7f9e14fa81a7ab70daafba05edf1d4dd7ca62c53
[mirror_edk2.git] / SecurityPkg / Tcg / Opal / OpalPassword / OpalPasswordPei.c
1 /** @file
2 Opal Password PEI driver which is used to unlock Opal Password for S3.
3
4 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
5 This program and the accompanying materials
6 are licensed and made available under the terms and conditions of the BSD License
7 which accompanies this distribution. The full text of the license may be found at
8 http://opensource.org/licenses/bsd-license.php
9
10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
12
13 **/
14
15 #include "OpalPasswordPei.h"
16
17 EFI_GUID mOpalDeviceAtaGuid = OPAL_DEVICE_ATA_GUID;
18 EFI_GUID mOpalDeviceNvmeGuid = OPAL_DEVICE_NVME_GUID;
19
20 #define OPAL_PCIE_ROOTPORT_SAVESIZE (0x40)
21 #define STORE_INVALID_ROOTPORT_INDEX ((UINT8) -1)
22
23 /**
24 Get IOMMU PPI.
25
26 @return Pointer to IOMMU PPI.
27
28 **/
29 EDKII_IOMMU_PPI *
30 GetIoMmu (
31 VOID
32 )
33 {
34 EFI_STATUS Status;
35 EDKII_IOMMU_PPI *IoMmu;
36
37 IoMmu = NULL;
38 Status = PeiServicesLocatePpi (
39 &gEdkiiIoMmuPpiGuid,
40 0,
41 NULL,
42 (VOID **) &IoMmu
43 );
44 if (!EFI_ERROR (Status) && (IoMmu != NULL)) {
45 return IoMmu;
46 }
47
48 return NULL;
49 }
50
51 /**
52 Allocates pages that are suitable for an OperationBusMasterCommonBuffer or
53 OperationBusMasterCommonBuffer64 mapping.
54
55 @param Pages The number of pages to allocate.
56 @param HostAddress A pointer to store the base system memory address of the
57 allocated range.
58 @param DeviceAddress The resulting map address for the bus master PCI controller to use to
59 access the hosts HostAddress.
60 @param Mapping A resulting value to pass to Unmap().
61
62 @retval EFI_SUCCESS The requested memory pages were allocated.
63 @retval EFI_UNSUPPORTED Attributes is unsupported. The only legal attribute bits are
64 MEMORY_WRITE_COMBINE and MEMORY_CACHED.
65 @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
66 @retval EFI_OUT_OF_RESOURCES The memory pages could not be allocated.
67
68 **/
69 EFI_STATUS
70 IoMmuAllocateBuffer (
71 IN UINTN Pages,
72 OUT VOID **HostAddress,
73 OUT EFI_PHYSICAL_ADDRESS *DeviceAddress,
74 OUT VOID **Mapping
75 )
76 {
77 EFI_STATUS Status;
78 UINTN NumberOfBytes;
79 EFI_PHYSICAL_ADDRESS HostPhyAddress;
80 EDKII_IOMMU_PPI *IoMmu;
81
82 *HostAddress = NULL;
83 *DeviceAddress = 0;
84 *Mapping = NULL;
85
86 IoMmu = GetIoMmu ();
87
88 if (IoMmu != NULL) {
89 Status = IoMmu->AllocateBuffer (
90 IoMmu,
91 EfiBootServicesData,
92 Pages,
93 HostAddress,
94 0
95 );
96 if (EFI_ERROR (Status)) {
97 return EFI_OUT_OF_RESOURCES;
98 }
99
100 NumberOfBytes = EFI_PAGES_TO_SIZE (Pages);
101 Status = IoMmu->Map (
102 IoMmu,
103 EdkiiIoMmuOperationBusMasterCommonBuffer,
104 *HostAddress,
105 &NumberOfBytes,
106 DeviceAddress,
107 Mapping
108 );
109 if (EFI_ERROR (Status)) {
110 IoMmu->FreeBuffer (IoMmu, Pages, *HostAddress);
111 *HostAddress = NULL;
112 return EFI_OUT_OF_RESOURCES;
113 }
114 Status = IoMmu->SetAttribute (
115 IoMmu,
116 *Mapping,
117 EDKII_IOMMU_ACCESS_READ | EDKII_IOMMU_ACCESS_WRITE
118 );
119 if (EFI_ERROR (Status)) {
120 IoMmu->Unmap (IoMmu, *Mapping);
121 IoMmu->FreeBuffer (IoMmu, Pages, *HostAddress);
122 *Mapping = NULL;
123 *HostAddress = NULL;
124 return Status;
125 }
126 } else {
127 Status = PeiServicesAllocatePages (
128 EfiBootServicesData,
129 Pages,
130 &HostPhyAddress
131 );
132 if (EFI_ERROR (Status)) {
133 return EFI_OUT_OF_RESOURCES;
134 }
135 *HostAddress = (VOID *) (UINTN) HostPhyAddress;
136 *DeviceAddress = HostPhyAddress;
137 *Mapping = NULL;
138 }
139 return Status;
140 }
141
142 /**
143 Frees memory that was allocated with AllocateBuffer().
144
145 @param Pages The number of pages to free.
