SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalUtil.c

   1 /** @file
   2   Public API for Opal Core library.
   3
   4 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14 #include <Uefi.h>
  15 #include <Library/BaseLib.h>
  16 #include <Library/DebugLib.h>
  17 #include <Library/TcgStorageOpalLib.h>
  18 #include "TcgStorageOpalLibInternal.h"
  19
  20 #define OPAL_MSID_LENGHT        128
  21
  22 /**
  23   Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method.
  24
  25   @param[in]      Session,           The session info for one opal device.
  26   @param[in]      Psid               PSID of device to revert.
  27   @param[in]      PsidLength         Length of PSID in bytes.
  28
  29 **/
  30 TCG_RESULT
  31 EFIAPI
  32 OpalUtilPsidRevert(
  33   OPAL_SESSION   *Session,
  34   const VOID     *Psid,
  35   UINT32         PsidLength
  36   )
  37 {
  38   UINT8        MethodStatus;
  39   TCG_RESULT   Ret;
  40   UINT32       RemovalTimeOut;
  41
  42   NULL_CHECK(Session);
  43   NULL_CHECK(Psid);
  44
  45   RemovalTimeOut = GetRevertTimeOut (Session);
  46   DEBUG ((DEBUG_INFO, "OpalUtilPsidRevert: Timeout value = %d\n", RemovalTimeOut));
  47
  48   Ret = OpalStartSession(
  49                       Session,
  50                       OPAL_UID_ADMIN_SP,
  51                       TRUE,
  52                       PsidLength,
  53                       Psid,
  54                       OPAL_ADMIN_SP_PSID_AUTHORITY,
  55                       &MethodStatus);
  56   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
  57     Ret = OpalPyrite2PsidRevert(Session, RemovalTimeOut);
  58     if (Ret != TcgResultSuccess) {
  59       //
  60       // If revert was successful, session was already ended by TPer, so only end session on failure
  61       //
  62       OpalEndSession(Session);
  63     }
  64   }
  65
  66   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
  67     Ret = TcgResultFailure;
  68   }
  69
  70   return Ret;
  71 }
  72
  73 /**
  74   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
  75   sets the OPAL_UID_ADMIN_SP_C_PIN_SID column with the new password,
  76   and activates the locking SP to copy SID PIN to Admin1 Locking SP PIN
  77
  78   @param[in]      Session,           The session info for one opal device.
  79   @param[in]      GeneratedSid       Generated SID of disk
  80   @param[in]      SidLength          Length of generatedSid in bytes
  81   @param[in]      Password           New admin password to set
  82   @param[in]      PassLength         Length of password in bytes
  83
  84 **/
  85 TCG_RESULT
  86 EFIAPI
  87 OpalUtilSetAdminPasswordAsSid(
  88   OPAL_SESSION      *Session,
  89   const VOID        *GeneratedSid,
  90   UINT32            SidLength,
  91   const VOID        *Password,
  92   UINT32            PassLength
  93   )
  94 {
  95   UINT8        MethodStatus;
  96   TCG_RESULT   Ret;
  97
  98   NULL_CHECK(Session);
  99   NULL_CHECK(GeneratedSid);
 100   NULL_CHECK(Password);
 101
 102   Ret = OpalStartSession(
 103                     Session,
 104                     OPAL_UID_ADMIN_SP,
 105                     TRUE,
 106                     SidLength,
 107                     GeneratedSid,
 108                     OPAL_ADMIN_SP_SID_AUTHORITY,
 109                     &MethodStatus
 110                     );
 111   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 112     DEBUG ((DEBUG_INFO, "start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 113     goto done;
 114   }
 115
 116   //
 117   // 1. Update SID = new Password
 118   //
 119   Ret = OpalSetPassword(
 120                     Session,
 121                     OPAL_UID_ADMIN_SP_C_PIN_SID,
 122                     Password,
 123                     PassLength,
 124                     &MethodStatus
 125                     );
 126
 127   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 128     OpalEndSession(Session);
 129     DEBUG ((DEBUG_INFO, "set Password failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 130     goto done;
 131   }
 132
 133   //
 134   // 2. Activate locking SP
 135   //
 136   Ret = OpalActivateLockingSp(Session, &MethodStatus);
 137   OpalEndSession(Session);
 138   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 139     DEBUG ((DEBUG_INFO, "activate locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 140     goto done;
 141   }
 142
 143 done:
 144   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 145     Ret = TcgResultFailure;
 146   }
 147   return Ret;
 148 }
 149
 150 /**
 151
 152   Opens a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 153   and updates the specified locking range with the provided column values
 154
 155   @param[in]      Session,               The session info for one opal device.
