SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalUtil.c

   1 /** @file
   2   Public API for Opal Core library.
   3
   4 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14 #include <Uefi.h>
  15 #include <Library/BaseLib.h>
  16 #include <Library/DebugLib.h>
  17 #include <Library/TcgStorageOpalLib.h>
  18 #include "TcgStorageOpalLibInternal.h"
  19
  20 #define OPAL_MSID_LENGHT        128
  21
  22 /**
  23   Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method.
  24
  25   @param[in]      Session,           The session info for one opal device.
  26   @param[in]      Psid               PSID of device to revert.
  27   @param[in]      PsidLength         Length of PSID in bytes.
  28
  29 **/
  30 TCG_RESULT
  31 EFIAPI
  32 OpalUtilPsidRevert(
  33   OPAL_SESSION   *Session,
  34   const VOID     *Psid,
  35   UINT32         PsidLength
  36   )
  37 {
  38   UINT8        MethodStatus;
  39   TCG_RESULT   Ret;
  40   UINT32       RemovalTimeOut;
  41
  42   NULL_CHECK(Session);
  43   NULL_CHECK(Psid);
  44
  45   RemovalTimeOut = GetRevertTimeOut (Session);
  46   DEBUG ((DEBUG_INFO, "OpalUtilPsidRevert: Timeout value = %d\n", RemovalTimeOut));
  47
  48   Ret = OpalStartSession(
  49                       Session,
  50                       OPAL_UID_ADMIN_SP,
  51                       TRUE,
  52                       PsidLength,
  53                       Psid,
  54                       OPAL_ADMIN_SP_PSID_AUTHORITY,
  55                       &MethodStatus);
  56   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
  57     Ret = OpalPyrite2PsidRevert(Session, RemovalTimeOut);
  58     if (Ret != TcgResultSuccess) {
  59       //
  60       // If revert was successful, session was already ended by TPer, so only end session on failure
  61       //
  62       OpalEndSession(Session);
  63     }
  64   }
  65
  66   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
  67     Ret = TcgResultFailure;
  68   }
  69
  70   return Ret;
  71 }
  72
  73 /**
  74   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
  75   sets the OPAL_UID_ADMIN_SP_C_PIN_SID column with the new password,
  76   and activates the locking SP to copy SID PIN to Admin1 Locking SP PIN
  77
  78   @param[in]      Session,           The session info for one opal device.
  79   @param[in]      GeneratedSid       Generated SID of disk
  80   @param[in]      SidLength          Length of generatedSid in bytes
  81   @param[in]      Password           New admin password to set
  82   @param[in]      PassLength         Length of password in bytes
  83
  84 **/
  85 TCG_RESULT
  86 EFIAPI
  87 OpalUtilSetAdminPasswordAsSid(
  88   OPAL_SESSION      *Session,
  89   const VOID        *GeneratedSid,
  90   UINT32            SidLength,
  91   const VOID        *Password,
  92   UINT32            PassLength
  93   )
  94 {
  95   UINT8        MethodStatus;
  96   TCG_RESULT   Ret;
  97
  98   NULL_CHECK(Session);
  99   NULL_CHECK(GeneratedSid);
 100   NULL_CHECK(Password);
 101
 102   Ret = OpalStartSession(
 103                     Session,
 104                     OPAL_UID_ADMIN_SP,
 105                     TRUE,
 106                     SidLength,
 107                     GeneratedSid,
 108                     OPAL_ADMIN_SP_SID_AUTHORITY,
 109                     &MethodStatus
 110                     );
 111   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 112     DEBUG ((DEBUG_INFO, "start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 113     goto done;
 114   }
 115
 116   //
 117   // 1. Update SID = new Password
 118   //
 119   Ret = OpalSetPassword(
 120                     Session,
 121                     OPAL_UID_ADMIN_SP_C_PIN_SID,
 122                     Password,
 123                     PassLength,
 124                     &MethodStatus
 125                     );
 126
 127   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 128     OpalEndSession(Session);
 129     DEBUG ((DEBUG_INFO, "set Password failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 130     goto done;
 131   }
 132
 133   //
 134   // 2. Activate locking SP
 135   //
 136   Ret = OpalActivateLockingSp(Session, &MethodStatus);
 137   OpalEndSession(Session);
 138   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 139     DEBUG ((DEBUG_INFO, "activate locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 140     goto done;
 141   }
 142
 143 done:
 144   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 145     Ret = TcgResultFailure;
 146   }
 147   return Ret;
 148 }
 149
 150 /**
 151
 152   Opens a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 153   and updates the specified locking range with the provided column values
 154
 155   @param[in]      Session,               The session info for one opal device.