146 @param HostAddress The base system memory address of the allocated range.
147 @param Mapping The mapping value returned from Map().
148
149 **/
150 VOID
151 IoMmuFreeBuffer (
152 IN UINTN Pages,
153 IN VOID *HostAddress,
154 IN VOID *Mapping
155 )
156 {
157 EDKII_IOMMU_PPI *IoMmu;
158
159 IoMmu = GetIoMmu ();
160
161 if (IoMmu != NULL) {
162 IoMmu->SetAttribute (IoMmu, Mapping, 0);
163 IoMmu->Unmap (IoMmu, Mapping);
164 IoMmu->FreeBuffer (IoMmu, Pages, HostAddress);
165 } else {
166 PeiServicesFreePages (
167 (EFI_PHYSICAL_ADDRESS) (UINTN) HostAddress,
168 Pages
169 );
170 }
171 }
172
173 /**
174 Provide IO action support.
175
176 @param[in] PeiDev The opal device need to perform trusted IO.
177 @param[in] IoType OPAL_IO_TYPE indicating whether to perform a Trusted Send or Trusted Receive.
178 @param[in] SecurityProtocol Security Protocol
179 @param[in] SpSpecific Security Protocol Specific
180 @param[in] TransferLength Transfer Length of Buffer (in bytes) - always a multiple of 512
181 @param[in] Buffer Address of Data to transfer
182
183 @retval EFI_SUCCESS Perform the IO action success.
184 @retval Others Perform the IO action failed.
185
186 **/
187 EFI_STATUS
188 PerformTrustedIo (
189 OPAL_PEI_DEVICE *PeiDev,
190 OPAL_IO_TYPE IoType,
191 UINT8 SecurityProtocol,
192 UINT16 SpSpecific,
193 UINTN TransferLength,
194 VOID *Buffer
195 )
196 {
197 EFI_STATUS Status;
198 UINTN BufferSizeBlocks;
199 EFI_ATA_COMMAND_BLOCK AtaCommandBlock;
200 OPAL_DEVICE_ATA *DevInfoAta;
201 AHCI_CONTEXT *AhciContext;
202 NVME_CONTEXT *NvmeContext;
203
204 Status = EFI_DEVICE_ERROR;
205 if (PeiDev->DeviceType == OPAL_DEVICE_TYPE_ATA) {
206 DevInfoAta = (OPAL_DEVICE_ATA *) PeiDev->Device;
207 AhciContext = (AHCI_CONTEXT *) PeiDev->Context;
208
209 BufferSizeBlocks = TransferLength / 512;
210
211 ZeroMem( &AtaCommandBlock, sizeof( EFI_ATA_COMMAND_BLOCK ) );
212 AtaCommandBlock.AtaCommand = ( IoType == OpalSend ) ? ATA_COMMAND_TRUSTED_SEND : ATA_COMMAND_TRUSTED_RECEIVE;
213 AtaCommandBlock.AtaSectorCount = ( UINT8 )BufferSizeBlocks;
214 AtaCommandBlock.AtaSectorNumber = ( UINT8 )( BufferSizeBlocks >> 8 );
215 AtaCommandBlock.AtaFeatures = SecurityProtocol;
216 AtaCommandBlock.AtaCylinderLow = ( UINT8 )( SpSpecific >> 8 );
217 AtaCommandBlock.AtaCylinderHigh = ( UINT8 )( SpSpecific );
218 AtaCommandBlock.AtaDeviceHead = ATA_DEVICE_LBA;
219
220
221 ZeroMem( AhciContext->Buffer, HDD_PAYLOAD );
222 ASSERT( TransferLength <= HDD_PAYLOAD );
223
224 if (IoType == OpalSend) {
225 CopyMem( AhciContext->Buffer, Buffer, TransferLength );
226 }
227
228 Status = AhciPioTransfer(
229 AhciContext,
230 (UINT8) DevInfoAta->Port,
231 (UINT8) DevInfoAta->PortMultiplierPort,
232 NULL,
233 0,
234 ( IoType == OpalSend ) ? FALSE : TRUE, // i/o direction
235 &AtaCommandBlock,
236 NULL,
237 AhciContext->Buffer,
238 (UINT32)TransferLength,
239 ATA_TIMEOUT
240 );
241
242 if (IoType == OpalRecv) {
243 CopyMem( Buffer, AhciContext->Buffer, TransferLength );
244 }
245 } else if (PeiDev->DeviceType == OPAL_DEVICE_TYPE_NVME) {
246 NvmeContext = (NVME_CONTEXT *) PeiDev->Context;
247 Status = NvmeSecuritySendReceive (
248 NvmeContext,
249 IoType == OpalSend,
250 SecurityProtocol,
251 SwapBytes16(SpSpecific),
252 TransferLength,
253 Buffer
254 );
255 } else {
256 DEBUG((DEBUG_ERROR, "DeviceType(%x) not support.\n", PeiDev->DeviceType));
257 }
258
259 return Status;
260 }
261
262 /**
263 Send a security protocol command to a device that receives data and/or the result
264 of one or more commands sent by SendData.
