SecurityPkg/Library/TcgStorageOpalLib/TcgStorageOpalUtil.c

   1 /** @file
   2   Public API for Opal Core library.
   3
   4 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14 #include <Uefi.h>
  15 #include <Library/BaseLib.h>
  16 #include <Library/DebugLib.h>
  17 #include <Library/TcgStorageOpalLib.h>
  18 #include "TcgStorageOpalLibInternal.h"
  19
  20 #define OPAL_MSID_LENGHT        128
  21
  22 /**
  23   Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method.
  24
  25   @param[in]      Session,           The session info for one opal device.
  26   @param[in]      Psid               PSID of device to revert.
  27   @param[in]      PsidLength         Length of PSID in bytes.
  28
  29 **/
  30 TCG_RESULT
  31 EFIAPI
  32 OpalUtilPsidRevert(
  33   OPAL_SESSION   *Session,
  34   const VOID     *Psid,
  35   UINT32         PsidLength
  36   )
  37 {
  38   UINT8        MethodStatus;
  39   TCG_RESULT   Ret;
  40   UINT32       RemovalTimeOut;
  41
  42   NULL_CHECK(Session);
  43   NULL_CHECK(Psid);
  44
  45   RemovalTimeOut = GetRevertTimeOut (Session);
  46   DEBUG ((DEBUG_INFO, "OpalUtilPsidRevert: Timeout value = %d\n", RemovalTimeOut));
  47
  48   Ret = OpalStartSession(
  49                       Session,
  50                       OPAL_UID_ADMIN_SP,
  51                       TRUE,
  52                       PsidLength,
  53                       Psid,
  54                       OPAL_ADMIN_SP_PSID_AUTHORITY,
  55                       &MethodStatus);
  56   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
  57     Ret = OpalPyrite2PsidRevert(Session, RemovalTimeOut);
  58     if (Ret != TcgResultSuccess) {
  59       //
  60       // If revert was successful, session was already ended by TPer, so only end session on failure
  61       //
  62       OpalEndSession(Session);
  63     }
  64   }
  65
  66   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
  67     Ret = TcgResultFailure;
  68   }
  69
  70   return Ret;
  71 }
  72
  73 /**
  74   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
  75   sets the OPAL_UID_ADMIN_SP_C_PIN_SID column with the new password,
  76   and activates the locking SP to copy SID PIN to Admin1 Locking SP PIN
  77
  78   @param[in]      Session,           The session info for one opal device.
  79   @param[in]      GeneratedSid       Generated SID of disk
  80   @param[in]      SidLength          Length of generatedSid in bytes
  81   @param[in]      Password           New admin password to set
  82   @param[in]      PassLength         Length of password in bytes
  83
  84 **/
  85 TCG_RESULT
  86 EFIAPI
  87 OpalUtilSetAdminPasswordAsSid(
  88   OPAL_SESSION      *Session,
  89   const VOID        *GeneratedSid,
  90   UINT32            SidLength,
  91   const VOID        *Password,
  92   UINT32            PassLength
  93   )
  94 {
  95   UINT8        MethodStatus;
  96   TCG_RESULT   Ret;
  97
  98   NULL_CHECK(Session);
  99   NULL_CHECK(GeneratedSid);
 100   NULL_CHECK(Password);
 101
 102   Ret = OpalStartSession(
 103                     Session,
 104                     OPAL_UID_ADMIN_SP,
 105                     TRUE,
 106                     SidLength,
 107                     GeneratedSid,
 108                     OPAL_ADMIN_SP_SID_AUTHORITY,
 109                     &MethodStatus
 110                     );
 111   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 112     DEBUG ((DEBUG_INFO, "start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 113     goto done;
 114   }
 115
 116   //
 117   // 1. Update SID = new Password
 118   //
 119   Ret = OpalSetPassword(
 120                     Session,
 121                     OPAL_UID_ADMIN_SP_C_PIN_SID,
 122                     Password,
 123                     PassLength,
 124                     &MethodStatus
 125                     );
 126
 127   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 128     OpalEndSession(Session);
 129     DEBUG ((DEBUG_INFO, "set Password failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 130     goto done;
 131   }
 132
 133   //
 134   // 2. Activate locking SP
 135   //
 136   Ret = OpalActivateLockingSp(Session, &MethodStatus);
 137   OpalEndSession(Session);
 138   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 139     DEBUG ((DEBUG_INFO, "activate locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 140     goto done;
 141   }
 142
 143 done:
 144   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 145     Ret = TcgResultFailure;
 146   }
 147   return Ret;
 148 }
 149
 150 /**
 151
 152   Opens a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 153   and updates the specified locking range with the provided column values
 154
 155   @param[in]      Session,               The session info for one opal device.