 156   @param[in]      Password           New admin password to set
 157   @param[in]      PassLength         Length of password in bytes
 158   @param[in]      LockingRangeUid    Locking range UID to set values
 159   @param[in]      RangeStart         Value to set RangeStart column for Locking Range
 160   @param[in]      RangeLength        Value to set RangeLength column for Locking Range
 161   @param[in]      ReadLockEnabled    Value to set readLockEnabled column for Locking Range
 162   @param[in]      WriteLockEnabled   Value to set writeLockEnabled column for Locking Range
 163   @param[in]      ReadLocked         Value to set ReadLocked column for Locking Range
 164   @param[in]      WriteLocked        Value to set WriteLocked column for Locking Range
 165
 166 **/
 167 TCG_RESULT
 168 EFIAPI
 169 OpalUtilSetOpalLockingRange(
 170   OPAL_SESSION   *Session,
 171   const VOID     *Password,
 172   UINT32         PassLength,
 173   TCG_UID        LockingRangeUid,
 174   UINT64         RangeStart,
 175   UINT64         RangeLength,
 176   BOOLEAN        ReadLockEnabled,
 177   BOOLEAN        WriteLockEnabled,
 178   BOOLEAN        ReadLocked,
 179   BOOLEAN        WriteLocked
 180   )
 181 {
 182   UINT8        MethodStatus;
 183   TCG_RESULT   Ret;
 184
 185   NULL_CHECK(Session);
 186   NULL_CHECK(Password);
 187
 188   //
 189   // Start session with Locking SP using current admin Password
 190   //
 191   Ret = OpalStartSession(
 192                       Session,
 193                       OPAL_UID_LOCKING_SP,
 194                       TRUE,
 195                       PassLength,
 196                       Password,
 197                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 198                       &MethodStatus);
 199   if ((Ret != TcgResultSuccess) || (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS)) {
 200     DEBUG ((DEBUG_INFO, "start session with locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 201     goto done;
 202   }
 203
 204   //
 205   // Enable locking range
 206   //
 207   Ret = OpalSetLockingRange(
 208             Session,
 209             LockingRangeUid,
 210             RangeStart,
 211             RangeLength,
 212             ReadLockEnabled,
 213             WriteLockEnabled,
 214             ReadLocked,
 215             WriteLocked,
 216             &MethodStatus);
 217
 218   OpalEndSession(Session);
 219   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 220     DEBUG ((DEBUG_INFO, "set locking range failed: Ret=%d MethodStatus=0x%x\n", Ret, MethodStatus));
 221   }
 222
 223 done:
 224   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 225     Ret = TcgResultFailure;
 226   }
 227   return Ret;
 228 }
 229
 230 /**
 231   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
 232   sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password,
 233   and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password.
 234
 235   @param[in]      Session,               The session info for one opal device.
 236   @param[in]      OldPassword        Current admin password
 237   @param[in]      OldPasswordLength  Length of current admin password in bytes
 238   @param[in]      NewPassword        New admin password to set
 239   @param[in]      NewPasswordLength  Length of new password in bytes
 240
 241 **/
 242 TCG_RESULT
 243 EFIAPI
 244 OpalUtilSetAdminPassword(
 245   OPAL_SESSION  *Session,
 246   const VOID    *OldPassword,
 247   UINT32        OldPasswordLength,
 248   const VOID    *NewPassword,
 249   UINT32        NewPasswordLength
 250   )
 251 {
 252   TCG_RESULT   Ret;
 253   UINT8        MethodStatus;
 254
 255   NULL_CHECK(Session);
 256   NULL_CHECK(OldPassword);
 257   NULL_CHECK(NewPassword);
 258
 259   //
 260   // Unknown ownership
 261   //
 262   Ret = OpalStartSession(
 263                   Session,
 264                   OPAL_UID_ADMIN_SP,
 265                   TRUE,
 266                   OldPasswordLength,
 267                   OldPassword,
 268                   OPAL_ADMIN_SP_SID_AUTHORITY,
 269                   &MethodStatus
 270                   );
 271   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 272     DEBUG ((DEBUG_INFO, "start session with admin SP using old Password failed\n"));
 273     goto done;
 274   }
 275
 276   //
 277   // Update SID = new pw
 278   //
 279   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, NewPassword, NewPasswordLength, &MethodStatus);
 280   OpalEndSession(Session);
 281   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 282     DEBUG ((DEBUG_INFO, "set new admin SP Password failed\n"));
 283     goto done;
 284   }
 285
 286   Ret = OpalStartSession(
 287                   Session,
 288                   OPAL_UID_LOCKING_SP,
 289                   TRUE,
 290                   OldPasswordLength,
 291                   OldPassword,
 292                   OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 293                   &MethodStatus
 294                   );
 295   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 296     DEBUG ((DEBUG_INFO, "start session with locking SP using old Password failed\n"));
 297     goto done;
 298   }
 299
 300   //
 301   // Update admin locking SP to new pw
 302   //
 303   Ret = OpalSetPassword(Session, OPAL_LOCKING_SP_C_PIN_ADMIN1, NewPassword, NewPasswordLength, &MethodStatus);
 304   OpalEndSession(Session);
 305   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 306     DEBUG ((DEBUG_INFO, "set new locking SP Password failed\n"));
 307     goto done;
 308   }
 309
 310 done:
 311   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 312     Ret = TcgResultFailure;
 313   }
 314   return Ret;
 315 }
 316
 317 /**
 318   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 319   and sets the User1 SP authority to enabled and sets the User1 password.
