MdeModulePkg/Bus/Ata/AhciPei/AhciPeiStorageSecurity.c

   1 /** @file
   2   The AhciPei driver is used to manage ATA hard disk device working under AHCI
   3   mode at PEI phase.
   4
   5   Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
   6
   7   This program and the accompanying materials
   8   are licensed and made available under the terms and conditions
   9   of the BSD License which accompanies this distribution.  The
  10   full text of the license may be found at
  11   http://opensource.org/licenses/bsd-license.php
  12
  13   THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  14   WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  15
  16 **/
  17
  18 #include "AhciPei.h"
  19
  20 /**
  21   Traverse the attached ATA devices list to find out the device with given trust
  22   computing device index.
  23
  24   @param[in] Private                      A pointer to the PEI_AHCI_CONTROLLER_PRIVATE_DATA
  25                                           instance.
  26   @param[in] TrustComputingDeviceIndex    The trust computing device index.
  27
  28   @retval    The pointer to the PEI_AHCI_ATA_DEVICE_DATA structure of the device
  29              info to access.
  30
  31 **/
  32 PEI_AHCI_ATA_DEVICE_DATA *
  33 SearchTrustComputingDeviceByIndex (
  34   IN PEI_AHCI_CONTROLLER_PRIVATE_DATA    *Private,
  35   IN UINTN                               TrustComputingDeviceIndex
  36   )
  37 {
  38   PEI_AHCI_ATA_DEVICE_DATA    *DeviceData;
  39   LIST_ENTRY                  *Node;
  40
  41   Node = GetFirstNode (&Private->DeviceList);
  42   while (!IsNull (&Private->DeviceList, Node)) {
  43     DeviceData = AHCI_PEI_ATA_DEVICE_INFO_FROM_THIS (Node);
  44
  45     if (DeviceData->TrustComputingDeviceIndex == TrustComputingDeviceIndex) {
  46       return DeviceData;
  47     }
  48
  49     Node = GetNextNode (&Private->DeviceList, Node);
  50   }
  51
  52   return NULL;
  53 }
  54
  55 /**
  56   Gets the count of storage security devices that one specific driver detects.
  57
  58   @param[in]  This               The PPI instance pointer.
  59   @param[out] NumberofDevices    The number of storage security devices discovered.
  60
  61   @retval EFI_SUCCESS              The operation performed successfully.
  62   @retval EFI_INVALID_PARAMETER    The parameters are invalid.
  63
  64 **/
  65 EFI_STATUS
  66 EFIAPI
  67 AhciStorageSecurityGetDeviceNo (
  68   IN  EDKII_PEI_STORAGE_SECURITY_CMD_PPI    *This,
  69   OUT UINTN                                 *NumberofDevices
  70   )
  71 {
  72   PEI_AHCI_CONTROLLER_PRIVATE_DATA    *Private;
  73
  74   if (This == NULL || NumberofDevices == NULL) {
  75     return EFI_INVALID_PARAMETER;
  76   }
  77
  78   Private = GET_AHCI_PEIM_HC_PRIVATE_DATA_FROM_THIS_STROAGE_SECURITY (This);
  79   *NumberofDevices = Private->TrustComputingDevices;
  80
  81   return EFI_SUCCESS;
  82 }
  83
  84 /**
  85   Gets the device path of a specific storage security device.
  86
  87   @param[in]  This                 The PPI instance pointer.
  88   @param[in]  DeviceIndex          Specifies the storage security device to which
  89                                    the function wants to talk. Because the driver
  90                                    that implements Storage Security Command PPIs
  91                                    will manage multiple storage devices, the PPIs
  92                                    that want to talk to a single device must specify
  93                                    the device index that was assigned during the
  94                                    enumeration process. This index is a number from
  95                                    one to NumberofDevices.
  96   @param[out] DevicePathLength     The length of the device path in bytes specified
  97                                    by DevicePath.
  98   @param[out] DevicePath           The device path of storage security device.
  99                                    This field re-uses EFI Device Path Protocol as
 100                                    defined by Section 10.2 EFI Device Path Protocol
 101                                    of UEFI 2.7 Specification.
 102
 103   @retval EFI_SUCCESS              The operation succeeds.
 104   @retval EFI_INVALID_PARAMETER    DevicePathLength or DevicePath is NULL.
 105   @retval EFI_NOT_FOUND            The specified storage security device not found.
 106   @retval EFI_OUT_OF_RESOURCES     The operation fails due to lack of resources.
 107
 108 **/
 109 EFI_STATUS
 110 EFIAPI
 111 AhciStorageSecurityGetDevicePath (
 112   IN  EDKII_PEI_STORAGE_SECURITY_CMD_PPI    *This,
 113   IN  UINTN                                 DeviceIndex,
 114   OUT UINTN                                 *DevicePathLength,
 115   OUT EFI_DEVICE_PATH_PROTOCOL              **DevicePath
 116   )
 117 {
 118   PEI_AHCI_CONTROLLER_PRIVATE_DATA    *Private;
 119   PEI_AHCI_ATA_DEVICE_DATA            *DeviceData;
 120   EFI_STATUS                          Status;
 121
 122   if (This == NULL || DevicePathLength == NULL || DevicePath == NULL) {
 123     return EFI_INVALID_PARAMETER;
 124   }
 125
 126   Private = GET_AHCI_PEIM_HC_PRIVATE_DATA_FROM_THIS_STROAGE_SECURITY (This);
 127   if ((DeviceIndex == 0) || (DeviceIndex > Private->TrustComputingDevices)) {
 128     return EFI_INVALID_PARAMETER;
 129   }
 130
 131   DeviceData = SearchTrustComputingDeviceByIndex (Private, DeviceIndex);
 132   if (DeviceData == NULL) {
 133     return EFI_NOT_FOUND;
 134   }
 135
 136   Status = AhciBuildDevicePath (
 137              Private,
 138              DeviceData->Port,
 139              DeviceData->PortMultiplier,
 140              DevicePathLength,
 141              DevicePath
 142              );
 143   if (EFI_ERROR (Status)) {
 144     return Status;
 145   }
 146
 147   return EFI_SUCCESS;
 148 }
 149
 150 /**
 151   Send a security protocol command to a device that receives data and/or the result
 152   of one or more commands sent by SendData.
 153
 154   The ReceiveData function sends a security protocol command to the given DeviceIndex.
 155   The security protocol command sent is defined by SecurityProtocolId and contains
 156   the security protocol specific data SecurityProtocolSpecificData. The function
 157   returns the data from the security protocol command in PayloadBuffer.
 158
 159   For devices supporting the SCSI command set, the security protocol command is sent
 160   using the SECURITY PROTOCOL IN command defined in SPC-4.
 161
 162   For devices supporting the ATA command set, the security protocol command is sent
 163   using one of the TRUSTED RECEIVE commands defined in ATA8-ACS if PayloadBufferSize
 164   is non-zero.
 165
 166   If the PayloadBufferSize is zero, the security protocol command is sent using the
 167   Trusted Non-Data command defined in ATA8-ACS.
 168
 169   If PayloadBufferSize is too small to store the available data from the security
 170   protocol command, the function shall copy PayloadBufferSize bytes into the
 171   PayloadBuffer and return EFI_WARN_BUFFER_TOO_SMALL.
 172
 173   If PayloadBuffer or PayloadTransferSize is NULL and PayloadBufferSize is non-zero,
 174   the function shall return EFI_INVALID_PARAMETER.
 175
 176   If the given DeviceIndex does not support security protocol commands, the function
 177   shall return EFI_UNSUPPORTED.
 178
 179   If the security protocol fails to complete within the Timeout period, the function
 180   shall return EFI_TIMEOUT.
 181
 182   If the security protocol command completes without an error, the function shall
 183   return EFI_SUCCESS. If the security protocol command completes with an error, the
 184   function shall return EFI_DEVICE_ERROR.
 185
 186   @param[in]  This             The PPI instance pointer.
 187   @param[in]  DeviceIndex      Specifies the storage security device to which the
 188                                function wants to talk. Because the driver that
 189                                implements Storage Security Command PPIs will manage
 190                                multiple storage devices, the PPIs that want to talk
 191                                to a single device must specify the device index
 192                                that was assigned during the enumeration process.
 193                                This index is a number from one to NumberofDevices.
 194   @param[in]  Timeout          The timeout, in 100ns units, to use for the execution
 195                                of the security protocol command. A Timeout value
 196                                of 0 means that this function will wait indefinitely
 197                                for the security protocol command to execute. If
 198                                Timeout is greater than zero, then this function
 199                                will return EFI_TIMEOUT if the time required to
 200                                execute the receive data command is greater than
 201                                Timeout.
 202   @param[in]  SecurityProtocolId
 203                                The value of the "Security Protocol" parameter of
 204                                the security protocol command to be sent.
 205   @param[in]  SecurityProtocolSpecificData
 206                                The value of the "Security Protocol Specific"
 207                                parameter of the security protocol command to be
 208                                sent.
 209   @param[in]  PayloadBufferSize
 210                                Size in bytes of the payload data buffer.
 211   @param[out] PayloadBuffer    A pointer to a destination buffer to store the
 212                                security protocol command specific payload data
 213                                for the security protocol command. The caller is
 214                                responsible for having either implicit or explicit
 215                                ownership of the buffer.
 216   @param[out] PayloadTransferSize
 217                                A pointer to a buffer to store the size in bytes
 218                                of the data written to the payload data buffer.
 219
 220   @retval EFI_SUCCESS                  The security protocol command completed
 221                                        successfully.
 222   @retval EFI_WARN_BUFFER_TOO_SMALL    The PayloadBufferSize was too small to
 223                                        store the available data from the device.
 224                                        The PayloadBuffer contains the truncated
 225                                        data.
 226   @retval EFI_UNSUPPORTED              The given DeviceIndex does not support
 227                                        security protocol commands.
 228   @retval EFI_DEVICE_ERROR             The security protocol command completed
 229                                        with an error.
 230   @retval EFI_INVALID_PARAMETER        The PayloadBuffer or PayloadTransferSize
 231                                        is NULL and PayloadBufferSize is non-zero.
 232   @retval EFI_TIMEOUT                  A timeout occurred while waiting for the
 233                                        security protocol command to execute.
 234
 235 **/
 236 EFI_STATUS
 237 EFIAPI
 238 AhciStorageSecurityReceiveData (
 239   IN  EDKII_PEI_STORAGE_SECURITY_CMD_PPI    *This,
 240   IN  UINTN                                 DeviceIndex,
 241   IN  UINT64                                Timeout,
 242   IN  UINT8                                 SecurityProtocolId,
 243   IN  UINT16                                SecurityProtocolSpecificData,
 244   IN  UINTN                                 PayloadBufferSize,
 245   OUT VOID                                  *PayloadBuffer,
 246   OUT UINTN                                 *PayloadTransferSize
 247   )
 248 {
 249   PEI_AHCI_CONTROLLER_PRIVATE_DATA    *Private;
 250   PEI_AHCI_ATA_DEVICE_DATA            *DeviceData;
 251
 252   if ((PayloadBuffer == NULL) || (PayloadTransferSize == NULL) || (PayloadBufferSize == 0)) {
 253     return EFI_INVALID_PARAMETER;
 254   }
 255
 256   Private = GET_AHCI_PEIM_HC_PRIVATE_DATA_FROM_THIS_STROAGE_SECURITY (This);
 257   if ((DeviceIndex == 0) || (DeviceIndex > Private->TrustComputingDevices)) {
 258     return EFI_INVALID_PARAMETER;
 259   }
 260
 261   DeviceData = SearchTrustComputingDeviceByIndex (Private, DeviceIndex);
 262   if (DeviceData == NULL) {
 263     return EFI_NOT_FOUND;
 264   }
 265
 266   ASSERT ((DeviceData->IdentifyData->trusted_computing_support & BIT0) != 0);
 267   if ((DeviceData->IdentifyData->trusted_computing_support & BIT0) == 0) {
 268     return EFI_UNSUPPORTED;
 269   }
 270
 271   return TrustTransferAtaDevice (
 272            DeviceData,
 273            PayloadBuffer,
 274            SecurityProtocolId,
 275            SecurityProtocolSpecificData,
 276            PayloadBufferSize,
 277            FALSE,
 278            Timeout,
 279            PayloadTransferSize
 280            );
 281 }
 282
 283 /**
 284   Send a security protocol command to a device.
 285
 286   The SendData function sends a security protocol command containing the payload
 287   PayloadBuffer to the given DeviceIndex. The security protocol command sent is
 288   defined by SecurityProtocolId and contains the security protocol specific data
 289   SecurityProtocolSpecificData. If the underlying protocol command requires a
 290   specific padding for the command payload, the SendData function shall add padding
 291   bytes to the command payload to satisfy the padding requirements.
 292
 293   For devices supporting the SCSI command set, the security protocol command is
 294   sent using the SECURITY PROTOCOL OUT command defined in SPC-4.