 156   @param[in]      Password           New admin password to set
 157   @param[in]      PassLength         Length of password in bytes
 158   @param[in]      LockingRangeUid    Locking range UID to set values
 159   @param[in]      RangeStart         Value to set RangeStart column for Locking Range
 160   @param[in]      RangeLength        Value to set RangeLength column for Locking Range
 161   @param[in]      ReadLockEnabled    Value to set readLockEnabled column for Locking Range
 162   @param[in]      WriteLockEnabled   Value to set writeLockEnabled column for Locking Range
 163   @param[in]      ReadLocked         Value to set ReadLocked column for Locking Range
 164   @param[in]      WriteLocked        Value to set WriteLocked column for Locking Range
 165
 166 **/
 167 TCG_RESULT
 168 EFIAPI
 169 OpalUtilSetOpalLockingRange(
 170   OPAL_SESSION   *Session,
 171   const VOID     *Password,
 172   UINT32         PassLength,
 173   TCG_UID        LockingRangeUid,
 174   UINT64         RangeStart,
 175   UINT64         RangeLength,
 176   BOOLEAN        ReadLockEnabled,
 177   BOOLEAN        WriteLockEnabled,
 178   BOOLEAN        ReadLocked,
 179   BOOLEAN        WriteLocked
 180   )
 181 {
 182   UINT8        MethodStatus;
 183   TCG_RESULT   Ret;
 184
 185   NULL_CHECK(Session);
 186   NULL_CHECK(Password);
 187
 188   //
 189   // Start session with Locking SP using current admin Password
 190   //
 191   Ret = OpalStartSession(
 192                       Session,
 193                       OPAL_UID_LOCKING_SP,
 194                       TRUE,
 195                       PassLength,
 196                       Password,
 197                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 198                       &MethodStatus);
 199   if ((Ret != TcgResultSuccess) || (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS)) {
 200     DEBUG ((DEBUG_INFO, "start session with locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 201     goto done;
 202   }
 203
 204   //
 205   // Enable locking range
 206   //
 207   Ret = OpalSetLockingRange(
 208             Session,
 209             LockingRangeUid,
 210             RangeStart,
 211             RangeLength,
 212             ReadLockEnabled,
 213             WriteLockEnabled,
 214             ReadLocked,
 215             WriteLocked,
 216             &MethodStatus);
 217
 218   OpalEndSession(Session);
 219   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 220     DEBUG ((DEBUG_INFO, "set locking range failed: Ret=%d MethodStatus=0x%x\n", Ret, MethodStatus));
 221   }
 222
 223 done:
 224   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 225     Ret = TcgResultFailure;
 226   }
 227   return Ret;
 228 }
 229
 230 /**
 231   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
 232   sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password,
 233   and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password.
 234
 235   @param[in]      Session,               The session info for one opal device.
 236   @param[in]      OldPassword        Current admin password
 237   @param[in]      OldPasswordLength  Length of current admin password in bytes
 238   @param[in]      NewPassword        New admin password to set
 239   @param[in]      NewPasswordLength  Length of new password in bytes
 240
 241 **/
 242 TCG_RESULT
 243 EFIAPI
 244 OpalUtilSetAdminPassword(
 245   OPAL_SESSION  *Session,
 246   const VOID    *OldPassword,
 247   UINT32        OldPasswordLength,
 248   const VOID    *NewPassword,
 249   UINT32        NewPasswordLength
 250   )
 251 {
 252   TCG_RESULT   Ret;
 253   UINT8        MethodStatus;
 254
 255   NULL_CHECK(Session);
 256   NULL_CHECK(OldPassword);
 257   NULL_CHECK(NewPassword);
 258
 259   //
 260   // Unknown ownership
 261   //
 262   Ret = OpalStartSession(
 263                   Session,
 264                   OPAL_UID_ADMIN_SP,
 265                   TRUE,
 266                   OldPasswordLength,
 267                   OldPassword,
 268                   OPAL_ADMIN_SP_SID_AUTHORITY,
 269                   &MethodStatus
 270                   );
 271   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 272     DEBUG ((DEBUG_INFO, "start session with admin SP using old Password failed\n"));
 273     goto done;
 274   }
 275
 276   //
 277   // Update SID = new pw
 278   //
 279   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, NewPassword, NewPasswordLength, &MethodStatus);
 280   OpalEndSession(Session);
 281   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 282     DEBUG ((DEBUG_INFO, "set new admin SP Password failed\n"));
 283     goto done;
 284   }
 285
 286   Ret = OpalStartSession(
 287                   Session,
 288                   OPAL_UID_LOCKING_SP,
 289                   TRUE,
 290                   OldPasswordLength,
 291                   OldPassword,
 292                   OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 293                   &MethodStatus
 294                   );
 295   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 296     DEBUG ((DEBUG_INFO, "start session with locking SP using old Password failed\n"));
 297     goto done;
 298   }
 299
 300   //
 301   // Update admin locking SP to new pw
 302   //
 303   Ret = OpalSetPassword(Session, OPAL_LOCKING_SP_C_PIN_ADMIN1, NewPassword, NewPasswordLength, &MethodStatus);
 304   OpalEndSession(Session);
 305   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 306     DEBUG ((DEBUG_INFO, "set new locking SP Password failed\n"));
 307     goto done;
 308   }
 309
 310 done:
 311   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 312     Ret = TcgResultFailure;
 313   }
 314   return Ret;
 315 }
 316
 317 /**
 318   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 319   and sets the User1 SP authority to enabled and sets the User1 password.