 320
 321   @param[in]      Session,               The session info for one opal device.
 322   @param[in]      OldPassword        Current admin password
 323   @param[in]      OldPasswordLength  Length of current admin password in bytes
 324   @param[in]      NewPassword        New admin password to set
 325   @param[in]      NewPasswordLength  Length of new password in bytes
 326
 327 **/
 328 TCG_RESULT
 329 EFIAPI
 330 OpalUtilSetUserPassword(
 331   OPAL_SESSION    *Session,
 332   const VOID      *OldPassword,
 333   UINT32          OldPasswordLength,
 334   const VOID      *NewPassword,
 335   UINT32          NewPasswordLength
 336   )
 337 {
 338   UINT8        MethodStatus;
 339   TCG_RESULT   Ret;
 340
 341   NULL_CHECK(Session);
 342   NULL_CHECK(OldPassword);
 343   NULL_CHECK(NewPassword);
 344
 345   //
 346   // See if updating user1 authority
 347   //
 348   Ret = OpalStartSession(
 349                     Session,
 350                     OPAL_UID_LOCKING_SP,
 351                     TRUE,
 352                     OldPasswordLength,
 353                     OldPassword,
 354                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 355                     &MethodStatus
 356                     );
 357   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 358     Ret = OpalSetPassword(
 359                       Session,
 360                       OPAL_LOCKING_SP_C_PIN_USER1,
 361                       NewPassword,
 362                       NewPasswordLength,
 363                       &MethodStatus
 364                       );
 365     OpalEndSession(Session);
 366     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 367       return Ret;
 368     }
 369   }
 370
 371   //
 372   // Setting Password for first time or setting Password as admin
 373   //
 374
 375   //
 376   // Start session with Locking SP using current admin Password
 377   //
 378   Ret = OpalStartSession(
 379                     Session,
 380                     OPAL_UID_LOCKING_SP,
 381                     TRUE,
 382                     OldPasswordLength,
 383                     OldPassword,
 384                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 385                     &MethodStatus
 386                     );
 387   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 388     DEBUG ((DEBUG_INFO, "StartSession with locking SP as admin1 authority failed\n"));
 389     goto done;
 390   }
 391
 392   //
 393   // Enable User1 and set its PIN
 394   //
 395   Ret = OpalSetLockingSpAuthorityEnabledAndPin(
 396                                           Session,
 397                                           OPAL_LOCKING_SP_C_PIN_USER1,
 398                                           OPAL_LOCKING_SP_USER1_AUTHORITY,
 399                                           NewPassword,
 400                                           NewPasswordLength,
 401                                           &MethodStatus
 402                                           );
 403   OpalEndSession(Session);
 404   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 405     DEBUG ((DEBUG_INFO, "OpalSetLockingSpAuthorityEnabledAndPin failed\n"));
 406     goto done;
 407   }
 408
 409 done:
 410   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 411     Ret = TcgResultFailure;
 412   }
 413   return Ret;
 414 }
 415
 416 /**
 417   Verify whether user input the correct password.
 418
 419   @param[in]      Session,               The session info for one opal device.
 420   @param[in]      Password                    Admin password
 421   @param[in]      PasswordLength              Length of password in bytes
 422   @param[in/out]  HostSigningAuthority        Use the Host signing authority type.