 156   @param[in]      Password           New admin password to set
 157   @param[in]      PassLength         Length of password in bytes
 158   @param[in]      LockingRangeUid    Locking range UID to set values
 159   @param[in]      RangeStart         Value to set RangeStart column for Locking Range
 160   @param[in]      RangeLength        Value to set RangeLength column for Locking Range
 161   @param[in]      ReadLockEnabled    Value to set readLockEnabled column for Locking Range
 162   @param[in]      WriteLockEnabled   Value to set writeLockEnabled column for Locking Range
 163   @param[in]      ReadLocked         Value to set ReadLocked column for Locking Range
 164   @param[in]      WriteLocked        Value to set WriteLocked column for Locking Range
 165
 166 **/
 167 TCG_RESULT
 168 EFIAPI
 169 OpalUtilSetOpalLockingRange(
 170   OPAL_SESSION   *Session,
 171   const VOID     *Password,
 172   UINT32         PassLength,
 173   TCG_UID        LockingRangeUid,
 174   UINT64         RangeStart,
 175   UINT64         RangeLength,
 176   BOOLEAN        ReadLockEnabled,
 177   BOOLEAN        WriteLockEnabled,
 178   BOOLEAN        ReadLocked,
 179   BOOLEAN        WriteLocked
 180   )
 181 {
 182   UINT8        MethodStatus;
 183   TCG_RESULT   Ret;
 184
 185   NULL_CHECK(Session);
 186   NULL_CHECK(Password);
 187
 188   //
 189   // Start session with Locking SP using current admin Password
 190   //
 191   Ret = OpalStartSession(
 192                       Session,
 193                       OPAL_UID_LOCKING_SP,
 194                       TRUE,
 195                       PassLength,
 196                       Password,
 197                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 198                       &MethodStatus);
 199   if ((Ret != TcgResultSuccess) || (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS)) {
 200     DEBUG ((DEBUG_INFO, "start session with locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 201     goto done;
 202   }
 203
 204   //
 205   // Enable locking range
 206   //
 207   Ret = OpalSetLockingRange(
 208             Session,
 209             LockingRangeUid,
 210             RangeStart,
 211             RangeLength,
 212             ReadLockEnabled,
 213             WriteLockEnabled,
 214             ReadLocked,
 215             WriteLocked,
 216             &MethodStatus);
 217
 218   OpalEndSession(Session);
 219   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 220     DEBUG ((DEBUG_INFO, "set locking range failed: Ret=%d MethodStatus=0x%x\n", Ret, MethodStatus));
 221   }
 222
 223 done:
 224   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 225     Ret = TcgResultFailure;
 226   }
 227   return Ret;
 228 }
 229
 230 /**
 231   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
 232   sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password,
 233   and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password.
 234
 235   @param[in]      Session,               The session info for one opal device.
 236   @param[in]      OldPassword        Current admin password
 237   @param[in]      OldPasswordLength  Length of current admin password in bytes
 238   @param[in]      NewPassword        New admin password to set
 239   @param[in]      NewPasswordLength  Length of new password in bytes
 240
 241 **/
 242 TCG_RESULT
 243 EFIAPI
 244 OpalUtilSetAdminPassword(
 245   OPAL_SESSION  *Session,
 246   const VOID    *OldPassword,
 247   UINT32        OldPasswordLength,
 248   const VOID    *NewPassword,
 249   UINT32        NewPasswordLength
 250   )
 251 {
 252   TCG_RESULT   Ret;
 253   UINT8        MethodStatus;
 254
 255   NULL_CHECK(Session);
 256   NULL_CHECK(OldPassword);
 257   NULL_CHECK(NewPassword);
 258
 259   //
 260   // Unknown ownership
 261   //
 262   Ret = OpalStartSession(
 263                   Session,
 264                   OPAL_UID_ADMIN_SP,
 265                   TRUE,
 266                   OldPasswordLength,
 267                   OldPassword,
 268                   OPAL_ADMIN_SP_SID_AUTHORITY,
 269                   &MethodStatus
 270                   );
 271   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 272     DEBUG ((DEBUG_INFO, "start session with admin SP using old Password failed\n"));
 273     goto done;
 274   }
 275
 276   //
 277   // Update SID = new pw
 278   //
 279   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, NewPassword, NewPasswordLength, &MethodStatus);
 280   OpalEndSession(Session);
 281   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 282     DEBUG ((DEBUG_INFO, "set new admin SP Password failed\n"));
 283     goto done;
 284   }
 285
 286   Ret = OpalStartSession(
 287                   Session,
 288                   OPAL_UID_LOCKING_SP,
 289                   TRUE,
 290                   OldPasswordLength,
 291                   OldPassword,
 292                   OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 293                   &MethodStatus
 294                   );
 295   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 296     DEBUG ((DEBUG_INFO, "start session with locking SP using old Password failed\n"));
 297     goto done;
 298   }
 299
 300   //
 301   // Update admin locking SP to new pw
 302   //
 303   Ret = OpalSetPassword(Session, OPAL_LOCKING_SP_C_PIN_ADMIN1, NewPassword, NewPasswordLength, &MethodStatus);
 304   OpalEndSession(Session);
 305   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 306     DEBUG ((DEBUG_INFO, "set new locking SP Password failed\n"));
 307     goto done;
 308   }
 309
 310 done:
 311   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 312     Ret = TcgResultFailure;
 313   }
 314   return Ret;
 315 }
 316
 317 /**
 318   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 319   and sets the User1 SP authority to enabled and sets the User1 password.