 295
 296   For devices supporting the ATA command set, the security protocol command is
 297   sent using one of the TRUSTED SEND commands defined in ATA8-ACS if PayloadBufferSize
 298   is non-zero. If the PayloadBufferSize is zero, the security protocol command
 299   is sent using the Trusted Non-Data command defined in ATA8-ACS.
 300
 301   If PayloadBuffer is NULL and PayloadBufferSize is non-zero, the function shall
 302   return EFI_INVALID_PARAMETER.
 303
 304   If the given DeviceIndex does not support security protocol commands, the function
 305   shall return EFI_UNSUPPORTED.
 306
 307   If the security protocol fails to complete within the Timeout period, the function
 308   shall return EFI_TIMEOUT.
 309
 310   If the security protocol command completes without an error, the function shall
 311   return EFI_SUCCESS. If the security protocol command completes with an error,
 312   the functio shall return EFI_DEVICE_ERROR.
 313
 314   @param[in] This              The PPI instance pointer.
 315   @param[in] DeviceIndex       The ID of the device.
 316   @param[in] Timeout           The timeout, in 100ns units, to use for the execution
 317                                of the security protocol command. A Timeout value
 318                                of 0 means that this function will wait indefinitely
 319                                for the security protocol command to execute. If
 320                                Timeout is greater than zero, then this function
 321                                will return EFI_TIMEOUT if the time required to
 322                                execute the receive data command is greater than
 323                                Timeout.
 324   @param[in] SecurityProtocolId
 325                                The value of the "Security Protocol" parameter of
 326                                the security protocol command to be sent.
 327   @param[in] SecurityProtocolSpecificData
 328                                The value of the "Security Protocol Specific"
 329                                parameter of the security protocol command to be
 330                                sent.
 331   @param[in] PayloadBufferSize Size in bytes of the payload data buffer.
 332   @param[in] PayloadBuffer     A pointer to a destination buffer to store the
 333                                security protocol command specific payload data
 334                                for the security protocol command.
 335
 336   @retval EFI_SUCCESS              The security protocol command completed successfully.
 337   @retval EFI_UNSUPPORTED          The given DeviceIndex does not support security
 338                                    protocol commands.
 339   @retval EFI_DEVICE_ERROR         The security protocol command completed with
 340                                    an error.
 341   @retval EFI_INVALID_PARAMETER    The PayloadBuffer is NULL and PayloadBufferSize
 342                                    is non-zero.
 343   @retval EFI_TIMEOUT              A timeout occurred while waiting for the security
 344                                    protocol command to execute.
 345
 346 **/
 347 EFI_STATUS
 348 EFIAPI
 349 AhciStorageSecuritySendData (
 350   IN EDKII_PEI_STORAGE_SECURITY_CMD_PPI  *This,
 351   IN UINTN                               DeviceIndex,
 352   IN UINT64                              Timeout,
 353   IN UINT8                               SecurityProtocolId,
 354   IN UINT16                              SecurityProtocolSpecificData,
 355   IN UINTN                               PayloadBufferSize,
 356   IN VOID                                *PayloadBuffer
 357   )
 358 {
 359   PEI_AHCI_CONTROLLER_PRIVATE_DATA    *Private;
 360   PEI_AHCI_ATA_DEVICE_DATA            *DeviceData;
 361
 362   if ((PayloadBuffer == NULL) && (PayloadBufferSize != 0)) {
 363     return EFI_INVALID_PARAMETER;
 364   }
 365
 366   Private = GET_AHCI_PEIM_HC_PRIVATE_DATA_FROM_THIS_STROAGE_SECURITY (This);
 367   if ((DeviceIndex == 0) || (DeviceIndex > Private->TrustComputingDevices)) {
 368     return EFI_INVALID_PARAMETER;
 369   }
 370
 371   DeviceData = SearchTrustComputingDeviceByIndex (Private, DeviceIndex);
 372   if (DeviceData == NULL) {
 373     return EFI_NOT_FOUND;
 374   }
 375
 376   ASSERT ((DeviceData->IdentifyData->trusted_computing_support & BIT0) != 0);
 377   if ((DeviceData->IdentifyData->trusted_computing_support & BIT0) == 0) {
 378     return EFI_UNSUPPORTED;
 379   }
 380
 381   return TrustTransferAtaDevice (
 382            DeviceData,
 383            PayloadBuffer,
 384            SecurityProtocolId,
 385            SecurityProtocolSpecificData,
 386            PayloadBufferSize,
 387            TRUE,
 388            Timeout,
 389            NULL
 390            );
 391 }