 320
 321   @param[in]      Session,               The session info for one opal device.
 322   @param[in]      OldPassword        Current admin password
 323   @param[in]      OldPasswordLength  Length of current admin password in bytes
 324   @param[in]      NewPassword        New admin password to set
 325   @param[in]      NewPasswordLength  Length of new password in bytes
 326
 327 **/
 328 TCG_RESULT
 329 EFIAPI
 330 OpalUtilSetUserPassword(
 331   OPAL_SESSION    *Session,
 332   const VOID      *OldPassword,
 333   UINT32          OldPasswordLength,
 334   const VOID      *NewPassword,
 335   UINT32          NewPasswordLength
 336   )
 337 {
 338   UINT8        MethodStatus;
 339   TCG_RESULT   Ret;
 340
 341   NULL_CHECK(Session);
 342   NULL_CHECK(OldPassword);
 343   NULL_CHECK(NewPassword);
 344
 345   //
 346   // See if updating user1 authority
 347   //
 348   Ret = OpalStartSession(
 349                     Session,
 350                     OPAL_UID_LOCKING_SP,
 351                     TRUE,
 352                     OldPasswordLength,
 353                     OldPassword,
 354                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 355                     &MethodStatus
 356                     );
 357   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 358     Ret = OpalSetPassword(
 359                       Session,
 360                       OPAL_LOCKING_SP_C_PIN_USER1,
 361                       NewPassword,
 362                       NewPasswordLength,
 363                       &MethodStatus
 364                       );
 365     OpalEndSession(Session);
 366     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 367       return Ret;
 368     }
 369   }
 370
 371   //
 372   // Setting Password for first time or setting Password as admin
 373   //
 374
 375   //
 376   // Start session with Locking SP using current admin Password
 377   //
 378   Ret = OpalStartSession(
 379                     Session,
 380                     OPAL_UID_LOCKING_SP,
 381                     TRUE,
 382                     OldPasswordLength,
 383                     OldPassword,
 384                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 385                     &MethodStatus
 386                     );
 387   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 388     DEBUG ((DEBUG_INFO, "StartSession with locking SP as admin1 authority failed\n"));
 389     goto done;
 390   }
 391
 392   //
 393   // Enable User1 and set its PIN
 394   //
 395   Ret = OpalSetLockingSpAuthorityEnabledAndPin(
 396                                           Session,
 397                                           OPAL_LOCKING_SP_C_PIN_USER1,
 398                                           OPAL_LOCKING_SP_USER1_AUTHORITY,
 399                                           NewPassword,
 400                                           NewPasswordLength,
 401                                           &MethodStatus
 402                                           );
 403   OpalEndSession(Session);
 404   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 405     DEBUG ((DEBUG_INFO, "OpalSetLockingSpAuthorityEnabledAndPin failed\n"));
 406     goto done;
 407   }
 408
 409 done:
 410   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 411     Ret = TcgResultFailure;
 412   }
 413   return Ret;
 414 }
 415
 416 /**
 417   Verify whether user input the correct password.
 418
 419   @param[in]      Session,               The session info for one opal device.
 420   @param[in]      Password                    Admin password
 421   @param[in]      PasswordLength              Length of password in bytes
 422   @param[in/out]  HostSigningAuthority        Use the Host signing authority type.
