }
1591
1592 static void tlmi_remove(struct wmi_device *wdev)
1593 {
1594         tlmi_release_attr();
1595         device_destroy(fw_attr_class, MKDEV(0, 0));
1596         fw_attributes_class_put();
1597 }
1598
1599 static int tlmi_probe(struct wmi_device *wdev, const void *context)
1600 {
1601         int ret;
1602
1603         ret = tlmi_analyze();
1604         if (ret)
1605                 return ret;
1606
1607         return tlmi_sysfs_init();
1608 }
1609
1610 static const struct wmi_device_id tlmi_id_table[] = {
1611         { .guid_string = LENOVO_BIOS_SETTING_GUID },
1612         { }
1613 };
1614 MODULE_DEVICE_TABLE(wmi, tlmi_id_table);
1615
1616 static struct wmi_driver tlmi_driver = {
1617         .driver = {
1618                 .name = "think-lmi",
1619         },
1620         .id_table = tlmi_id_table,
1621         .probe = tlmi_probe,
1622         .remove = tlmi_remove,
1623 };
1624
1625 MODULE_AUTHOR("Sugumaran L <slacshiminar@lenovo.com>");
1626 MODULE_AUTHOR("Mark Pearson <markpearson@lenovo.com>");
1627 MODULE_AUTHOR("Corentin Chary <corentin.chary@gmail.com>");
1628 MODULE_DESCRIPTION("ThinkLMI Driver");
1629 MODULE_LICENSE("GPL");
1630
1631 module_wmi_driver(tlmi_driver);