 320
 321   @param[in]      Session,               The session info for one opal device.
 322   @param[in]      OldPassword        Current admin password
 323   @param[in]      OldPasswordLength  Length of current admin password in bytes
 324   @param[in]      NewPassword        New admin password to set
 325   @param[in]      NewPasswordLength  Length of new password in bytes
 326
 327 **/
 328 TCG_RESULT
 329 EFIAPI
 330 OpalUtilSetUserPassword(
 331   OPAL_SESSION    *Session,
 332   const VOID      *OldPassword,
 333   UINT32          OldPasswordLength,
 334   const VOID      *NewPassword,
 335   UINT32          NewPasswordLength
 336   )
 337 {
 338   UINT8        MethodStatus;
 339   TCG_RESULT   Ret;
 340
 341   NULL_CHECK(Session);
 342   NULL_CHECK(OldPassword);
 343   NULL_CHECK(NewPassword);
 344
 345   //
 346   // See if updating user1 authority
 347   //
 348   Ret = OpalStartSession(
 349                     Session,
 350                     OPAL_UID_LOCKING_SP,
 351                     TRUE,
 352                     OldPasswordLength,
 353                     OldPassword,
 354                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 355                     &MethodStatus
 356                     );
 357   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 358     Ret = OpalSetPassword(
 359                       Session,
 360                       OPAL_LOCKING_SP_C_PIN_USER1,
 361                       NewPassword,
 362                       NewPasswordLength,
 363                       &MethodStatus
 364                       );
 365     OpalEndSession(Session);
 366     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 367       return Ret;
 368     }
 369   }
 370
 371   //
 372   // Setting Password for first time or setting Password as admin
 373   //
 374
 375   //
 376   // Start session with Locking SP using current admin Password
 377   //
 378   Ret = OpalStartSession(
 379                     Session,
 380                     OPAL_UID_LOCKING_SP,
 381                     TRUE,
 382                     OldPasswordLength,
 383                     OldPassword,
 384                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 385                     &MethodStatus
 386                     );
 387   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 388     DEBUG ((DEBUG_INFO, "StartSession with locking SP as admin1 authority failed\n"));
 389     goto done;
 390   }
 391
 392   //
 393   // Enable User1 and set its PIN
 394   //
 395   Ret = OpalSetLockingSpAuthorityEnabledAndPin(
 396                                           Session,
 397                                           OPAL_LOCKING_SP_C_PIN_USER1,
 398                                           OPAL_LOCKING_SP_USER1_AUTHORITY,
 399                                           NewPassword,
 400                                           NewPasswordLength,
 401                                           &MethodStatus
 402                                           );
 403   OpalEndSession(Session);
 404   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 405     DEBUG ((DEBUG_INFO, "OpalSetLockingSpAuthorityEnabledAndPin failed\n"));
 406     goto done;
 407   }
 408
 409 done:
 410   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 411     Ret = TcgResultFailure;
 412   }
 413   return Ret;
 414 }
 415
 416 /**
 417   Verify whether user input the correct password.
 418
 419   @param[in]      Session,               The session info for one opal device.
 420   @param[in]      Password                    Admin password
 421   @param[in]      PasswordLength              Length of password in bytes
 422   @param[in/out]  HostSigningAuthority        Use the Host signing authority type.