265
266 The ReceiveData function sends a security protocol command to the given MediaId.
267 The security protocol command sent is defined by SecurityProtocolId and contains
268 the security protocol specific data SecurityProtocolSpecificData. The function
269 returns the data from the security protocol command in PayloadBuffer.
270
271 For devices supporting the SCSI command set, the security protocol command is sent
272 using the SECURITY PROTOCOL IN command defined in SPC-4.
273
274 For devices supporting the ATA command set, the security protocol command is sent
275 using one of the TRUSTED RECEIVE commands defined in ATA8-ACS if PayloadBufferSize
276 is non-zero.
277
278 If the PayloadBufferSize is zero, the security protocol command is sent using the
279 Trusted Non-Data command defined in ATA8-ACS.
280
281 If PayloadBufferSize is too small to store the available data from the security
282 protocol command, the function shall copy PayloadBufferSize bytes into the
283 PayloadBuffer and return EFI_WARN_BUFFER_TOO_SMALL.
284
285 If PayloadBuffer or PayloadTransferSize is NULL and PayloadBufferSize is non-zero,
286 the function shall return EFI_INVALID_PARAMETER.
287
288 If the given MediaId does not support security protocol commands, the function shall
289 return EFI_UNSUPPORTED. If there is no media in the device, the function returns
290 EFI_NO_MEDIA. If the MediaId is not the ID for the current media in the device,
291 the function returns EFI_MEDIA_CHANGED.
292
293 If the security protocol fails to complete within the Timeout period, the function
294 shall return EFI_TIMEOUT.
295
296 If the security protocol command completes without an error, the function shall
297 return EFI_SUCCESS. If the security protocol command completes with an error, the
298 function shall return EFI_DEVICE_ERROR.
299
300 @param This Indicates a pointer to the calling context.
301 @param MediaId ID of the medium to receive data from.
302 @param Timeout The timeout, in 100ns units, to use for the execution
303 of the security protocol command. A Timeout value of 0
304 means that this function will wait indefinitely for the
305 security protocol command to execute. If Timeout is greater
306 than zero, then this function will return EFI_TIMEOUT
307 if the time required to execute the receive data command
308 is greater than Timeout.
309 @param SecurityProtocolId The value of the "Security Protocol" parameter of
310 the security protocol command to be sent.
311 @param SecurityProtocolSpecificData The value of the "Security Protocol Specific" parameter
312 of the security protocol command to be sent.
313 @param PayloadBufferSize Size in bytes of the payload data buffer.
314 @param PayloadBuffer A pointer to a destination buffer to store the security
315 protocol command specific payload data for the security
316 protocol command. The caller is responsible for having
317 either implicit or explicit ownership of the buffer.
318 @param PayloadTransferSize A pointer to a buffer to store the size in bytes of the
319 data written to the payload data buffer.
320
321 @retval EFI_SUCCESS The security protocol command completed successfully.
322 @retval EFI_WARN_BUFFER_TOO_SMALL The PayloadBufferSize was too small to store the available
323 data from the device. The PayloadBuffer contains the truncated data.
324 @retval EFI_UNSUPPORTED The given MediaId does not support security protocol commands.
325 @retval EFI_DEVICE_ERROR The security protocol command completed with an error.
326 @retval EFI_NO_MEDIA There is no media in the device.
327 @retval EFI_MEDIA_CHANGED The MediaId is not for the current media.
328 @retval EFI_INVALID_PARAMETER The PayloadBuffer or PayloadTransferSize is NULL and
329 PayloadBufferSize is non-zero.
330 @retval EFI_TIMEOUT A timeout occurred while waiting for the security
331 protocol command to execute.
332
333 **/
334 EFI_STATUS
335 EFIAPI
336 SecurityReceiveData (
337 IN EFI_STORAGE_SECURITY_COMMAND_PROTOCOL *This,
338 IN UINT32 MediaId,
339 IN UINT64 Timeout,
340 IN UINT8 SecurityProtocolId,
341 IN UINT16 SecurityProtocolSpecificData,
342 IN UINTN PayloadBufferSize,
343 OUT VOID *PayloadBuffer,
344 OUT UINTN *PayloadTransferSize
345 )
346 {
347 OPAL_PEI_DEVICE *PeiDev;
348
349 PeiDev = OPAL_PEI_DEVICE_FROM_THIS (This);
350 if (PeiDev == NULL) {
351 return EFI_DEVICE_ERROR;
352 }
353
354 return PerformTrustedIo (
355 PeiDev,
356 OpalRecv,
357 SecurityProtocolId,
358 SecurityProtocolSpecificData,
359 PayloadBufferSize,
360 PayloadBuffer
361 );
362 }
363
364 /**
365 Send a security protocol command to a device.
366
367 The SendData function sends a security protocol command containing the payload
368 PayloadBuffer to the given MediaId. The security protocol command sent is
369 defined by SecurityProtocolId and contains the security protocol specific data
370 SecurityProtocolSpecificData. If the underlying protocol command requires a
371 specific padding for the command payload, the SendData function shall add padding
372 bytes to the command payload to satisfy the padding requirements.