 423
 424 **/
 425 TCG_RESULT
 426 EFIAPI
 427 OpalUtilVerifyPassword (
 428   OPAL_SESSION   *Session,
 429   const VOID     *Password,
 430   UINT32         PasswordLength,
 431   TCG_UID        HostSigningAuthority
 432   )
 433 {
 434   TCG_RESULT                    Ret;
 435   UINT8                         MethodStatus;
 436
 437   NULL_CHECK(Session);
 438   NULL_CHECK(Password);
 439
 440   Ret = OpalStartSession(
 441             Session,
 442             OPAL_UID_LOCKING_SP,
 443             TRUE,
 444             PasswordLength,
 445             Password,
 446             HostSigningAuthority,
 447             &MethodStatus);
 448   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 449     OpalEndSession(Session);
 450     return TcgResultSuccess;
 451   }
 452
 453   return TcgResultFailure;
 454 }
 455
 456 /**
 457   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 458   and generates a new global locking range key to erase the Data.
 459
 460   @param[in]      Session,               The session info for one opal device.
 461   @param[in]      Password                   Admin or user password
 462   @param[in]      PasswordLength         Length of password in bytes
 463   @param[in/out]  PasswordFailed       indicates if password failed (start session didn't work)
 464
 465 **/
 466 TCG_RESULT
 467 EFIAPI
 468 OpalUtilSecureErase(
 469   OPAL_SESSION     *Session,
 470   const VOID       *Password,
 471   UINT32           PasswordLength,
 472   BOOLEAN          *PasswordFailed
 473   )
 474 {
 475   UINT8        MethodStatus;
 476   TCG_RESULT   Ret;
 477
 478   NULL_CHECK(Session);
 479   NULL_CHECK(Password);
 480   NULL_CHECK(PasswordFailed);
 481
 482   //
 483   // Try to generate a new key with admin1
 484   //
 485   Ret = OpalStartSession(
 486                       Session,
 487                       OPAL_UID_LOCKING_SP,
 488                       TRUE,
 489                       PasswordLength,
 490                       Password,
 491                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 492                       &MethodStatus
 493                       );
 494
 495   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 496     Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 497     *PasswordFailed = FALSE;
 498     OpalEndSession(Session);
 499   } else {
 500     //
 501     // Try to generate a new key with user1
 502     //
 503     Ret = OpalStartSession(
 504                       Session,
 505                       OPAL_UID_LOCKING_SP,
 506                       TRUE,
 507                       PasswordLength,
 508                       Password,
 509                       OPAL_LOCKING_SP_USER1_AUTHORITY,
 510                       &MethodStatus
 511                       );
 512
 513     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 514       Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 515       *PasswordFailed = FALSE;
 516       OpalEndSession(Session);
 517     } else {
 518       *PasswordFailed = TRUE;
 519     }
 520   }
 521
 522   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 523     Ret = TcgResultFailure;
 524   }
 525   return Ret;
 526 }
 527
 528 /**
 529   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority.
 530
 531   @param[in]      Session,               The session info for one opal device.
 532   @param[in]      Password               Admin password
 533   @param[in]      PasswordLength         Length of password in bytes
 534   @param[in/out]  PasswordFailed         indicates if password failed (start session didn't work)
 535
 536 **/
 537 TCG_RESULT
 538 EFIAPI
 539 OpalUtilDisableUser(
 540   OPAL_SESSION   *Session,
 541   const VOID     *Password,
 542   UINT32         PasswordLength,
 543   BOOLEAN        *PasswordFailed
 544   )
 545 {
 546   UINT8        MethodStatus;
 547   TCG_RESULT   Ret;
 548
 549   NULL_CHECK(Session);
 550   NULL_CHECK(Password);
 551   NULL_CHECK(PasswordFailed);
 552
 553   //
 554   // Start session with Locking SP using current admin Password
 555   //
 556   Ret = OpalStartSession(
 557                     Session,
 558                     OPAL_UID_LOCKING_SP,
 559                     TRUE,
 560                     PasswordLength,
 561                     Password,
 562                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 563                     &MethodStatus
 564                     );
 565   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 566     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as Admin1 failed\n"));
 567     *PasswordFailed = TRUE;
 568     goto done;
 569   }
 570
 571   *PasswordFailed = FALSE;
 572   Ret = OpalDisableUser(Session, &MethodStatus);
 573   OpalEndSession(Session);
 574
 575 done:
 576   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 577     Ret = TcgResultFailure;
 578   }
 579   return Ret;
 580 }
 581
 582 /**
 583   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method.
 584
 585   @param[in]      Session,           The session info for one opal device.