 423
 424 **/
 425 TCG_RESULT
 426 EFIAPI
 427 OpalUtilVerifyPassword (
 428   OPAL_SESSION   *Session,
 429   const VOID     *Password,
 430   UINT32         PasswordLength,
 431   TCG_UID        HostSigningAuthority
 432   )
 433 {
 434   TCG_RESULT                    Ret;
 435   UINT8                         MethodStatus;
 436
 437   NULL_CHECK(Session);
 438   NULL_CHECK(Password);
 439
 440   Ret = OpalStartSession(
 441             Session,
 442             OPAL_UID_LOCKING_SP,
 443             TRUE,
 444             PasswordLength,
 445             Password,
 446             HostSigningAuthority,
 447             &MethodStatus);
 448   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 449     OpalEndSession(Session);
 450     return TcgResultSuccess;
 451   }
 452
 453   return TcgResultFailure;
 454 }
 455
 456 /**
 457   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 458   and generates a new global locking range key to erase the Data.
 459
 460   @param[in]      Session,               The session info for one opal device.
 461   @param[in]      Password                   Admin or user password
 462   @param[in]      PasswordLength         Length of password in bytes
 463   @param[in/out]  PasswordFailed       indicates if password failed (start session didn't work)
 464
 465 **/
 466 TCG_RESULT
 467 EFIAPI
 468 OpalUtilSecureErase(
 469   OPAL_SESSION     *Session,
 470   const VOID       *Password,
 471   UINT32           PasswordLength,
 472   BOOLEAN          *PasswordFailed
 473   )
 474 {
 475   UINT8        MethodStatus;
 476   TCG_RESULT   Ret;
 477
 478   NULL_CHECK(Session);
 479   NULL_CHECK(Password);
 480   NULL_CHECK(PasswordFailed);
 481
 482   //
 483   // Try to generate a new key with admin1
 484   //
 485   Ret = OpalStartSession(
 486                       Session,
 487                       OPAL_UID_LOCKING_SP,
 488                       TRUE,
 489                       PasswordLength,
 490                       Password,
 491                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 492                       &MethodStatus
 493                       );
 494
 495   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 496     Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 497     *PasswordFailed = FALSE;
 498     OpalEndSession(Session);
 499   } else {
 500     //
 501     // Try to generate a new key with user1
 502     //
 503     Ret = OpalStartSession(
 504                       Session,
 505                       OPAL_UID_LOCKING_SP,
 506                       TRUE,
 507                       PasswordLength,
 508                       Password,
 509                       OPAL_LOCKING_SP_USER1_AUTHORITY,
 510                       &MethodStatus
 511                       );
 512
 513     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 514       Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 515       *PasswordFailed = FALSE;
 516       OpalEndSession(Session);
 517     } else {
 518       *PasswordFailed = TRUE;
 519     }
 520   }
 521
 522   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 523     Ret = TcgResultFailure;
 524   }
 525   return Ret;
 526 }
 527
 528 /**
 529   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority.
 530
 531   @param[in]      Session,               The session info for one opal device.
 532   @param[in]      Password               Admin password
 533   @param[in]      PasswordLength         Length of password in bytes
 534   @param[in/out]  PasswordFailed         indicates if password failed (start session didn't work)
 535
 536 **/
 537 TCG_RESULT
 538 EFIAPI
 539 OpalUtilDisableUser(
 540   OPAL_SESSION   *Session,
 541   const VOID     *Password,
 542   UINT32         PasswordLength,
 543   BOOLEAN        *PasswordFailed
 544   )
 545 {
 546   UINT8        MethodStatus;
 547   TCG_RESULT   Ret;
 548
 549   NULL_CHECK(Session);
 550   NULL_CHECK(Password);
 551   NULL_CHECK(PasswordFailed);
 552
 553   //
 554   // Start session with Locking SP using current admin Password
 555   //
 556   Ret = OpalStartSession(
 557                     Session,
 558                     OPAL_UID_LOCKING_SP,
 559                     TRUE,
 560                     PasswordLength,
 561                     Password,
 562                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 563                     &MethodStatus
 564                     );
 565   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 566     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as Admin1 failed\n"));
 567     *PasswordFailed = TRUE;
 568     goto done;
 569   }
 570
 571   *PasswordFailed = FALSE;
 572   Ret = OpalDisableUser(Session, &MethodStatus);
 573   OpalEndSession(Session);
 574
 575 done:
 576   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 577     Ret = TcgResultFailure;
 578   }
 579   return Ret;
 580 }
 581
 582 /**
 583   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method.
 584
 585   @param[in]      Session,           The session info for one opal device.
 586   @param[in]      KeepUserData       TRUE to keep existing Data on the disk, or FALSE to erase it
 587   @param[in]      Password           Admin password
 588   @param[in]      PasswordLength     Length of password in bytes
 589   @param[in/out]  PasswordFailed     indicates if password failed (start session didn't work)
 590   @param[in]      Msid               Msid info.