 423
 424 **/
 425 TCG_RESULT
 426 EFIAPI
 427 OpalUtilVerifyPassword (
 428   OPAL_SESSION   *Session,
 429   const VOID     *Password,
 430   UINT32         PasswordLength,
 431   TCG_UID        HostSigningAuthority
 432   )
 433 {
 434   TCG_RESULT                    Ret;
 435   UINT8                         MethodStatus;
 436
 437   NULL_CHECK(Session);
 438   NULL_CHECK(Password);
 439
 440   Ret = OpalStartSession(
 441             Session,
 442             OPAL_UID_LOCKING_SP,
 443             TRUE,
 444             PasswordLength,
 445             Password,
 446             HostSigningAuthority,
 447             &MethodStatus);
 448   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 449     OpalEndSession(Session);
 450     return TcgResultSuccess;
 451   }
 452
 453   return TcgResultFailure;
 454 }
 455
 456 /**
 457   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
 458   and generates a new global locking range key to erase the Data.
 459
 460   @param[in]      Session,               The session info for one opal device.
 461   @param[in]      Password                   Admin or user password
 462   @param[in]      PasswordLength         Length of password in bytes
 463   @param[in/out]  PasswordFailed       indicates if password failed (start session didn't work)
 464
 465 **/
 466 TCG_RESULT
 467 EFIAPI
 468 OpalUtilSecureErase(
 469   OPAL_SESSION     *Session,
 470   const VOID       *Password,
 471   UINT32           PasswordLength,
 472   BOOLEAN          *PasswordFailed
 473   )
 474 {
 475   UINT8        MethodStatus;
 476   TCG_RESULT   Ret;
 477
 478   NULL_CHECK(Session);
 479   NULL_CHECK(Password);
 480   NULL_CHECK(PasswordFailed);
 481
 482   //
 483   // Try to generate a new key with admin1
 484   //
 485   Ret = OpalStartSession(
 486                       Session,
 487                       OPAL_UID_LOCKING_SP,
 488                       TRUE,
 489                       PasswordLength,
 490                       Password,
 491                       OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 492                       &MethodStatus
 493                       );
 494
 495   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 496     Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 497     *PasswordFailed = FALSE;
 498     OpalEndSession(Session);
 499   } else {
 500     //
 501     // Try to generate a new key with user1
 502     //
 503     Ret = OpalStartSession(
 504                       Session,
 505                       OPAL_UID_LOCKING_SP,
 506                       TRUE,
 507                       PasswordLength,
 508                       Password,
 509                       OPAL_LOCKING_SP_USER1_AUTHORITY,
 510                       &MethodStatus
 511                       );
 512
 513     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 514       Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus);
 515       *PasswordFailed = FALSE;
 516       OpalEndSession(Session);
 517     } else {
 518       *PasswordFailed = TRUE;
 519     }
 520   }
 521
 522   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 523     Ret = TcgResultFailure;
 524   }
 525   return Ret;
 526 }
 527
 528 /**
 529   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority.
 530
 531   @param[in]      Session,               The session info for one opal device.
 532   @param[in]      Password               Admin password
 533   @param[in]      PasswordLength         Length of password in bytes
 534   @param[in/out]  PasswordFailed         indicates if password failed (start session didn't work)
 535
 536 **/
 537 TCG_RESULT
 538 EFIAPI
 539 OpalUtilDisableUser(
 540   OPAL_SESSION   *Session,
 541   const VOID     *Password,
 542   UINT32         PasswordLength,
 543   BOOLEAN        *PasswordFailed
 544   )
 545 {
 546   UINT8        MethodStatus;
 547   TCG_RESULT   Ret;
 548
 549   NULL_CHECK(Session);
 550   NULL_CHECK(Password);
 551   NULL_CHECK(PasswordFailed);
 552
 553   //
 554   // Start session with Locking SP using current admin Password
 555   //
 556   Ret = OpalStartSession(
 557                     Session,
 558                     OPAL_UID_LOCKING_SP,
 559                     TRUE,
 560                     PasswordLength,
 561                     Password,
 562                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 563                     &MethodStatus
 564                     );
 565   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 566     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as Admin1 failed\n"));
 567     *PasswordFailed = TRUE;
 568     goto done;
 569   }
 570
 571   *PasswordFailed = FALSE;
 572   Ret = OpalDisableUser(Session, &MethodStatus);
 573   OpalEndSession(Session);
 574
 575 done:
 576   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 577     Ret = TcgResultFailure;
 578   }
 579   return Ret;
 580 }
 581
 582 /**
 583   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method.
 584
 585   @param[in]      Session,           The session info for one opal device.
 586   @param[in]      KeepUserData       TRUE to keep existing Data on the disk, or FALSE to erase it
 587   @param[in]      Password           Admin password
 588   @param[in]      PasswordLength     Length of password in bytes
 589   @param[in/out]  PasswordFailed     indicates if password failed (start session didn't work)
 590   @param[in]      Msid               Msid info.