373
374 For devices supporting the SCSI command set, the security protocol command is sent
375 using the SECURITY PROTOCOL OUT command defined in SPC-4.
376
377 For devices supporting the ATA command set, the security protocol command is sent
378 using one of the TRUSTED SEND commands defined in ATA8-ACS if PayloadBufferSize
379 is non-zero. If the PayloadBufferSize is zero, the security protocol command is
380 sent using the Trusted Non-Data command defined in ATA8-ACS.
381
382 If PayloadBuffer is NULL and PayloadBufferSize is non-zero, the function shall
383 return EFI_INVALID_PARAMETER.
384
385 If the given MediaId does not support security protocol commands, the function
386 shall return EFI_UNSUPPORTED. If there is no media in the device, the function
387 returns EFI_NO_MEDIA. If the MediaId is not the ID for the current media in the
388 device, the function returns EFI_MEDIA_CHANGED.
389
390 If the security protocol fails to complete within the Timeout period, the function
391 shall return EFI_TIMEOUT.
392
393 If the security protocol command completes without an error, the function shall return
394 EFI_SUCCESS. If the security protocol command completes with an error, the function
395 shall return EFI_DEVICE_ERROR.
396
397 @param This Indicates a pointer to the calling context.
398 @param MediaId ID of the medium to receive data from.
399 @param Timeout The timeout, in 100ns units, to use for the execution
400 of the security protocol command. A Timeout value of 0
401 means that this function will wait indefinitely for the
402 security protocol command to execute. If Timeout is greater
403 than zero, then this function will return EFI_TIMEOUT
404 if the time required to execute the send data command
405 is greater than Timeout.
406 @param SecurityProtocolId The value of the "Security Protocol" parameter of
407 the security protocol command to be sent.
408 @param SecurityProtocolSpecificData The value of the "Security Protocol Specific" parameter
409 of the security protocol command to be sent.
410 @param PayloadBufferSize Size in bytes of the payload data buffer.
411 @param PayloadBuffer A pointer to a destination buffer to store the security
412 protocol command specific payload data for the security
413 protocol command.
414
415 @retval EFI_SUCCESS The security protocol command completed successfully.
416 @retval EFI_UNSUPPORTED The given MediaId does not support security protocol commands.
417 @retval EFI_DEVICE_ERROR The security protocol command completed with an error.
418 @retval EFI_NO_MEDIA There is no media in the device.
419 @retval EFI_MEDIA_CHANGED The MediaId is not for the current media.
420 @retval EFI_INVALID_PARAMETER The PayloadBuffer is NULL and PayloadBufferSize is non-zero.
421 @retval EFI_TIMEOUT A timeout occurred while waiting for the security
422 protocol command to execute.
423
424 **/
425 EFI_STATUS
426 EFIAPI
427 SecuritySendData (
428 IN EFI_STORAGE_SECURITY_COMMAND_PROTOCOL *This,
429 IN UINT32 MediaId,
430 IN UINT64 Timeout,
431 IN UINT8 SecurityProtocolId,
432 IN UINT16 SecurityProtocolSpecificData,
433 IN UINTN PayloadBufferSize,
434 IN VOID *PayloadBuffer
435 )
436 {
437 OPAL_PEI_DEVICE *PeiDev;
438
439 PeiDev = OPAL_PEI_DEVICE_FROM_THIS (This);
440 if (PeiDev == NULL) {
441 return EFI_DEVICE_ERROR;
442 }
443
444 return PerformTrustedIo (
445 PeiDev,
446 OpalSend,
447 SecurityProtocolId,
448 SecurityProtocolSpecificData,
449 PayloadBufferSize,
450 PayloadBuffer
451 );
452
453 }
454
455 /**
456 Save/Restore RootPort configuration space.
457
458 @param[in] DevInfoNvme Pointer to NVMe device info.
459 @param[in] SaveAction TRUE: Save, FALSE: Restore
460 @param[in,out] PcieConfBufferList Configuration space data buffer for save/restore
461
462 @return PCIE base address of this RootPort
463 **/
464 UINTN
465 SaveRestoreRootportConfSpace (
466 IN OPAL_DEVICE_NVME *DevInfoNvme,
467 IN BOOLEAN SaveAction,
468 IN OUT UINT8 **PcieConfBufferList
469 )
470 {
471 UINTN RpBase;
472 UINTN Length;
473 OPAL_PCI_DEVICE *DevNode;
474 UINT8 *StorePcieConfData;
475 UINTN Index;
476
477 Length = 0;
478 Index = 0;
479 RpBase = 0;
480
481 while (sizeof (OPAL_DEVICE_NVME) + Length < DevInfoNvme->Length) {
482 DevNode = (OPAL_PCI_DEVICE *)((UINT8*)DevInfoNvme->PciBridgeNode + Length);
483 RpBase = PCI_LIB_ADDRESS (DevNode->Bus, DevNode->Device, DevNode->Function, 0x0);
484
485 if (PcieConfBufferList != NULL) {
486 if (SaveAction) {
487 StorePcieConfData = (UINT8 *) AllocateZeroPool (OPAL_PCIE_ROOTPORT_SAVESIZE);
488 ASSERT (StorePcieConfData != NULL);
489 OpalPciRead (StorePcieConfData, RpBase, OPAL_PCIE_ROOTPORT_SAVESIZE);
490 PcieConfBufferList[Index] = StorePcieConfData;
491 } else {
492 // Skip PCIe Command & Status registers
493 StorePcieConfData = PcieConfBufferList[Index];
494 OpalPciWrite (RpBase, StorePcieConfData, 4);
495 OpalPciWrite (RpBase + 8, StorePcieConfData + 8, OPAL_PCIE_ROOTPORT_SAVESIZE - 8);
496
497 FreePool (StorePcieConfData);
498 }
499 }
500
501 Length += sizeof (OPAL_PCI_DEVICE);
502 Index ++;
503 }
504
505 return RpBase;
506 }
507
508 /**
509 Configure RootPort for downstream PCIe NAND devices.
510
511 @param[in] RpBase - PCIe configuration space address of this RootPort
512 @param[in] BusNumber - Bus number
513 @param[in] MemoryBase - Memory base address
514 @param[in] MemoryLength - Memory size
515
516 **/
517 VOID
518 ConfigureRootPortForPcieNand (
519 IN UINTN RpBase,
520 IN UINTN BusNumber,
521 IN UINT32 MemoryBase,
522 IN UINT32 MemoryLength
523 )
524 {
525 UINT32 MemoryLimit;
526
527 DEBUG ((DEBUG_INFO, "ConfigureRootPortForPcieNand, BusNumber: %x, MemoryBase: %x, MemoryLength: %x\n",
528 BusNumber, MemoryBase, MemoryLength));
529
530 if (MemoryLength == 0) {
531 MemoryLimit = MemoryBase;
532 } else {
533 MemoryLimit = MemoryBase + MemoryLength + 0xFFFFF; // 1M
534 }
535
536 ///
537 /// Configue PCIE configuration space for RootPort
538 ///
539 PciWrite8 (RpBase + NVME_PCIE_BNUM + 1, (UINT8) BusNumber); // Secondary Bus Number registers
540 PciWrite8 (RpBase + NVME_PCIE_BNUM + 2, (UINT8) BusNumber); // Subordinate Bus Number registers
541 PciWrite8 (RpBase + NVME_PCIE_IOBL, 0xFF); // I/O Base registers
542 PciWrite8 (RpBase + NVME_PCIE_IOBL + 1, 0x00); // I/O Limit registers
543 PciWrite16 (RpBase + NVME_PCIE_MBL, (UINT16) RShiftU64 ((UINTN)MemoryBase, 16)); // Memory Base register
544 PciWrite16 (RpBase + NVME_PCIE_MBL + 2, (UINT16) RShiftU64 ((UINTN)MemoryLimit, 16)); // Memory Limit register
545 PciWrite16 (RpBase + NVME_PCIE_PMBL, 0xFFFF); // Prefetchable Memory Base registers
546 PciWrite16 (RpBase + NVME_PCIE_PMBL + 2, 0x0000); // Prefetchable Memory Limit registers
547 PciWrite32 (RpBase + NVME_PCIE_PMBU32, 0xFFFFFFFF); // Prefetchable Memory Upper Base registers
548 PciWrite32 (RpBase + NVME_PCIE_PMLU32, 0x00000000); // Prefetchable Memory Upper Limit registers
549 }
550
551 /**
552
553 The function returns whether or not the device is Opal Locked.
554 TRUE means that the device is partially or fully locked.
555 This will perform a Level 0 Discovery and parse the locking feature descriptor
556
557 @param[in] OpalDev Opal object to determine if locked.
558 @param[out] BlockSidSupported Whether device support BlockSid feature.
559
560 **/
561 BOOLEAN
562 IsOpalDeviceLocked(
563 OPAL_PEI_DEVICE *OpalDev,
564 BOOLEAN *BlockSidSupported
565 )
566 {
567 OPAL_SESSION Session;
568 OPAL_DISK_SUPPORT_ATTRIBUTE SupportedAttributes;
569 TCG_LOCKING_FEATURE_DESCRIPTOR LockingFeature;
570 UINT16 OpalBaseComId;
571 TCG_RESULT Ret;
572
573 Session.Sscp = &OpalDev->Sscp;
574 Session.MediaId = 0;
575
576 Ret = OpalGetSupportedAttributesInfo (&Session, &SupportedAttributes, &OpalBaseComId);
577 if (Ret != TcgResultSuccess) {
578 return FALSE;
579 }
580
581 Session.OpalBaseComId = OpalBaseComId;
582 *BlockSidSupported = SupportedAttributes.BlockSid == 1 ? TRUE : FALSE;
583
584 Ret = OpalGetLockingInfo(&Session, &LockingFeature);
585 if (Ret != TcgResultSuccess) {
586 return FALSE;
587 }
588
589 return OpalDeviceLocked (&SupportedAttributes, &LockingFeature);
590 }
591
592 /**
593 Unlock OPAL password for S3.
594
595 @param[in] OpalDev Opal object to unlock.
596
597 **/
598 VOID
599 UnlockOpalPassword (
600 IN OPAL_PEI_DEVICE *OpalDev
601 )
602 {
603 TCG_RESULT Result;
604 OPAL_SESSION Session;
605 BOOLEAN BlockSidSupport;
606 UINT32 PpStorageFlags;
607 BOOLEAN BlockSIDEnabled;
608
609 BlockSidSupport = FALSE;
610 if (IsOpalDeviceLocked (OpalDev, &BlockSidSupport)) {
611 ZeroMem(&Session, sizeof (Session));
612 Session.Sscp = &OpalDev->Sscp;
613 Session.MediaId = 0;
614 Session.OpalBaseComId = OpalDev->Device->OpalBaseComId;
615
616 Result = OpalUtilUpdateGlobalLockingRange (
617 &Session,
618 OpalDev->Device->Password,
619 OpalDev->Device->PasswordLength,
620 FALSE,
621 FALSE
622 );
623 DEBUG ((
624 DEBUG_INFO,
625 "%a() OpalUtilUpdateGlobalLockingRange() Result = 0x%x\n",
626 __FUNCTION__,
627 Result
628 ));
629 }
630
631 PpStorageFlags = Tcg2PhysicalPresenceLibGetManagementFlags ();
632 if ((PpStorageFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID) != 0) {
633 BlockSIDEnabled = TRUE;
634 } else {
635 BlockSIDEnabled = FALSE;
636 }
637 if (BlockSIDEnabled && BlockSidSupport) {
638 ZeroMem(&Session, sizeof (Session));
639 Session.Sscp = &OpalDev->Sscp;
640 Session.MediaId = 0;
641 Session.OpalBaseComId = OpalDev->Device->OpalBaseComId;
642 Result = OpalBlockSid (&Session, TRUE);
643 DEBUG ((
644 DEBUG_INFO,
645 "%a() OpalBlockSid() Result = 0x%x\n",
646 __FUNCTION__,
647 Result
648 ));
649 }
650 }
651
652 /**
653 Unlock ATA OPAL password for S3.
654
655 **/
656 VOID
657 UnlockOpalPasswordAta (
658 VOID
659 )
660 {
661 EFI_STATUS Status;
662 UINT8 *DevInfo;
663 OPAL_DEVICE_ATA TempDevInfoAta;
664 OPAL_DEVICE_ATA *DevInfoAta;
665 UINTN DevInfoLengthAta;
666 UINT8 Bus;
667 UINT8 Device;
668 UINT8 Function;
669 OPAL_PEI_DEVICE OpalDev;
670 UINT8 BaseClassCode;
671 UINT8 SubClassCode;
672 UINT8 SataCmdSt;
673 AHCI_CONTEXT AhciContext;
674 UINT32 AhciBar;
675
676 DEBUG ((DEBUG_INFO, "%a() - enter\n", __FUNCTION__));
677
678 //
679 // Get ATA OPAL device info from LockBox.
680 //
681 DevInfo = (UINT8 *) &TempDevInfoAta;
682 DevInfoLengthAta = sizeof (OPAL_DEVICE_ATA);
683 Status = RestoreLockBox (&mOpalDeviceAtaGuid, DevInfo, &DevInfoLengthAta);
684 if (Status == EFI_BUFFER_TOO_SMALL) {
685 DevInfo = AllocatePages (EFI_SIZE_TO_PAGES (DevInfoLengthAta));
686 if (DevInfo != NULL) {
687 Status = RestoreLockBox (&mOpalDeviceAtaGuid, DevInfo, &DevInfoLengthAta);
688 }
689 }
690 if (EFI_ERROR (Status) || (DevInfo == NULL)) {
691 return;
692 }
693
694 for (DevInfoAta = (OPAL_DEVICE_ATA *) DevInfo;
695 (UINTN) DevInfoAta < ((UINTN) DevInfo + DevInfoLengthAta);
696 DevInfoAta = (OPAL_DEVICE_ATA *) ((UINTN) DevInfoAta + DevInfoAta->Length)) {
697 Bus = DevInfoAta->Device.Bus;
698 Device = DevInfoAta->Device.Device;
699 Function = DevInfoAta->Device.Function;
700
701 SataCmdSt = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, PCI_COMMAND_OFFSET));
702 PciWrite8 (PCI_LIB_ADDRESS (Bus, Device, Function, PCI_COMMAND_OFFSET), 0x6);
703
704 BaseClassCode = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x0B));
705 SubClassCode = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x0A));
706 if ((BaseClassCode != PCI_CLASS_MASS_STORAGE) ||
707 ((SubClassCode != PCI_CLASS_MASS_STORAGE_SATADPA) && (SubClassCode != PCI_CLASS_MASS_STORAGE_RAID))) {
708 DEBUG ((DEBUG_ERROR, "%a() ClassCode/SubClassCode are not supported\n", __FUNCTION__));
709 } else {
710 AhciBar = PciRead32 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x24));
711 PciWrite32 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x24), DevInfoAta->BarAddr);
712
713 ZeroMem (&AhciContext, sizeof (AHCI_CONTEXT));
714 AhciContext.AhciBar = DevInfoAta->BarAddr;
715 AhciAllocateResource (&AhciContext);
716 Status = AhciModeInitialize (&AhciContext, (UINT8)DevInfoAta->Port);
717 ASSERT_EFI_ERROR (Status);
718 if (EFI_ERROR (Status)) {
719 DEBUG ((DEBUG_ERROR, "%a() AhciModeInitialize() error, Status: %r\n", __FUNCTION__, Status));
720 }
721
722 OpalDev.Signature = OPAL_PEI_DEVICE_SIGNATURE;
723 OpalDev.Sscp.ReceiveData = SecurityReceiveData;
724 OpalDev.Sscp.SendData = SecuritySendData;
725 OpalDev.DeviceType = OPAL_DEVICE_TYPE_ATA;
726 OpalDev.Device = (OPAL_DEVICE_COMMON *) DevInfoAta;
727 OpalDev.Context = &AhciContext;
728
729 UnlockOpalPassword (&OpalDev);
730
731 AhciFreeResource (&AhciContext);
732 PciWrite32 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x24), AhciBar);
733 }
734 PciWrite8 (PCI_LIB_ADDRESS (Bus, Device, Function, PCI_COMMAND_OFFSET), SataCmdSt);
735 }
736
737 ZeroMem (DevInfo, DevInfoLengthAta);
738 if ((UINTN) DevInfo != (UINTN) &TempDevInfoAta) {
739 FreePages (DevInfo, EFI_SIZE_TO_PAGES (DevInfoLengthAta));
740 }
741
742 DEBUG ((DEBUG_INFO, "%a() - exit\n", __FUNCTION__));
743 }
744
745 /**
746 Unlock NVMe OPAL password for S3.
747
748 **/
749 VOID
750 UnlockOpalPasswordNvme (
751 VOID
752 )
753 {
754 EFI_STATUS Status;
755 UINT8 *DevInfo;
756 OPAL_DEVICE_NVME TempDevInfoNvme;
757 OPAL_DEVICE_NVME *DevInfoNvme;
758 UINTN DevInfoLengthNvme;
759 UINT8 Bus;
760 UINT8 Device;
761 UINT8 Function;
762 OPAL_PEI_DEVICE OpalDev;
763 UINT8 BaseClassCode;
764 UINT8 SubClassCode;
765 UINT8 ProgInt;
766 UINT8 NvmeCmdSt;
767 UINT8 *StorePcieConfDataList[16];
768 UINTN RpBase;
769 UINTN MemoryBase;
770 UINTN MemoryLength;
771 NVME_CONTEXT NvmeContext;
772
773 DEBUG ((DEBUG_INFO, "%a() - enter\n", __FUNCTION__));
774
775 //
776 // Get NVMe OPAL device info from LockBox.
777 //
778 DevInfo = (UINT8 *) &TempDevInfoNvme;
779 DevInfoLengthNvme = sizeof (OPAL_DEVICE_NVME);
780 Status = RestoreLockBox (&mOpalDeviceNvmeGuid, DevInfo, &DevInfoLengthNvme);
781 if (Status == EFI_BUFFER_TOO_SMALL) {
782 DevInfo = AllocatePages (EFI_SIZE_TO_PAGES (DevInfoLengthNvme));
783 if (DevInfo != NULL) {
784 Status = RestoreLockBox (&mOpalDeviceNvmeGuid, DevInfo, &DevInfoLengthNvme);
785 }
786 }
787 if (EFI_ERROR (Status) || (DevInfo == NULL)) {
788 return;
789 }
790
791 for (DevInfoNvme = (OPAL_DEVICE_NVME *) DevInfo;
792 (UINTN) DevInfoNvme < ((UINTN) DevInfo + DevInfoLengthNvme);
793 DevInfoNvme = (OPAL_DEVICE_NVME *) ((UINTN) DevInfoNvme + DevInfoNvme->Length)) {
794 Bus = DevInfoNvme->Device.Bus;
795 Device = DevInfoNvme->Device.Device;
796 Function = DevInfoNvme->Device.Function;
797
798 RpBase = 0;
799 NvmeCmdSt = 0;
800
801 ///
802 /// Save original RootPort configuration space to heap
803 ///
804 RpBase = SaveRestoreRootportConfSpace (
805 DevInfoNvme,
806 TRUE, // save
807 StorePcieConfDataList
808 );
809 MemoryBase = DevInfoNvme->BarAddr;
810 MemoryLength = 0;
811 ConfigureRootPortForPcieNand (RpBase, Bus, (UINT32) MemoryBase, (UINT32) MemoryLength);
812
813 ///
814 /// Enable PCIE decode for RootPort
815 ///
816 NvmeCmdSt = PciRead8 (RpBase + NVME_PCIE_PCICMD);
817 PciWrite8 (RpBase + NVME_PCIE_PCICMD, 0x6);
818
819 BaseClassCode = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x0B));
820 SubClassCode = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x0A));
821 ProgInt = PciRead8 (PCI_LIB_ADDRESS (Bus, Device, Function, 0x09));
822 if ((BaseClassCode != PCI_CLASS_MASS_STORAGE) ||
823 (SubClassCode != PCI_CLASS_MASS_STORAGE_NVM) ||
824 (ProgInt != PCI_IF_NVMHCI)) {
825 DEBUG ((DEBUG_ERROR, "%a() ClassCode/SubClassCode/PI are not supported\n", __FUNCTION__));
826 } else {
827 ZeroMem (&NvmeContext, sizeof (NVME_CONTEXT));
828 NvmeContext.Nbar = DevInfoNvme->BarAddr;
829 NvmeContext.PciBase = PCI_LIB_ADDRESS (Bus, Device, Function, 0x0);
830 NvmeContext.NvmeInitWaitTime = 0;
831 NvmeContext.Nsid = DevInfoNvme->NvmeNamespaceId;
832 NvmeAllocateResource (&NvmeContext);
833 Status = NvmeControllerInit (&NvmeContext);
834
835 OpalDev.Signature = OPAL_PEI_DEVICE_SIGNATURE;
836 OpalDev.Sscp.ReceiveData = SecurityReceiveData;
837 OpalDev.Sscp.SendData = SecuritySendData;
838 OpalDev.DeviceType = OPAL_DEVICE_TYPE_NVME;
839 OpalDev.Device = (OPAL_DEVICE_COMMON *) DevInfoNvme;
840 OpalDev.Context = &NvmeContext;
841
842 UnlockOpalPassword (&OpalDev);
843
844 Status = NvmeControllerExit (&NvmeContext);
845 NvmeFreeResource (&NvmeContext);
846 }
847
848 ASSERT (RpBase != 0);
849 PciWrite8 (RpBase + NVME_PCIE_PCICMD, 0);
850 RpBase = SaveRestoreRootportConfSpace (
851 DevInfoNvme,
852 FALSE, // restore
853 StorePcieConfDataList
854 );
855 PciWrite8 (RpBase + NVME_PCIE_PCICMD, NvmeCmdSt);
856 }
857
858 ZeroMem (DevInfo, DevInfoLengthNvme);
859 if ((UINTN) DevInfo != (UINTN) &TempDevInfoNvme) {
860 FreePages (DevInfo, EFI_SIZE_TO_PAGES (DevInfoLengthNvme));
861 }
862
863 DEBUG ((DEBUG_INFO, "%a() - exit\n", __FUNCTION__));
864 }
865
866 /**
867 Unlock OPAL password for S3.
868
869 **/
870 VOID
871 OpalPasswordS3 (
872 VOID
873 )
874 {
875 UnlockOpalPasswordAta ();
876 UnlockOpalPasswordNvme ();
877 }
878
879 /**
880 Entry point of the notification callback function itself within the PEIM.
881 It is to unlock OPAL password for S3.
882
883 @param PeiServices Indirect reference to the PEI Services Table.
884 @param NotifyDescriptor Address of the notification descriptor data structure.
885 @param Ppi Address of the PPI that was installed.
886
887 @return Status of the notification.
888 The status code returned from this function is ignored.
889 **/
890 EFI_STATUS
891 EFIAPI
892 OpalPasswordEndOfPeiNotify(
893 IN EFI_PEI_SERVICES **PeiServices,
894 IN EFI_PEI_NOTIFY_DESCRIPTOR *NotifyDesc,
895 IN VOID *Ppi
896 )
897 {
898 EFI_STATUS Status;
899 EFI_BOOT_MODE BootMode;
900
901 Status = PeiServicesGetBootMode (&BootMode);
902 ASSERT_EFI_ERROR (Status);
903 if (BootMode != BOOT_ON_S3_RESUME) {
904 return EFI_UNSUPPORTED;
905 }
906
907 DEBUG ((DEBUG_INFO, "%a() - enter at S3 resume\n", __FUNCTION__));
908
909 OpalPasswordS3 ();
910
911 DEBUG ((DEBUG_INFO, "%a() - exit at S3 resume\n", __FUNCTION__));
912
913 return EFI_SUCCESS;
914 }
915
916 EFI_PEI_NOTIFY_DESCRIPTOR mOpalPasswordEndOfPeiNotifyDesc = {
917 (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
918 &gEfiEndOfPeiSignalPpiGuid,
919 OpalPasswordEndOfPeiNotify
920 };
921
922 /**
923 Main entry for this module.
924
925 @param FileHandle Handle of the file being invoked.
926 @param PeiServices Pointer to PEI Services table.
927
928 @return Status from PeiServicesNotifyPpi.
929
930 **/
931 EFI_STATUS
932 EFIAPI
933 OpalPasswordPeiInit (
934 IN EFI_PEI_FILE_HANDLE FileHandle,
935 IN CONST EFI_PEI_SERVICES **PeiServices
936 )
937 {
938 EFI_STATUS Status;
939
940 Status = PeiServicesNotifyPpi (&mOpalPasswordEndOfPeiNotifyDesc);
941 ASSERT_EFI_ERROR (Status);
942 return Status;
943 }
944