 591   @param[in]      MsidLength         Msid data length.
 592
 593 **/
 594 TCG_RESULT
 595 EFIAPI
 596 OpalUtilRevert(
 597   OPAL_SESSION     *Session,
 598   BOOLEAN          KeepUserData,
 599   const VOID       *Password,
 600   UINT32           PasswordLength,
 601   BOOLEAN          *PasswordFailed,
 602   UINT8            *Msid,
 603   UINT32           MsidLength
 604   )
 605 {
 606   UINT8        MethodStatus;
 607   TCG_RESULT   Ret;
 608   UINT32       RemovalTimeOut;
 609
 610   NULL_CHECK(Session);
 611   NULL_CHECK(Msid);
 612   NULL_CHECK(Password);
 613   NULL_CHECK(PasswordFailed);
 614
 615   RemovalTimeOut = GetRevertTimeOut (Session);
 616   DEBUG ((DEBUG_INFO, "OpalUtilRevert: Timeout value = %d\n", RemovalTimeOut));
 617
 618   Ret = OpalStartSession(
 619                    Session,
 620                    OPAL_UID_LOCKING_SP,
 621                    TRUE,
 622                    PasswordLength,
 623                    Password,
 624                    OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 625                    &MethodStatus
 626                    );
 627
 628   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 629     DEBUG ((DEBUG_INFO, "error starting session: Ret=%d, MethodStatus=%u\n", Ret, MethodStatus));
 630     *PasswordFailed = TRUE;
 631     goto done;
 632   }
 633
 634   *PasswordFailed = FALSE;
 635   //
 636   // Try to revert with admin1
 637   //
 638   Ret = OpalPyrite2AdminRevert(Session, KeepUserData, &MethodStatus, RemovalTimeOut);
 639   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 640     //
 641     // Device ends the session on successful revert, so only call OpalEndSession when fail.
 642     //
 643     DEBUG ((DEBUG_INFO, "OpalAdminRevert as admin failed\n"));
 644     OpalEndSession(Session);
 645   }
 646
 647   Ret = OpalUtilSetSIDtoMSID (Session, Password, PasswordLength, Msid, MsidLength);
 648
 649 done:
 650   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 651     Ret = TcgResultFailure;
 652   }
 653   return Ret;
 654 }
 655
 656 /**
 657   After revert success, set SID to MSID.
 658
 659   @param          Session,           The session info for one opal device.
 660   @param          Password,          Input password info.
 661   @param          PasswordLength,    Input password length.
 662   @param          Msid               Msid info.
 663   @param          MsidLength         Msid data length.
 664
 665 **/
 666 TCG_RESULT
 667 EFIAPI
 668 OpalUtilSetSIDtoMSID (
 669   OPAL_SESSION     *Session,
 670   const VOID       *Password,
 671   UINT32           PasswordLength,
 672   UINT8            *Msid,
 673   UINT32           MsidLength
 674   )
 675 {
 676   TCG_RESULT                   Ret;
 677   UINT8                        MethodStatus;
 678
 679   NULL_CHECK(Session);
 680   NULL_CHECK(Msid);
 681   NULL_CHECK(Password);
 682
 683   //
 684   // Start session with admin sp to update SID to MSID
 685   //
 686   Ret = OpalStartSession(
 687             Session,
 688             OPAL_UID_ADMIN_SP,
 689             TRUE,
 690             PasswordLength,
 691             Password,
 692             OPAL_ADMIN_SP_SID_AUTHORITY,
 693             &MethodStatus
 694             );
 695   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 696     goto done;
 697   }
 698
 699   //
 700   // Update SID pin
 701   //
 702   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, Msid, MsidLength, &MethodStatus);
 703   OpalEndSession(Session);
 704
 705 done:
 706   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 707     Ret = TcgResultFailure;
 708   }
 709
 710   return Ret;
 711 }
 712
 713 /**
 714   Update global locking range.
 715
 716   @param          Session,           The session info for one opal device.
 717   @param          Password,          Input password info.
 718   @param          PasswordLength,    Input password length.
 719   @param          ReadLocked,        Read lock info.
 720   @param          WriteLocked        write lock info.
