From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: "Mark Pearson" <mpearson-lenovo@squebb.ca>,
"Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>,
"Sasha Levin" <sashal@kernel.org>
Subject: [PATCH 6.6.y 1/2] platform/x86: think-lmi: improve check if BIOS account security enabled
Date: Wed, 9 Sep 2026 11:12:36 -0400 [thread overview]
Message-ID: <20260909151237.2839173-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090326-unmixable-concur-5982@gregkh>
From: Mark Pearson <mpearson-lenovo@squebb.ca>
[ Upstream commit b39e8ece931a4b4f64cdf9e75fffd6e82828e471 ]
Improve determination of whether authentication account is enabled by
checking if either password or certificate is enabled.
Renamed valid to pwd_enabled for better readability.
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://lore.kernel.org/r/20241024195536.6992-1-mpearson-lenovo@squebb.ca
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Backport to 6.6: omit the password-field updates in save_settings_store(),
because this tree has no bulk-save interface. Preserve the existing
strip_cr() handling in debug_cmd_store().
Prepare for commit 4f3183f5ae9b ("platform/x86: think-lmi: Fix certificate
thumbprint sysfs output") by carrying over only the thumbprint iteration
from commit 5dcb5ef125907 ("platform/x86: think-lmi: Multi-certificate
support"), along with its array-size include and password-mode constant.
Keep the existing single-certificate command format for older firmware and
use the upstream certificate selector for multi-certificate firmware.
Leave the count and error-handling correction to the target commit. No
functions are added.
Stable-dep-of: 4f3183f5ae9b ("platform/x86: think-lmi: Fix certificate thumbprint sysfs output")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/think-lmi.c | 46 ++++++++++++++++++++++----------
drivers/platform/x86/think-lmi.h | 4 ++-
2 files changed, 35 insertions(+), 15 deletions(-)
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index d5319b4637e18..9b048ca18d006 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -12,6 +12,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/acpi.h>
+#include <linux/array_size.h>
#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/mutex.h>
@@ -391,7 +392,7 @@ static ssize_t is_enabled_show(struct kobject *kobj, struct kobj_attribute *attr
{
struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
- return sysfs_emit(buf, "%d\n", setting->valid);
+ return sysfs_emit(buf, "%d\n", setting->pwd_enabled || setting->cert_installed);
}
static struct kobj_attribute auth_is_pass_set = __ATTR_RO(is_enabled);
@@ -471,7 +472,7 @@ static ssize_t new_password_store(struct kobject *kobj,
if (ret)
goto out;
- if (tlmi_priv.pwd_admin->valid) {
+ if (tlmi_priv.pwd_admin->pwd_enabled) {
ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
tlmi_priv.pwd_admin->password);
if (ret)
@@ -671,18 +672,35 @@ static ssize_t cert_thumbprint(char *buf, const char *arg, int count)
return count;
}
+static const char * const thumbtypes[] = { "Md5", "Sha1", "Sha256" };
+
static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_attribute *attr,
char *buf)
{
struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
+ unsigned int i;
int count = 0;
+ char *wmistr;
if (!tlmi_priv.certificate_support || !setting->cert_installed)
return -EOPNOTSUPP;
- count += cert_thumbprint(buf, "Md5", count);
- count += cert_thumbprint(buf, "Sha1", count);
- count += cert_thumbprint(buf, "Sha256", count);
+ for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
+ if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) {
+ /* Format: 'SVC | SMC, Thumbtype' */
+ wmistr = kasprintf(GFP_KERNEL, "%s,%s",
+ setting == tlmi_priv.pwd_admin ? "SVC" : "SMC",
+ thumbtypes[i]);
+ } else {
+ /* Format: 'Thumbtype' */
+ wmistr = kasprintf(GFP_KERNEL, "%s", thumbtypes[i]);
+ }
+ if (!wmistr)
+ return -ENOMEM;
+ count += cert_thumbprint(buf, wmistr, count);
+ kfree(wmistr);
+ }
+
return count;
}
@@ -782,7 +800,7 @@ static ssize_t certificate_store(struct kobject *kobj,
new_cert, setting->signature);
} else {
/* This is a fresh install */
- if (!setting->valid || !setting->password[0]) {
+ if (!setting->pwd_enabled || !setting->password[0]) {
kfree(new_cert);
return -EACCES;
}
@@ -1024,7 +1042,7 @@ static ssize_t current_value_store(struct kobject *kobj,
* Workstation's require the opcode to be set before changing the
* attribute.