 586   @param[in]      KeepUserData       TRUE to keep existing Data on the disk, or FALSE to erase it
 587   @param[in]      Password           Admin password
 588   @param[in]      PasswordLength     Length of password in bytes
 589   @param[in/out]  PasswordFailed     indicates if password failed (start session didn't work)
 590   @param[in]      Msid               Msid info.
 591   @param[in]      MsidLength         Msid data length.
 592
 593 **/
 594 TCG_RESULT
 595 EFIAPI
 596 OpalUtilRevert(
 597   OPAL_SESSION     *Session,
 598   BOOLEAN          KeepUserData,
 599   const VOID       *Password,
 600   UINT32           PasswordLength,
 601   BOOLEAN          *PasswordFailed,
 602   UINT8            *Msid,
 603   UINT32           MsidLength
 604   )
 605 {
 606   UINT8        MethodStatus;
 607   TCG_RESULT   Ret;
 608   UINT32       RemovalTimeOut;
 609
 610   NULL_CHECK(Session);
 611   NULL_CHECK(Msid);
 612   NULL_CHECK(Password);
 613   NULL_CHECK(PasswordFailed);
 614
 615   RemovalTimeOut = GetRevertTimeOut (Session);
 616   DEBUG ((DEBUG_INFO, "OpalUtilRevert: Timeout value = %d\n", RemovalTimeOut));
 617
 618   Ret = OpalStartSession(
 619                    Session,
 620                    OPAL_UID_LOCKING_SP,
 621                    TRUE,
 622                    PasswordLength,
 623                    Password,
 624                    OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 625                    &MethodStatus
 626                    );
 627
 628   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 629     DEBUG ((DEBUG_INFO, "error starting session: Ret=%d, MethodStatus=%u\n", Ret, MethodStatus));
 630     *PasswordFailed = TRUE;
 631     goto done;
 632   }
 633
 634   *PasswordFailed = FALSE;
 635   //
 636   // Try to revert with admin1
 637   //
 638   Ret = OpalPyrite2AdminRevert(Session, KeepUserData, &MethodStatus, RemovalTimeOut);
 639   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 640     //
 641     // Device ends the session on successful revert, so only call OpalEndSession when fail.
 642     //
 643     DEBUG ((DEBUG_INFO, "OpalAdminRevert as admin failed\n"));
 644     OpalEndSession(Session);
 645   }
 646
 647   Ret = OpalUtilSetSIDtoMSID (Session, Password, PasswordLength, Msid, MsidLength);
 648
 649 done:
 650   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 651     Ret = TcgResultFailure;
 652   }
 653   return Ret;
 654 }
 655
 656 /**
 657   After revert success, set SID to MSID.
 658
 659   @param          Session,           The session info for one opal device.
 660   @param          Password,          Input password info.
 661   @param          PasswordLength,    Input password length.
 662   @param          Msid               Msid info.
 663   @param          MsidLength         Msid data length.
 664
 665 **/
 666 TCG_RESULT
 667 EFIAPI
 668 OpalUtilSetSIDtoMSID (
 669   OPAL_SESSION     *Session,
 670   const VOID       *Password,
 671   UINT32           PasswordLength,
 672   UINT8            *Msid,
 673   UINT32           MsidLength
 674   )
 675 {
 676   TCG_RESULT                   Ret;
 677   UINT8                        MethodStatus;
 678
 679   NULL_CHECK(Session);
 680   NULL_CHECK(Msid);
 681   NULL_CHECK(Password);
 682
 683   //
 684   // Start session with admin sp to update SID to MSID
 685   //
 686   Ret = OpalStartSession(
 687             Session,
 688             OPAL_UID_ADMIN_SP,
 689             TRUE,
 690             PasswordLength,
 691             Password,
 692             OPAL_ADMIN_SP_SID_AUTHORITY,
 693             &MethodStatus
 694             );
 695   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 696     goto done;
 697   }
 698
 699   //
 700   // Update SID pin
 701   //
 702   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, Msid, MsidLength, &MethodStatus);
 703   OpalEndSession(Session);
 704
 705 done:
 706   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 707     Ret = TcgResultFailure;
 708   }
 709
 710   return Ret;
 711 }
 712
 713 /**
 714   Update global locking range.
 715
 716   @param          Session,           The session info for one opal device.
 717   @param          Password,          Input password info.
 718   @param          PasswordLength,    Input password length.
 719   @param          ReadLocked,        Read lock info.
 720   @param          WriteLocked        write lock info.
 721
 722 **/
 723 TCG_RESULT
 724 EFIAPI
 725 OpalUtilUpdateGlobalLockingRange(
 726   OPAL_SESSION    *Session,
 727   const VOID      *Password,
 728   UINT32          PasswordLength,
 729   BOOLEAN         ReadLocked,
 730   BOOLEAN         WriteLocked
 731   )
 732 {
 733   UINT8        MethodStatus;
 734   TCG_RESULT   Ret;
 735
 736   NULL_CHECK(Session);
 737   NULL_CHECK(Password);
 738
 739   //
 740   // Try to start session with Locking SP as admin1 authority
 741   //
 742   Ret = OpalStartSession(
 743                     Session,
 744                     OPAL_UID_LOCKING_SP,
 745                     TRUE,
 746                     PasswordLength,
 747                     Password,
 748                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 749                     &MethodStatus
 750                     );
 751   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 752     Ret = OpalUpdateGlobalLockingRange(
 753                                 Session,
 754                                 ReadLocked,
 755                                 WriteLocked,
 756                                 &MethodStatus
 757                                 );
 758     OpalEndSession(Session);
 759     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 760       goto done;
 761     }
 762   }
 763
 764   if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) {
 765     DEBUG ((DEBUG_INFO, "unlock as admin failed with AUTHORITY_LOCKED_OUT\n"));
 766     goto done;
 767   }
 768
 769   //
 770   // Try user1 authority
 771   //
 772   Ret = OpalStartSession(
 773                     Session,
 774                     OPAL_UID_LOCKING_SP,
 775                     TRUE,
 776                     PasswordLength,
 777                     Password,
 778                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 779                     &MethodStatus
 780                     );
 781   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 782     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as User1 failed\n"));
 783     goto done;
 784   }
 785
 786   Ret = OpalUpdateGlobalLockingRange(Session, ReadLocked, WriteLocked, &MethodStatus);
 787   OpalEndSession(Session);
 788
 789 done:
 790   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 791     Ret = TcgResultFailure;
 792   }
 793   return Ret;
 794 }
 795
 796 /**
 797   Update global locking range.
 798
 799   @param          Session,           The session info for one opal device.
 800   @param          Msid,              The data buffer to save Msid info.
 801   @param          MsidBufferLength,  The data buffer length for Msid.
 802   @param          MsidLength,        The actual data length for Msid.
 803
 804 **/
 805 TCG_RESULT
 806 EFIAPI
 807 OpalUtilGetMsid(
 808   OPAL_SESSION    *Session,
 809   UINT8           *Msid,
 810   UINT32          MsidBufferLength,
 811   UINT32          *MsidLength
 812   )
 813 {
 814   UINT8        MethodStatus;
 815   TCG_RESULT   Ret;
 816
 817   NULL_CHECK(Session);
 818   NULL_CHECK(Msid);
 819   NULL_CHECK(MsidLength);
 820
 821   Ret = OpalStartSession(
 822                    Session,
 823                    OPAL_UID_ADMIN_SP,
 824                    TRUE,
 825                    0,
 826                    NULL,
 827                    TCG_UID_NULL,
 828                    &MethodStatus
 829                    );
 830   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 831     Ret = OpalGetMsid (Session, MsidBufferLength, Msid, MsidLength);
 832     OpalEndSession (Session);
 833   }
 834
 835   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 836     Ret = TcgResultFailure;
 837   }
 838
 839   return Ret;
 840 }
 841
 842 /**
 843
 844   The function determines who owns the device by attempting to start a session with different credentials.
 845   If the SID PIN matches the MSID PIN, the no one owns the device.
 846   If the SID PIN matches the ourSidPin, then "Us" owns the device.  Otherwise it is unknown.
 847
 848
 849   @param[in]      Session            The session info for one opal device.
 850   @param          Msid,              The Msid info.
 851   @param          MsidLength,        The data length for Msid.
 852
 853 **/
 854 OPAL_OWNER_SHIP
 855 EFIAPI
 856 OpalUtilDetermineOwnership(
 857   OPAL_SESSION       *Session,
 858   UINT8              *Msid,
 859   UINT32             MsidLength
 860   )
 861 {
 862   UINT8            MethodStatus;
 863   TCG_RESULT       Ret;
 864   OPAL_OWNER_SHIP  Owner;
 865
 866   if ((Session == NULL) || (Msid == NULL)) {
 867     return OpalOwnershipUnknown;
 868   }
 869
 870   Owner = OpalOwnershipUnknown;
 871   //
 872   // Start Session as SID_UID with ADMIN_SP using MSID PIN
 873   //
 874   Ret = OpalStartSession(
 875                     Session,
 876                     OPAL_UID_ADMIN_SP,
 877                     TRUE,
 878                     MsidLength,
 879                     Msid,
 880                     OPAL_ADMIN_SP_SID_AUTHORITY,
 881                     &MethodStatus);
 882   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 883     //
 884     // now we know that SID PIN == MSID PIN
 885     //
 886     Owner = OpalOwnershipNobody;
 887
 888     OpalEndSession(Session);
 889   }
 890
 891   return Owner;
 892 }
 893
 894 /**
 895
 896   The function returns if admin password exists.
 897
 898   @param[in]      OwnerShip         The owner ship of the opal device.
 899   @param[in]      LockingFeature    The locking info of the opal device.
 900
 901   @retval         TRUE              Admin password existed.
 902   @retval         FALSE             Admin password not existed.
 903
 904 **/
 905 BOOLEAN
 906 EFIAPI
 907 OpalUtilAdminPasswordExists(
 908   IN  UINT16                           OwnerShip,
 909   IN  TCG_LOCKING_FEATURE_DESCRIPTOR   *LockingFeature
 910   )
 911 {
 912   NULL_CHECK(LockingFeature);
 913
 914   // if it is Unknown who owns the device
 915   // then someone has set password previously through our UI
 916   // because the SID would no longer match the generated SID (ownership us)
 917   // or someone has set password using 3rd party software
 918
 919   //
 920   // Locking sp enabled is checked b/c it must be enabled to change the PIN of the Admin1.
 921   //
 922   return (OwnerShip == OpalOwnershipUnknown && LockingFeature->LockingEnabled);
 923 }
 924
 925 /**
 926   Get Active Data Removal Mechanism Value.
 927
 928   @param[in]      Session                        The session info for one opal device.
 929   @param[in]      GeneratedSid                   Generated SID of disk
 930   @param[in]      SidLength                      Length of generatedSid in bytes
 931   @param[out]     ActiveDataRemovalMechanism     Return the active data removal mechanism.
 932
 933 **/
 934 TCG_RESULT
 935 EFIAPI
 936 OpalUtilGetActiveDataRemovalMechanism (
 937   OPAL_SESSION      *Session,
 938   const VOID        *GeneratedSid,
 939   UINT32            SidLength,
 940   UINT8             *ActiveDataRemovalMechanism
 941   )
 942 {
 943   TCG_RESULT   Ret;
 944   UINT8        MethodStatus;
 945
 946   NULL_CHECK(Session);
 947   NULL_CHECK(GeneratedSid);
 948   NULL_CHECK(ActiveDataRemovalMechanism);
 949
 950   Ret = OpalStartSession(
 951                     Session,
 952                     OPAL_UID_ADMIN_SP,
 953                     TRUE,
 954                     SidLength,
 955                     GeneratedSid,
 956                     OPAL_ADMIN_SP_ANYBODY_AUTHORITY,
 957                     &MethodStatus
 958                     );
 959   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 960     DEBUG ((DEBUG_INFO, "Start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 961     if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 962       Ret = TcgResultFailure;
 963     }
 964     return Ret;
 965   }
 966
 967   Ret = OpalPyrite2GetActiveDataRemovalMechanism (
 968                     Session,
 969                     ActiveDataRemovalMechanism
 970                     );
 971
 972   if (Ret != TcgResultSuccess) {
 973     DEBUG ((DEBUG_INFO, "Pyrite2 Get Active Data Removal Mechanism failed: Ret=%d\n", Ret));
 974   }
 975
 976   OpalEndSession(Session);
 977
 978   return Ret;
 979 }
 980
 981 /**
 982   Calculate the estimated time.
 983
 984   @param[in]      IsMinute               Whether the input time value is minute type or second type.
 985   @param[in]      Time                   The input time value.
 986
 987 **/
 988 UINT32
 989 CalculateDataRemovalTime (
 990   IN BOOLEAN               IsMinute,
 991   IN UINT16                Time
 992   )
 993 {
 994   if (IsMinute) {
 995     return Time * 2 * 60;
 996   } else {
 997     return Time * 2;
 998   }
 999 }
1000
1001 /**
1002   Return the estimated time for specific type.
1003
1004   @param[in]      Index               The input data removal type.
1005   @param[in]      Descriptor          DATA_REMOVAL_FEATURE_DESCRIPTOR
1006
1007 **/
1008 UINT32
1009 GetDataRemovalTime (
1010   IN  UINT8                            Index,
1011   IN  DATA_REMOVAL_FEATURE_DESCRIPTOR  *Descriptor
1012   )
1013 {
1014   switch (Index) {
1015   case OverwriteDataErase:
1016     return CalculateDataRemovalTime (Descriptor->FormatBit0, SwapBytes16 (Descriptor->TimeBit0));
1017
1018   case BlockErase:
1019     return CalculateDataRemovalTime (Descriptor->FormatBit1, SwapBytes16 (Descriptor->TimeBit1));
1020
1021   case CryptoErase:
1022     return CalculateDataRemovalTime (Descriptor->FormatBit2, SwapBytes16 (Descriptor->TimeBit2));
1023
1024   case Unmap:
1025     return CalculateDataRemovalTime (Descriptor->FormatBit3, SwapBytes16 (Descriptor->TimeBit3));
1026
1027   case ResetWritePointers:
1028     return CalculateDataRemovalTime (Descriptor->FormatBit4, SwapBytes16 (Descriptor->TimeBit4));
1029
1030   case VendorSpecificErase:
1031     return CalculateDataRemovalTime (Descriptor->FormatBit5, SwapBytes16 (Descriptor->TimeBit5));
1032
1033   default:
1034     return 0;
1035   }
1036 }
1037
1038 /**
1039   Get the supported Data Removal Mechanism list.
1040
1041   @param[in]      Session                        The session info for one opal device.
1042   @param[out]     RemovalMechanismLists          Return the supported data removal mechanism lists.
1043
1044 **/
1045 TCG_RESULT
1046 EFIAPI
1047 OpalUtilGetDataRemovalMechanismLists (
1048   IN  OPAL_SESSION      *Session,
1049   OUT UINT32            *RemovalMechanismLists
1050   )
1051 {
1052   TCG_RESULT                       Ret;
1053   UINTN                            DataSize;
1054   DATA_REMOVAL_FEATURE_DESCRIPTOR  Descriptor;
1055   UINT8                            Index;
1056   UINT8                            BitValue;
1057
1058   NULL_CHECK(Session);
1059   NULL_CHECK(RemovalMechanismLists);
1060
1061   DataSize = sizeof (Descriptor);
1062   Ret = OpalGetFeatureDescriptor (Session, TCG_FEATURE_DATA_REMOVAL, &DataSize, &Descriptor);
1063   if (Ret != TcgResultSuccess) {
1064     return TcgResultFailure;
1065   }
1066
1067   ASSERT (Descriptor.RemovalMechanism != 0);
1068
1069   for (Index = 0; Index < ResearvedMechanism; Index ++) {
1070     BitValue = (BOOLEAN) BitFieldRead8 (Descriptor.RemovalMechanism, Index, Index);
1071
1072     if (BitValue == 0) {
1073       RemovalMechanismLists[Index] = 0;
1074     } else {
1075       RemovalMechanismLists[Index] = GetDataRemovalTime (Index, &Descriptor);
1076     }
1077   }
1078
1079   return TcgResultSuccess;
1080 }
1081
1082 /**
1083   Get revert timeout value.
1084
1085   @param[in]      Session                       The session info for one opal device.
1086
1087 **/
1088 UINT32
1089 GetRevertTimeOut (
1090   IN OPAL_SESSION                *Session
1091   )
1092 {
1093   TCG_RESULT                   TcgResult;
1094   OPAL_DISK_SUPPORT_ATTRIBUTE  SupportedAttributes;
1095   UINT16                       BaseComId;
1096   UINT32                       MsidLength;
1097   UINT8                        Msid[OPAL_MSID_LENGHT];
1098   UINT32                       RemovalMechanishLists[ResearvedMechanism];
1099   UINT8                        ActiveDataRemovalMechanism;
1100
1101   TcgResult = OpalGetSupportedAttributesInfo (Session, &SupportedAttributes, &BaseComId);
1102   if (TcgResult != TcgResultSuccess || SupportedAttributes.DataRemoval == 0) {
1103     return 0;
1104   }
1105
1106   TcgResult = OpalUtilGetMsid (Session, Msid, OPAL_MSID_LENGHT, &MsidLength);
1107   if (TcgResult != TcgResultSuccess) {
1108     return 0;
1109   }
1110
1111   TcgResult = OpalUtilGetDataRemovalMechanismLists (Session, RemovalMechanishLists);
1112   if (TcgResult != TcgResultSuccess) {
1113     return 0;
1114   }
1115
1116   TcgResult = OpalUtilGetActiveDataRemovalMechanism (Session, Msid, MsidLength, &ActiveDataRemovalMechanism);
1117   if (TcgResult != TcgResultSuccess) {
1118     return 0;
1119   }
1120
1121   return RemovalMechanishLists[ActiveDataRemovalMechanism];
1122 }