 721
 722 **/
 723 TCG_RESULT
 724 EFIAPI
 725 OpalUtilUpdateGlobalLockingRange(
 726   OPAL_SESSION    *Session,
 727   const VOID      *Password,
 728   UINT32          PasswordLength,
 729   BOOLEAN         ReadLocked,
 730   BOOLEAN         WriteLocked
 731   )
 732 {
 733   UINT8        MethodStatus;
 734   TCG_RESULT   Ret;
 735
 736   NULL_CHECK(Session);
 737   NULL_CHECK(Password);
 738
 739   //
 740   // Try to start session with Locking SP as admin1 authority
 741   //
 742   Ret = OpalStartSession(
 743                     Session,
 744                     OPAL_UID_LOCKING_SP,
 745                     TRUE,
 746                     PasswordLength,
 747                     Password,
 748                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 749                     &MethodStatus
 750                     );
 751   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 752     Ret = OpalUpdateGlobalLockingRange(
 753                                 Session,
 754                                 ReadLocked,
 755                                 WriteLocked,
 756                                 &MethodStatus
 757                                 );
 758     OpalEndSession(Session);
 759     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 760       goto done;
 761     }
 762   }
 763
 764   if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) {
 765     DEBUG ((DEBUG_INFO, "unlock as admin failed with AUTHORITY_LOCKED_OUT\n"));
 766   }
 767
 768   //
 769   // Try user1 authority
 770   //
 771   Ret = OpalStartSession(
 772                     Session,
 773                     OPAL_UID_LOCKING_SP,
 774                     TRUE,
 775                     PasswordLength,
 776                     Password,
 777                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 778                     &MethodStatus
 779                     );
 780   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 781     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as User1 failed\n"));
 782     goto done;
 783   }
 784
 785   Ret = OpalUpdateGlobalLockingRange(Session, ReadLocked, WriteLocked, &MethodStatus);
 786   OpalEndSession(Session);
 787
 788 done:
 789   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 790     if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) {
 791       //
 792       // Caller need to know this special error, but return status not has type for it.
 793       // so here use TcgResultFailureInvalidType as an replacement.
 794       //
 795       Ret = TcgResultFailureInvalidType;
 796     } else {
 797       Ret = TcgResultFailure;
 798     }
 799   }
 800   return Ret;
 801 }
 802
 803 /**
 804   Update global locking range.
 805
 806   @param          Session,           The session info for one opal device.
 807   @param          Msid,              The data buffer to save Msid info.
 808   @param          MsidBufferLength,  The data buffer length for Msid.
 809   @param          MsidLength,        The actual data length for Msid.
 810
 811 **/
 812 TCG_RESULT
 813 EFIAPI
 814 OpalUtilGetMsid(
 815   OPAL_SESSION    *Session,
 816   UINT8           *Msid,
 817   UINT32          MsidBufferLength,
 818   UINT32          *MsidLength
 819   )
 820 {
 821   UINT8        MethodStatus;
 822   TCG_RESULT   Ret;
 823
 824   NULL_CHECK(Session);
 825   NULL_CHECK(Msid);
 826   NULL_CHECK(MsidLength);
 827
 828   Ret = OpalStartSession(
 829                    Session,
 830                    OPAL_UID_ADMIN_SP,
 831                    TRUE,
 832                    0,
 833                    NULL,
 834                    TCG_UID_NULL,
 835                    &MethodStatus
 836                    );
 837   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 838     Ret = OpalGetMsid (Session, MsidBufferLength, Msid, MsidLength);
 839     OpalEndSession (Session);
 840   }
 841
 842   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 843     Ret = TcgResultFailure;
 844   }
 845
 846   return Ret;
 847 }
 848
 849 /**
 850
 851   The function determines who owns the device by attempting to start a session with different credentials.
 852   If the SID PIN matches the MSID PIN, the no one owns the device.
 853   If the SID PIN matches the ourSidPin, then "Us" owns the device.  Otherwise it is unknown.
 854
 855
 856   @param[in]      Session            The session info for one opal device.
 857   @param          Msid,              The Msid info.
 858   @param          MsidLength,        The data length for Msid.
 859
 860 **/
 861 OPAL_OWNER_SHIP
 862 EFIAPI
 863 OpalUtilDetermineOwnership(
 864   OPAL_SESSION       *Session,
 865   UINT8              *Msid,
 866   UINT32             MsidLength
 867   )
 868 {
 869   UINT8            MethodStatus;
 870   TCG_RESULT       Ret;
 871   OPAL_OWNER_SHIP  Owner;
 872
 873   if ((Session == NULL) || (Msid == NULL)) {
 874     return OpalOwnershipUnknown;
 875   }
 876
 877   Owner = OpalOwnershipUnknown;
 878   //
 879   // Start Session as SID_UID with ADMIN_SP using MSID PIN
 880   //
 881   Ret = OpalStartSession(
 882                     Session,
 883                     OPAL_UID_ADMIN_SP,
 884                     TRUE,
 885                     MsidLength,
 886                     Msid,
 887                     OPAL_ADMIN_SP_SID_AUTHORITY,
 888                     &MethodStatus);
 889   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 890     //
 891     // now we know that SID PIN == MSID PIN
 892     //
 893     Owner = OpalOwnershipNobody;
 894
 895     OpalEndSession(Session);
 896   }
 897
 898   return Owner;
 899 }
 900
 901 /**
 902
 903   The function returns if admin password exists.
 904
 905   @param[in]      OwnerShip         The owner ship of the opal device.