 591   @param[in]      MsidLength         Msid data length.
 592
 593 **/
 594 TCG_RESULT
 595 EFIAPI
 596 OpalUtilRevert(
 597   OPAL_SESSION     *Session,
 598   BOOLEAN          KeepUserData,
 599   const VOID       *Password,
 600   UINT32           PasswordLength,
 601   BOOLEAN          *PasswordFailed,
 602   UINT8            *Msid,
 603   UINT32           MsidLength
 604   )
 605 {
 606   UINT8        MethodStatus;
 607   TCG_RESULT   Ret;
 608   UINT32       RemovalTimeOut;
 609
 610   NULL_CHECK(Session);
 611   NULL_CHECK(Msid);
 612   NULL_CHECK(Password);
 613   NULL_CHECK(PasswordFailed);
 614
 615   RemovalTimeOut = GetRevertTimeOut (Session);
 616   DEBUG ((DEBUG_INFO, "OpalUtilRevert: Timeout value = %d\n", RemovalTimeOut));
 617
 618   Ret = OpalStartSession(
 619                    Session,
 620                    OPAL_UID_LOCKING_SP,
 621                    TRUE,
 622                    PasswordLength,
 623                    Password,
 624                    OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 625                    &MethodStatus
 626                    );
 627
 628   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 629     DEBUG ((DEBUG_INFO, "error starting session: Ret=%d, MethodStatus=%u\n", Ret, MethodStatus));
 630     *PasswordFailed = TRUE;
 631     goto done;
 632   }
 633
 634   *PasswordFailed = FALSE;
 635   //
 636   // Try to revert with admin1
 637   //
 638   Ret = OpalPyrite2AdminRevert(Session, KeepUserData, &MethodStatus, RemovalTimeOut);
 639   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 640     //
 641     // Device ends the session on successful revert, so only call OpalEndSession when fail.
 642     //
 643     DEBUG ((DEBUG_INFO, "OpalAdminRevert as admin failed\n"));
 644     OpalEndSession(Session);
 645   }
 646
 647   Ret = OpalUtilSetSIDtoMSID (Session, Password, PasswordLength, Msid, MsidLength);
 648
 649 done:
 650   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 651     Ret = TcgResultFailure;
 652   }
 653   return Ret;
 654 }
 655
 656 /**
 657   After revert success, set SID to MSID.
 658
 659   @param          Session,           The session info for one opal device.
 660   @param          Password,          Input password info.
 661   @param          PasswordLength,    Input password length.
 662   @param          Msid               Msid info.
 663   @param          MsidLength         Msid data length.
 664
 665 **/
 666 TCG_RESULT
 667 EFIAPI
 668 OpalUtilSetSIDtoMSID (
 669   OPAL_SESSION     *Session,
 670   const VOID       *Password,
 671   UINT32           PasswordLength,
 672   UINT8            *Msid,
 673   UINT32           MsidLength
 674   )
 675 {
 676   TCG_RESULT                   Ret;
 677   UINT8                        MethodStatus;
 678
 679   NULL_CHECK(Session);
 680   NULL_CHECK(Msid);
 681   NULL_CHECK(Password);
 682
 683   //
 684   // Start session with admin sp to update SID to MSID
 685   //
 686   Ret = OpalStartSession(
 687             Session,
 688             OPAL_UID_ADMIN_SP,
 689             TRUE,
 690             PasswordLength,
 691             Password,
 692             OPAL_ADMIN_SP_SID_AUTHORITY,
 693             &MethodStatus
 694             );
 695   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 696     goto done;
 697   }
 698
 699   //
 700   // Update SID pin
 701   //
 702   Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, Msid, MsidLength, &MethodStatus);
 703   OpalEndSession(Session);
 704
 705 done:
 706   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 707     Ret = TcgResultFailure;
 708   }
 709
 710   return Ret;
 711 }
 712
 713 /**
 714   Update global locking range.
 715
 716   @param          Session,           The session info for one opal device.
 717   @param          Password,          Input password info.
 718   @param          PasswordLength,    Input password length.
 719   @param          ReadLocked,        Read lock info.
 720   @param          WriteLocked        write lock info.
 721
 722 **/
 723 TCG_RESULT
 724 EFIAPI
 725 OpalUtilUpdateGlobalLockingRange(
 726   OPAL_SESSION    *Session,
 727   const VOID      *Password,
 728   UINT32          PasswordLength,
 729   BOOLEAN         ReadLocked,
 730   BOOLEAN         WriteLocked
 731   )
 732 {
 733   UINT8        MethodStatus;
 734   TCG_RESULT   Ret;
 735
 736   NULL_CHECK(Session);
 737   NULL_CHECK(Password);
 738
 739   //
 740   // Try to start session with Locking SP as admin1 authority
 741   //
 742   Ret = OpalStartSession(
 743                     Session,
 744                     OPAL_UID_LOCKING_SP,
 745                     TRUE,
 746                     PasswordLength,
 747                     Password,
 748                     OPAL_LOCKING_SP_ADMIN1_AUTHORITY,
 749                     &MethodStatus
 750                     );
 751   if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 752     Ret = OpalUpdateGlobalLockingRange(
 753                                 Session,
 754                                 ReadLocked,
 755                                 WriteLocked,
 756                                 &MethodStatus
 757                                 );
 758     OpalEndSession(Session);
 759     if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) {
 760       goto done;
 761     }
 762   }
 763
 764   if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) {
 765     DEBUG ((DEBUG_INFO, "unlock as admin failed with AUTHORITY_LOCKED_OUT\n"));
 766     goto done;
 767   }
 768
 769   //
 770   // Try user1 authority
 771   //
 772   Ret = OpalStartSession(
 773                     Session,
 774                     OPAL_UID_LOCKING_SP,
 775                     TRUE,
 776                     PasswordLength,
 777                     Password,
 778                     OPAL_LOCKING_SP_USER1_AUTHORITY,
 779                     &MethodStatus
 780                     );
 781   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 782     DEBUG ((DEBUG_INFO, "StartSession with Locking SP as User1 failed\n"));
 783     goto done;
 784   }
 785
 786   Ret = OpalUpdateGlobalLockingRange(Session, ReadLocked, WriteLocked, &MethodStatus);
 787   OpalEndSession(Session);
 788
 789 done:
 790   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 791     if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) {
 792       //
 793       // Caller need to know this special error, but return status not has type for it.
 794       // so here use TcgResultFailureInvalidType as an replacement.
 795       //
 796       Ret = TcgResultFailureInvalidType;
 797     } else {
 798       Ret = TcgResultFailure;
 799     }
 800   }
 801   return Ret;
 802 }
 803
 804 /**
 805   Update global locking range.
 806
 807   @param          Session,           The session info for one opal device.
 808   @param          Msid,              The data buffer to save Msid info.
 809   @param          MsidBufferLength,  The data buffer length for Msid.
 810   @param          MsidLength,        The actual data length for Msid.
 811
 812 **/
 813 TCG_RESULT
 814 EFIAPI
 815 OpalUtilGetMsid(
 816   OPAL_SESSION    *Session,
 817   UINT8           *Msid,
 818   UINT32          MsidBufferLength,
 819   UINT32          *MsidLength
 820   )
 821 {
 822   UINT8        MethodStatus;
 823   TCG_RESULT   Ret;
 824
 825   NULL_CHECK(Session);
 826   NULL_CHECK(Msid);
 827   NULL_CHECK(MsidLength);
 828
 829   Ret = OpalStartSession(
 830                    Session,
 831                    OPAL_UID_ADMIN_SP,
 832                    TRUE,
 833                    0,
 834                    NULL,
 835                    TCG_UID_NULL,
 836                    &MethodStatus
 837                    );
 838   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 839     Ret = OpalGetMsid (Session, MsidBufferLength, Msid, MsidLength);
 840     OpalEndSession (Session);
 841   }
 842
 843   if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 844     Ret = TcgResultFailure;
 845   }
 846
 847   return Ret;
 848 }
 849
 850 /**
 851
 852   The function determines who owns the device by attempting to start a session with different credentials.
 853   If the SID PIN matches the MSID PIN, the no one owns the device.
 854   If the SID PIN matches the ourSidPin, then "Us" owns the device.  Otherwise it is unknown.
 855
 856
 857   @param[in]      Session            The session info for one opal device.
 858   @param          Msid,              The Msid info.
 859   @param          MsidLength,        The data length for Msid.
 860
 861 **/
 862 OPAL_OWNER_SHIP
 863 EFIAPI
 864 OpalUtilDetermineOwnership(
 865   OPAL_SESSION       *Session,
 866   UINT8              *Msid,
 867   UINT32             MsidLength
 868   )
 869 {
 870   UINT8            MethodStatus;
 871   TCG_RESULT       Ret;
 872   OPAL_OWNER_SHIP  Owner;
 873
 874   if ((Session == NULL) || (Msid == NULL)) {
 875     return OpalOwnershipUnknown;
 876   }
 877
 878   Owner = OpalOwnershipUnknown;
 879   //
 880   // Start Session as SID_UID with ADMIN_SP using MSID PIN
 881   //
 882   Ret = OpalStartSession(
 883                     Session,
 884                     OPAL_UID_ADMIN_SP,
 885                     TRUE,
 886                     MsidLength,
 887                     Msid,
 888                     OPAL_ADMIN_SP_SID_AUTHORITY,
 889                     &MethodStatus);
 890   if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) {
 891     //
 892     // now we know that SID PIN == MSID PIN
 893     //
 894     Owner = OpalOwnershipNobody;
 895
 896     OpalEndSession(Session);
 897   }
 898
 899   return Owner;
 900 }
 901
 902 /**
 903
 904   The function returns if admin password exists.
 905
 906   @param[in]      OwnerShip         The owner ship of the opal device.
 907   @param[in]      LockingFeature    The locking info of the opal device.
 908
 909   @retval         TRUE              Admin password existed.
 910   @retval         FALSE             Admin password not existed.
 911
 912 **/
 913 BOOLEAN
 914 EFIAPI
 915 OpalUtilAdminPasswordExists(
 916   IN  UINT16                           OwnerShip,
 917   IN  TCG_LOCKING_FEATURE_DESCRIPTOR   *LockingFeature
 918   )
 919 {
 920   NULL_CHECK(LockingFeature);
 921
 922   // if it is Unknown who owns the device
 923   // then someone has set password previously through our UI
 924   // because the SID would no longer match the generated SID (ownership us)
 925   // or someone has set password using 3rd party software
 926
 927   //
 928   // Locking sp enabled is checked b/c it must be enabled to change the PIN of the Admin1.
 929   //
 930   return (OwnerShip == OpalOwnershipUnknown && LockingFeature->LockingEnabled);
 931 }
 932
 933 /**
 934   Get Active Data Removal Mechanism Value.
 935
 936   @param[in]      Session                        The session info for one opal device.
 937   @param[in]      GeneratedSid                   Generated SID of disk
 938   @param[in]      SidLength                      Length of generatedSid in bytes
 939   @param[out]     ActiveDataRemovalMechanism     Return the active data removal mechanism.
 940
 941 **/
 942 TCG_RESULT
 943 EFIAPI
 944 OpalUtilGetActiveDataRemovalMechanism (
 945   OPAL_SESSION      *Session,
 946   const VOID        *GeneratedSid,
 947   UINT32            SidLength,
 948   UINT8             *ActiveDataRemovalMechanism
 949   )
 950 {
 951   TCG_RESULT   Ret;
 952   UINT8        MethodStatus;
 953
 954   NULL_CHECK(Session);
 955   NULL_CHECK(GeneratedSid);
 956   NULL_CHECK(ActiveDataRemovalMechanism);
 957
 958   Ret = OpalStartSession(
 959                     Session,
 960                     OPAL_UID_ADMIN_SP,
 961                     TRUE,
 962                     SidLength,
 963                     GeneratedSid,
 964                     OPAL_ADMIN_SP_ANYBODY_AUTHORITY,
 965                     &MethodStatus
 966                     );
 967   if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 968     DEBUG ((DEBUG_INFO, "Start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus));
 969     if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) {
 970       Ret = TcgResultFailure;
 971     }
 972     return Ret;
 973   }
 974
 975   Ret = OpalPyrite2GetActiveDataRemovalMechanism (
 976                     Session,
 977                     ActiveDataRemovalMechanism
 978                     );
 979
 980   if (Ret != TcgResultSuccess) {
 981     DEBUG ((DEBUG_INFO, "Pyrite2 Get Active Data Removal Mechanism failed: Ret=%d\n", Ret));
 982   }
 983
 984   OpalEndSession(Session);
 985
 986   return Ret;
 987 }
 988
 989 /**
 990   Calculate the estimated time.
 991
 992   @param[in]      IsMinute               Whether the input time value is minute type or second type.
 993   @param[in]      Time                   The input time value.
 994
 995 **/
 996 UINT32
 997 CalculateDataRemovalTime (
 998   IN BOOLEAN               IsMinute,
 999   IN UINT16                Time
1000   )
1001 {
1002   if (IsMinute) {
1003     return Time * 2 * 60;
1004   } else {
1005     return Time * 2;
1006   }
1007 }
1008
1009 /**
1010   Return the estimated time for specific type.
1011
1012   @param[in]      Index               The input data removal type.
1013   @param[in]      Descriptor          DATA_REMOVAL_FEATURE_DESCRIPTOR
1014
1015 **/
1016 UINT32
1017 GetDataRemovalTime (
1018   IN  UINT8                            Index,
1019   IN  DATA_REMOVAL_FEATURE_DESCRIPTOR  *Descriptor
1020   )
1021 {
1022   switch (Index) {
1023   case OverwriteDataErase:
1024     return CalculateDataRemovalTime (Descriptor->FormatBit0, SwapBytes16 (Descriptor->TimeBit0));
1025
1026   case BlockErase:
1027     return CalculateDataRemovalTime (Descriptor->FormatBit1, SwapBytes16 (Descriptor->TimeBit1));
1028
1029   case CryptoErase:
1030     return CalculateDataRemovalTime (Descriptor->FormatBit2, SwapBytes16 (Descriptor->TimeBit2));
1031
1032   case Unmap:
1033     return CalculateDataRemovalTime (Descriptor->FormatBit3, SwapBytes16 (Descriptor->TimeBit3));
1034
1035   case ResetWritePointers:
1036     return CalculateDataRemovalTime (Descriptor->FormatBit4, SwapBytes16 (Descriptor->TimeBit4));
1037
1038   case VendorSpecificErase:
1039     return CalculateDataRemovalTime (Descriptor->FormatBit5, SwapBytes16 (Descriptor->TimeBit5));
1040
1041   default:
1042     return 0;
1043   }
1044 }
1045
1046 /**
1047   Get the supported Data Removal Mechanism list.
1048
1049   @param[in]      Session                        The session info for one opal device.
1050   @param[out]     RemovalMechanismLists          Return the supported data removal mechanism lists.
1051
1052 **/
1053 TCG_RESULT
1054 EFIAPI
1055 OpalUtilGetDataRemovalMechanismLists (
1056   IN  OPAL_SESSION      *Session,
1057   OUT UINT32            *RemovalMechanismLists
1058   )
1059 {
1060   TCG_RESULT                       Ret;
1061   UINTN                            DataSize;
1062   DATA_REMOVAL_FEATURE_DESCRIPTOR  Descriptor;
1063   UINT8                            Index;
1064   UINT8                            BitValue;
1065
1066   NULL_CHECK(Session);
1067   NULL_CHECK(RemovalMechanismLists);
1068
1069   DataSize = sizeof (Descriptor);
1070   Ret = OpalGetFeatureDescriptor (Session, TCG_FEATURE_DATA_REMOVAL, &DataSize, &Descriptor);
1071   if (Ret != TcgResultSuccess) {
1072     return TcgResultFailure;
1073   }
1074
1075   ASSERT (Descriptor.RemovalMechanism != 0);
1076
1077   for (Index = 0; Index < ResearvedMechanism; Index ++) {
1078     BitValue = (BOOLEAN) BitFieldRead8 (Descriptor.RemovalMechanism, Index, Index);
1079
1080     if (BitValue == 0) {
1081       RemovalMechanismLists[Index] = 0;
1082     } else {
1083       RemovalMechanismLists[Index] = GetDataRemovalTime (Index, &Descriptor);
1084     }
1085   }
1086
1087   return TcgResultSuccess;
1088 }
1089
1090 /**
1091   Get revert timeout value.
1092
1093   @param[in]      Session                       The session info for one opal device.
1094
1095 **/
1096 UINT32
1097 GetRevertTimeOut (
1098   IN OPAL_SESSION                *Session
1099   )
1100 {
1101   TCG_RESULT                   TcgResult;
1102   OPAL_DISK_SUPPORT_ATTRIBUTE  SupportedAttributes;
1103   UINT16                       BaseComId;
1104   UINT32                       MsidLength;
1105   UINT8                        Msid[OPAL_MSID_LENGHT];
1106   UINT32                       RemovalMechanishLists[ResearvedMechanism];
1107   UINT8                        ActiveDataRemovalMechanism;
1108
1109   TcgResult = OpalGetSupportedAttributesInfo (Session, &SupportedAttributes, &BaseComId);
1110   if (TcgResult != TcgResultSuccess || SupportedAttributes.DataRemoval == 0) {
1111     return 0;
1112   }
1113
1114   TcgResult = OpalUtilGetMsid (Session, Msid, OPAL_MSID_LENGHT, &MsidLength);
1115   if (TcgResult != TcgResultSuccess) {
1116     return 0;
1117   }
1118
1119   TcgResult = OpalUtilGetDataRemovalMechanismLists (Session, RemovalMechanishLists);
1120   if (TcgResult != TcgResultSuccess) {
1121     return 0;
1122   }
1123
1124   TcgResult = OpalUtilGetActiveDataRemovalMechanism (Session, Msid, MsidLength, &ActiveDataRemovalMechanism);
1125   if (TcgResult != TcgResultSuccess) {
1126     return 0;
1127   }
1128
1129   return RemovalMechanishLists[ActiveDataRemovalMechanism];
1130 }