From: Eric Dong <eric.dong@intel.com>
Date: Wed, 11 May 2016 02:36:05 +0000 (+0800)
Subject: SecurityPkg OpalPasswordDxe: Error handling enhance when input password.
X-Git-Tag: edk2-stable201903~7083
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=72a05f849f18b48586f3103c7457b8d07a02c7dd;p=mirror_edk2.git

SecurityPkg OpalPasswordDxe: Error handling enhance when input password.

Enhance the error handling:
1. When the device is unlocked at BIOS phase and system does a warm reboot,
the device may be still in unlock status if it uses external power. For
such case, we would still popup password window to ask user input. If
user presses ESC key here, we would force the system shut down or ask
user input again to avoid security hole.
2. When user reach max retry count, force shutdown.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
---

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
index 7c6deb8f39..3764b24344 100644
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
@@ -263,6 +263,7 @@ OpalDriverRequestPassword (
   EFI_INPUT_KEY       Key;
   OPAL_SESSION        Session;
   BOOLEAN             PressEsc;
+  BOOLEAN             Locked;
 
   if (Dev == NULL) {
     return;
@@ -277,33 +278,61 @@ OpalDriverRequestPassword (
     Session.MediaId = Dev->OpalDisk.MediaId;
     Session.OpalBaseComId = Dev->OpalDisk.OpalBaseComId;
 
+    Locked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature);
+
     while (Count < MAX_PASSWORD_TRY_COUNT) {
       Password = OpalDriverPopUpHddPassword (Dev, &PressEsc);
       if (PressEsc) {
-        //
-        // User not input password and press ESC, keep device in lock status and continue boot.
-        //
-        do {
-          CreatePopUp (
-                  EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
-                  &Key,
-                  L"Confirm: Not unlock device and continue boot?.",
-                  L"Press ENTER to confirm, Press Esc to input password",
-                  NULL
-                  );
-        } while ((Key.ScanCode != SCAN_ESC) && (Key.UnicodeChar != CHAR_CARRIAGE_RETURN));
-
-        if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {
-          gST->ConOut->ClearScreen(gST->ConOut);
+        if (Locked) {
           //
-          // Keep lock and continue boot.
+          // Current device in the lock status and
+          // User not input password and press ESC,
+          // keep device in lock status and continue boot.
           //
-          return;
+          do {
+            CreatePopUp (
+                    EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+                    &Key,
+                    L"Press ENTER to skip password, Press ESC to input password",
+                    NULL
+                    );
+          } while ((Key.ScanCode != SCAN_ESC) && (Key.UnicodeChar != CHAR_CARRIAGE_RETURN));
+
+          if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {
+            gST->ConOut->ClearScreen(gST->ConOut);
+            //
+            // Keep lock and continue boot.
+            //
+            return;
+          } else {
+            //
+            // Let user input password again.
+            //
+            continue;
+          }
         } else {
           //
-          // Let user input password again.
+          // Current device in the unlock status and
+          // User not input password and press ESC,
+          // Shutdown the device.
           //
-          continue;
+          do {
+            CreatePopUp (
+                    EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+                    &Key,
+                    L"Press ENTER to shutdown, Press ESC to input password",
+                    NULL
+                    );
+          } while ((Key.ScanCode != SCAN_ESC) && (Key.UnicodeChar != CHAR_CARRIAGE_RETURN));
+
+          if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {
+            gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);
+          } else {
+            //
+            // Let user input password again.
+            //
+            continue;
+          }
         }
       }
 
@@ -313,7 +342,7 @@ OpalDriverRequestPassword (
       }
       PasswordLen = (UINT32) AsciiStrLen(Password);
 
-      if (OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature)) {
+      if (Locked) {
         Ret = OpalSupportUnlock(&Session, Password, PasswordLen, Dev->OpalDevicePath);
       } else {
         Ret = OpalSupportLock(&Session, Password, PasswordLen, Dev->OpalDevicePath);
@@ -349,12 +378,13 @@ OpalDriverRequestPassword (
         CreatePopUp (
                 EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
                 &Key,
-                L"Opal password retry count is expired. Keep lock and continue boot.",
-                L"Press ENTER to continue",
+                L"Opal password retry count exceeds the limit. Must shutdown!",
+                L"Press ENTER to shutdown",
                 NULL
                 );
       } while (Key.UnicodeChar != CHAR_CARRIAGE_RETURN);
-      gST->ConOut->ClearScreen(gST->ConOut);
+
+      gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);
     }
   }
 }