 906   @param[in]      LockingFeature    The locking info of the opal device.
 907
 908   @retval         TRUE              Admin password existed.
 909   @retval         FALSE             Admin password not existed.
 910
 911 **/
 912 BOOLEAN
 913 EFIAPI
 914 OpalUtilAdminPasswordExists(
 915   IN  UINT16                           OwnerShip,
 916   IN  TCG_LOCKING_FEATURE_DESCRIPTOR   *LockingFeature
 917   )
 918 {
 919   NULL_CHECK(LockingFeature);
 920
 921   // if it is Unknown who owns the device
 922   // then someone has set password previously through our UI
 923   // because the SID would no longer match the generated SID (ownership us)
 924   // or someone has set password using 3rd party software
 925
 926   //
 927   // Locking sp enabled is checked b/c it must be enabled to change the PIN of the Admin1.
 928   //
 929   return (OwnerShip == OpalOwnershipUnknown && LockingFeature->LockingEnabled);
 930 }
 931
 932 /**
 933   Get Active Data Removal Mechanism Value.
 934
 935   @param[in]      Session                        The session info for one opal device.
 936   @param[in]      GeneratedSid                   Generated SID of disk
 937   @param[in]      SidLength                      Length of generatedSid in bytes
 938   @param[out]     ActiveDataRemovalMechanism     Return the active data removal mechanism.
 939
 940 **/
 941 TCG_RESULT
 942 EFIAPI
 943 OpalUtilGetActiveDataRemovalMechanism (
 944   OPAL_SESSION      *Session,
 945   const VOID        *GeneratedSid,
 946   UINT32            SidLength,
 947   UINT8             *ActiveDataRemovalMechanism
 948   )
 949 {
 950   TCG_RESULT   Ret;
 951   UINT8        MethodStatus;
 952
 953   NULL_CHECK(Session);
 954   NULL_CHECK(GeneratedSid);
 955   NULL_CHECK(ActiveDataRemovalMechanism);
 956
 957   Ret = OpalStartSession(
 958                     Session,
 959                     OPAL_UID_ADMIN_SP,
 960                     TRUE,
 961                     SidLength,
 962                     GeneratedSid,
 963                     OPAL_ADMIN_SP_ANYBODY_AUTHORITY,
 964                     &MethodStatus
 965                     );
 966   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 967     DEBUG ((DEBUG_INFO, "Start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 968     if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 969       Ret = TcgResultFailure;
 970     }
 971     return Ret;
 972   }
 973
 974   Ret = OpalPyrite2GetActiveDataRemovalMechanism (
 975                     Session,
 976                     ActiveDataRemovalMechanism
 977                     );
 978
 979   if (Ret != TcgResultSuccess) {
 980     DEBUG ((DEBUG_INFO, "Pyrite2 Get Active Data Removal Mechanism failed: Ret=%d\n", Ret));
 981   }
 982
 983   OpalEndSession(Session);
 984
 985   return Ret;
 986 }
 987
 988 /**
 989   Calculate the estimated time.
 990
 991   @param[in]      IsMinute               Whether the input time value is minute type or second type.
 992   @param[in]      Time                   The input time value.
 993
 994 **/
 995 UINT32
 996 CalculateDataRemovalTime (
 997   IN BOOLEAN               IsMinute,
 998   IN UINT16                Time
 999   )
1000 {
1001   if (IsMinute) {
1002     return Time * 2 * 60;
1003   } else {
1004     return Time * 2;
1005   }
1006 }
1007
1008 /**
1009   Return the estimated time for specific type.
1010
1011   @param[in]      Index               The input data removal type.
1012   @param[in]      Descriptor          DATA_REMOVAL_FEATURE_DESCRIPTOR
1013
1014 **/
1015 UINT32
1016 GetDataRemovalTime (
1017   IN  UINT8                            Index,
1018   IN  DATA_REMOVAL_FEATURE_DESCRIPTOR  *Descriptor
1019   )
1020 {
1021   switch (Index) {
1022   case OverwriteDataErase:
1023     return CalculateDataRemovalTime (Descriptor->FormatBit0, SwapBytes16 (Descriptor->TimeBit0));
1024
1025   case BlockErase:
1026     return CalculateDataRemovalTime (Descriptor->FormatBit1, SwapBytes16 (Descriptor->TimeBit1));
1027
1028   case CryptoErase:
1029     return CalculateDataRemovalTime (Descriptor->FormatBit2, SwapBytes16 (Descriptor->TimeBit2));
1030
1031   case Unmap:
1032     return CalculateDataRemovalTime (Descriptor->FormatBit3, SwapBytes16 (Descriptor->TimeBit3));
1033
1034   case ResetWritePointers:
1035     return CalculateDataRemovalTime (Descriptor->FormatBit4, SwapBytes16 (Descriptor->TimeBit4));
1036
1037   case VendorSpecificErase:
1038     return CalculateDataRemovalTime (Descriptor->FormatBit5, SwapBytes16 (Descriptor->TimeBit5));
1039
1040   default:
1041     return 0;
1042   }
1043 }
1044
1045 /**
1046   Get the supported Data Removal Mechanism list.
1047
1048   @param[in]      Session                        The session info for one opal device.
1049   @param[out]     RemovalMechanismLists          Return the supported data removal mechanism lists.
1050
1051 **/
1052 TCG_RESULT
1053 EFIAPI
1054 OpalUtilGetDataRemovalMechanismLists (
1055   IN  OPAL_SESSION      *Session,
1056   OUT UINT32            *RemovalMechanismLists
1057   )
1058 {
1059   TCG_RESULT                       Ret;
1060   UINTN                            DataSize;
1061   DATA_REMOVAL_FEATURE_DESCRIPTOR  Descriptor;
1062   UINT8                            Index;
1063   UINT8                            BitValue;
1064
1065   NULL_CHECK(Session);
1066   NULL_CHECK(RemovalMechanismLists);
1067
1068   DataSize = sizeof (Descriptor);
1069   Ret = OpalGetFeatureDescriptor (Session, TCG_FEATURE_DATA_REMOVAL, &DataSize, &Descriptor);
1070   if (Ret != TcgResultSuccess) {
1071     return TcgResultFailure;
1072   }
1073
1074   ASSERT (Descriptor.RemovalMechanism != 0);
1075
1076   for (Index = 0; Index < ResearvedMechanism; Index ++) {
1077     BitValue = (BOOLEAN) BitFieldRead8 (Descriptor.RemovalMechanism, Index, Index);
1078
1079     if (BitValue == 0) {
1080       RemovalMechanismLists[Index] = 0;
1081     } else {
1082       RemovalMechanismLists[Index] = GetDataRemovalTime (Index, &Descriptor);
1083     }
1084   }
1085
1086   return TcgResultSuccess;
1087 }
1088
1089 /**
1090   Get revert timeout value.
1091
1092   @param[in]      Session                       The session info for one opal device.
1093
1094 **/
1095 UINT32
1096 GetRevertTimeOut (
1097   IN OPAL_SESSION                *Session
1098   )
1099 {
1100   TCG_RESULT                   TcgResult;
1101   OPAL_DISK_SUPPORT_ATTRIBUTE  SupportedAttributes;
1102   UINT16                       BaseComId;
1103   UINT32                       MsidLength;
1104   UINT8                        Msid[OPAL_MSID_LENGHT];
1105   UINT32                       RemovalMechanishLists[ResearvedMechanism];
1106   UINT8                        ActiveDataRemovalMechanism;
1107
1108   TcgResult = OpalGetSupportedAttributesInfo (Session, &SupportedAttributes, &BaseComId);
1109   if (TcgResult != TcgResultSuccess || SupportedAttributes.DataRemoval == 0) {
1110     return 0;
1111   }
1112
1113   TcgResult = OpalUtilGetMsid (Session, Msid, OPAL_MSID_LENGHT, &MsidLength);
1114   if (TcgResult != TcgResultSuccess) {
1115     return 0;
1116   }
1117
1118   TcgResult = OpalUtilGetDataRemovalMechanismLists (Session, RemovalMechanishLists);
1119   if (TcgResult != TcgResultSuccess) {
1120     return 0;
1121   }
1122
1123   TcgResult = OpalUtilGetActiveDataRemovalMechanism (Session, Msid, MsidLength, &ActiveDataRemovalMechanism);
1124   if (TcgResult != TcgResultSuccess) {
1125     return 0;
1126   }
1127
1128   return RemovalMechanishLists[ActiveDataRemovalMechanism];
1129 }