*/
- if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
+ if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
ret = tlmi_opcode_setting("WmiOpcodePasswordAdmin",
tlmi_priv.pwd_admin->password);
if (ret)
@@ -1044,7 +1062,7 @@ static ssize_t current_value_store(struct kobject *kobj,
ret = tlmi_save_bios_settings("");
} else { /* old non-opcode based authentication method (deprecated) */
- if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
+ if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
tlmi_priv.pwd_admin->password,
encoding_options[tlmi_priv.pwd_admin->encoding],
@@ -1175,7 +1193,7 @@ static ssize_t debug_cmd_store(struct kobject *kobj, struct kobj_attribute *attr
/* Strip out CR if one is present */
strip_cr(new_setting);
- if (tlmi_priv.pwd_admin->valid && tlmi_priv.pwd_admin->password[0]) {
+ if (tlmi_priv.pwd_admin->pwd_enabled && tlmi_priv.pwd_admin->password[0]) {
auth_str = kasprintf(GFP_KERNEL, "%s,%s,%s;",
tlmi_priv.pwd_admin->password,
encoding_options[tlmi_priv.pwd_admin->encoding],
@@ -1496,14 +1514,14 @@ static int tlmi_analyze(void)
goto fail_clear_attr;
if (tlmi_priv.pwdcfg.core.password_state & TLMI_PAP_PWD)
- tlmi_priv.pwd_admin->valid = true;
+ tlmi_priv.pwd_admin->pwd_enabled = true;
tlmi_priv.pwd_power = tlmi_create_auth("pop", "power-on");
if (!tlmi_priv.pwd_power)
goto fail_clear_attr;
if (tlmi_priv.pwdcfg.core.password_state & TLMI_POP_PWD)
- tlmi_priv.pwd_power->valid = true;
+ tlmi_priv.pwd_power->pwd_enabled = true;
if (tlmi_priv.opcode_support) {
tlmi_priv.pwd_system = tlmi_create_auth("smp", "system");
@@ -1511,7 +1529,7 @@ static int tlmi_analyze(void)
goto fail_clear_attr;
if (tlmi_priv.pwdcfg.core.password_state & TLMI_SMP_PWD)
- tlmi_priv.pwd_system->valid = true;
+ tlmi_priv.pwd_system->pwd_enabled = true;
tlmi_priv.pwd_hdd = tlmi_create_auth("hdd", "hdd");
if (!tlmi_priv.pwd_hdd)
@@ -1529,7 +1547,7 @@ static int tlmi_analyze(void)
/* Check if PWD is configured and set index to first drive found */
if (tlmi_priv.pwdcfg.ext.hdd_user_password ||
tlmi_priv.pwdcfg.ext.hdd_master_password) {
- tlmi_priv.pwd_hdd->valid = true;
+ tlmi_priv.pwd_hdd->pwd_enabled = true;
if (tlmi_priv.pwdcfg.ext.hdd_master_password)
tlmi_priv.pwd_hdd->index =
ffs(tlmi_priv.pwdcfg.ext.hdd_master_password) - 1;
@@ -1539,7 +1557,7 @@ static int tlmi_analyze(void)
}
if (tlmi_priv.pwdcfg.ext.nvme_user_password ||
tlmi_priv.pwdcfg.ext.nvme_master_password) {
- tlmi_priv.pwd_nvme->valid = true;
+ tlmi_priv.pwd_nvme->pwd_enabled = true;
if (tlmi_priv.pwdcfg.ext.nvme_master_password)
tlmi_priv.pwd_nvme->index =
ffs(tlmi_priv.pwdcfg.ext.nvme_master_password) - 1;
diff --git a/drivers/platform/x86/think-lmi.h b/drivers/platform/x86/think-lmi.h
index 4daba6151cd67..69e8a9bcdb710 100644
--- a/drivers/platform/x86/think-lmi.h
+++ b/drivers/platform/x86/think-lmi.h
@@ -28,6 +28,8 @@ enum level_option {
};
/* password configuration details */
+#define TLMI_PWDCFG_MODE_MULTICERT 3
+
struct tlmi_pwdcfg_core {
uint32_t password_mode;
uint32_t password_state;
@@ -52,7 +54,7 @@ struct tlmi_pwdcfg {
/* password setting details */
struct tlmi_pwd_setting {
struct kobject kobj;
- bool valid;
+ bool pwd_enabled;
char password[TLMI_PWD_BUFSIZE];
const char *pwd_type;
const char *role;
--
2.53.0
next prev parent reply other threads:[~2026-09-09 15:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 14:49 FAILED: patch "[PATCH] platform/x86: think-lmi: Fix certificate thumbprint sysfs" failed to apply to 6.6-stable tree gregkh
2026-09-09 15:12 ` Sasha Levin [this message]
2026-09-09 15:12 ` [PATCH 6.6.y 2/2] platform/x86: think-lmi: Fix certificate thumbprint sysfs output Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260909151237.2839173-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=mpearson-lenovo@squebb.ca \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox