SecurityPkg/Tcg/Opal/OpalPasswordSmm/OpalPasswordSmm.h

   1 /** @file
   2   Opal password smm driver which is used to support Opal security feature at s3 path.
   3
   4 Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #ifndef _OPAL_PASSWORD_SMM_H_
  16 #define _OPAL_PASSWORD_SMM_H_
  17
  18 #include <PiSmm.h>
  19 #include <IndustryStandard/Atapi.h>
  20
  21 #include <Protocol/SmmSwDispatch2.h>
  22 #include <Protocol/SmmSxDispatch2.h>
  23 #include <Protocol/AtaPassThru.h>
  24 #include <Protocol/PciIo.h>
  25 #include <Protocol/SmmReadyToLock.h>
  26 #include <Protocol/SmmVariable.h>
  27 #include <Protocol/VariableLock.h>
  28 #include <Protocol/SmmEndOfDxe.h>
  29 #include <Protocol/StorageSecurityCommand.h>
  30
  31 #include <Library/OpalPasswordSupportLib.h>
  32 #include <Library/DebugLib.h>
  33 #include <Library/PcdLib.h>
  34 #include <Library/IoLib.h>
  35 #include <Library/TimerLib.h>
  36 #include <Library/PciLib.h>
  37 #include <Library/BaseLib.h>
  38 #include <Library/BaseMemoryLib.h>
  39 #include <Library/SmmServicesTableLib.h>
  40 #include <Library/MemoryAllocationLib.h>
  41 #include <Library/UefiDriverEntryPoint.h>
  42 #include <Library/UefiBootServicesTableLib.h>
  43 #include <Library/UefiRuntimeServicesTableLib.h>
  44 #include <Library/UefiLib.h>
  45 #include <Library/S3BootScriptLib.h>
  46 #include <Library/DevicePathLib.h>
  47 #include <Library/DxeServicesTableLib.h>
  48 #include <Library/SmmIoLib.h>
  49
  50 #include <IndustryStandard/Pci22.h>
  51
  52 #include <Guid/OpalPasswordExtraInfoVariable.h>
  53
  54 #include "OpalAhciMode.h"
  55 #include "OpalIdeMode.h"
  56 #include "OpalNvmeMode.h"
  57
  58 //
  59 // Time out Value for ATA pass through protocol
  60 //
  61 #define ATA_TIMEOUT                      EFI_TIMER_PERIOD_SECONDS (3)
  62
  63 //
  64 // The payload Length of HDD related ATA commands
  65 //
  66 #define HDD_PAYLOAD                      512
  67 //
  68 // According to ATA spec, the max Length of hdd password is 32 bytes
  69 //
  70 #define OPAL_PASSWORD_MAX_LENGTH         32
  71
  72 extern VOID                              *mBuffer;
  73
  74 #pragma pack(1)
  75
  76 typedef struct {
  77   UINT32                   Address;
  78   S3_BOOT_SCRIPT_LIB_WIDTH Width;
  79 } OPAL_HC_PCI_REGISTER_SAVE;
  80
  81
  82 typedef struct {
  83   UINT32                SegNum;
  84   UINT32                BusNum;
  85   UINT32                DevNum;
  86   UINT32                FuncNum;
  87 } PCI_DEVICE;
  88
  89 /**
  90 * Opal I/O Type utilized by the Trusted IO callback
  91 *
  92 * The type indicates if the I/O is a send or receive
  93 */
  94 typedef enum {
  95     //
  96     // I/O is a TCG Trusted Send command
  97     //
  98     OpalSend,
  99
 100     //
 101     // I/O is a TCG Trusted Receive command
 102     //
 103     OpalRecv
 104 } OPAL_IO_TYPE;
 105
 106
 107 #define OPAL_SMM_DEVICE_SIGNATURE SIGNATURE_32 ('o', 's', 'd', 's')
 108
 109 typedef struct {
 110   UINTN                                    Signature;
 111   LIST_ENTRY                               Link;
 112
 113   EFI_STORAGE_SECURITY_COMMAND_PROTOCOL    Sscp;
 114
 115   UINT32                                   SegNum;
 116   UINT32                                   BusNum;
 117   UINT32                                   DevNum;
 118   UINT32                                   FuncNum;
 119
 120   UINT8                                    DeviceType;
 121
 122   UINT32                                   SataPort;
 123   UINT32                                   SataPortMultiplierPort;
 124
 125   UINT32                                   NvmeNamespaceId;
 126
 127   UINT8                                    Password[32];
 128   UINT8                                    PasswordLength;
 129
 130   UINT32                                   Length;
 131   PCI_DEVICE                               *PciBridgeNode;
 132
 133   UINT16                                   OpalBaseComId;
 134 } OPAL_SMM_DEVICE;
 135
 136 #define OPAL_SMM_DEVICE_FROM_THIS(a)  CR (a, OPAL_SMM_DEVICE, Sscp, OPAL_SMM_DEVICE_SIGNATURE)
 137
 138 #pragma pack()
 139
 140 /**
 141   Send a security protocol command to a device that receives data and/or the result
 142   of one or more commands sent by SendData.
 143
 144   The ReceiveData function sends a security protocol command to the given MediaId.
 145   The security protocol command sent is defined by SecurityProtocolId and contains
 146   the security protocol specific data SecurityProtocolSpecificData. The function
 147   returns the data from the security protocol command in PayloadBuffer.
 148
 149   For devices supporting the SCSI command set, the security protocol command is sent
 150   using the SECURITY PROTOCOL IN command defined in SPC-4.
 151
 152   For devices supporting the ATA command set, the security protocol command is sent
 153   using one of the TRUSTED RECEIVE commands defined in ATA8-ACS if PayloadBufferSize
 154   is non-zero.
 155
 156   If the PayloadBufferSize is zero, the security protocol command is sent using the
 157   Trusted Non-Data command defined in ATA8-ACS.
 158
 159   If PayloadBufferSize is too small to store the available data from the security
 160   protocol command, the function shall copy PayloadBufferSize bytes into the
 161   PayloadBuffer and return EFI_WARN_BUFFER_TOO_SMALL.
 162
 163   If PayloadBuffer or PayloadTransferSize is NULL and PayloadBufferSize is non-zero,
 164   the function shall return EFI_INVALID_PARAMETER.
 165
 166   If the given MediaId does not support security protocol commands, the function shall
 167   return EFI_UNSUPPORTED. If there is no media in the device, the function returns
 168   EFI_NO_MEDIA. If the MediaId is not the ID for the current media in the device,
 169   the function returns EFI_MEDIA_CHANGED.
 170
 171   If the security protocol fails to complete within the Timeout period, the function
 172   shall return EFI_TIMEOUT.
 173
 174   If the security protocol command completes without an error, the function shall
 175   return EFI_SUCCESS. If the security protocol command completes with an error, the
 176   function shall return EFI_DEVICE_ERROR.
 177
 178   @param  This                         Indicates a pointer to the calling context.
 179   @param  MediaId                      ID of the medium to receive data from.
 180   @param  Timeout                      The timeout, in 100ns units, to use for the execution
 181                                        of the security protocol command. A Timeout value of 0
 182                                        means that this function will wait indefinitely for the
 183                                        security protocol command to execute. If Timeout is greater
 184                                        than zero, then this function will return EFI_TIMEOUT
 185                                        if the time required to execute the receive data command
 186                                        is greater than Timeout.
 187   @param  SecurityProtocolId           The value of the "Security Protocol" parameter of
 188                                        the security protocol command to be sent.
 189   @param  SecurityProtocolSpecificData The value of the "Security Protocol Specific" parameter
 190                                        of the security protocol command to be sent.
 191   @param  PayloadBufferSize            Size in bytes of the payload data buffer.
 192   @param  PayloadBuffer                A pointer to a destination buffer to store the security
 193                                        protocol command specific payload data for the security
 194                                        protocol command. The caller is responsible for having
 195                                        either implicit or explicit ownership of the buffer.
 196   @param  PayloadTransferSize          A pointer to a buffer to store the size in bytes of the
 197                                        data written to the payload data buffer.
 198
 199   @retval EFI_SUCCESS                  The security protocol command completed successfully.
 200   @retval EFI_WARN_BUFFER_TOO_SMALL    The PayloadBufferSize was too small to store the available
 201                                        data from the device. The PayloadBuffer contains the truncated data.
 202   @retval EFI_UNSUPPORTED              The given MediaId does not support security protocol commands.
 203   @retval EFI_DEVICE_ERROR             The security protocol command completed with an error.
 204   @retval EFI_NO_MEDIA                 There is no media in the device.
 205   @retval EFI_MEDIA_CHANGED            The MediaId is not for the current media.
 206   @retval EFI_INVALID_PARAMETER        The PayloadBuffer or PayloadTransferSize is NULL and
 207                                        PayloadBufferSize is non-zero.
 208   @retval EFI_TIMEOUT                  A timeout occurred while waiting for the security
 209                                        protocol command to execute.
 210
 211 **/
 212 EFI_STATUS
 213 EFIAPI
 214 SecurityReceiveData (
 215   IN  EFI_STORAGE_SECURITY_COMMAND_PROTOCOL   *This,
 216   IN  UINT32                                  MediaId,
 217   IN  UINT64                                  Timeout,
 218   IN  UINT8                                   SecurityProtocolId,
 219   IN  UINT16                                  SecurityProtocolSpecificData,
 220   IN  UINTN                                   PayloadBufferSize,
 221   OUT VOID                                    *PayloadBuffer,
 222   OUT UINTN                                   *PayloadTransferSize
 223   );
 224
 225 /**
 226   Send a security protocol command to a device.
 227
 228   The SendData function sends a security protocol command containing the payload
 229   PayloadBuffer to the given MediaId. The security protocol command sent is
 230   defined by SecurityProtocolId and contains the security protocol specific data
 231   SecurityProtocolSpecificData. If the underlying protocol command requires a
 232   specific padding for the command payload, the SendData function shall add padding
 233   bytes to the command payload to satisfy the padding requirements.
 234
 235   For devices supporting the SCSI command set, the security protocol command is sent
 236   using the SECURITY PROTOCOL OUT command defined in SPC-4.
 237
 238   For devices supporting the ATA command set, the security protocol command is sent
 239   using one of the TRUSTED SEND commands defined in ATA8-ACS if PayloadBufferSize
 240   is non-zero. If the PayloadBufferSize is zero, the security protocol command is
 241   sent using the Trusted Non-Data command defined in ATA8-ACS.
 242
 243   If PayloadBuffer is NULL and PayloadBufferSize is non-zero, the function shall
 244   return EFI_INVALID_PARAMETER.
 245
 246   If the given MediaId does not support security protocol commands, the function
 247   shall return EFI_UNSUPPORTED. If there is no media in the device, the function
 248   returns EFI_NO_MEDIA. If the MediaId is not the ID for the current media in the
 249   device, the function returns EFI_MEDIA_CHANGED.
 250
 251   If the security protocol fails to complete within the Timeout period, the function
 252   shall return EFI_TIMEOUT.
 253
 254   If the security protocol command completes without an error, the function shall return
 255   EFI_SUCCESS. If the security protocol command completes with an error, the function
 256   shall return EFI_DEVICE_ERROR.
 257
 258   @param  This                         Indicates a pointer to the calling context.
 259   @param  MediaId                      ID of the medium to receive data from.
 260   @param  Timeout                      The timeout, in 100ns units, to use for the execution
 261                                        of the security protocol command. A Timeout value of 0
 262                                        means that this function will wait indefinitely for the
 263                                        security protocol command to execute. If Timeout is greater
 264                                        than zero, then this function will return EFI_TIMEOUT
 265                                        if the time required to execute the receive data command
 266                                        is greater than Timeout.
 267   @param  SecurityProtocolId           The value of the "Security Protocol" parameter of
 268                                        the security protocol command to be sent.
 269   @param  SecurityProtocolSpecificData The value of the "Security Protocol Specific" parameter
 270                                        of the security protocol command to be sent.
 271   @param  PayloadBufferSize            Size in bytes of the payload data buffer.
 272   @param  PayloadBuffer                A pointer to a destination buffer to store the security
 273                                        protocol command specific payload data for the security
 274                                        protocol command.
 275
 276   @retval EFI_SUCCESS                  The security protocol command completed successfully.
 277   @retval EFI_UNSUPPORTED              The given MediaId does not support security protocol commands.
 278   @retval EFI_DEVICE_ERROR             The security protocol command completed with an error.
 279   @retval EFI_NO_MEDIA                 There is no media in the device.
 280   @retval EFI_MEDIA_CHANGED            The MediaId is not for the current media.
 281   @retval EFI_INVALID_PARAMETER        The PayloadBuffer is NULL and PayloadBufferSize is non-zero.
 282   @retval EFI_TIMEOUT                  A timeout occurred while waiting for the security
 283                                        protocol command to execute.
 284
 285 **/
 286 EFI_STATUS
 287 EFIAPI
 288 SecuritySendData (
 289   IN EFI_STORAGE_SECURITY_COMMAND_PROTOCOL    *This,
 290   IN UINT32                                   MediaId,
 291   IN UINT64                                   Timeout,
 292   IN UINT8                                    SecurityProtocolId,
 293   IN UINT16                                   SecurityProtocolSpecificData,
 294   IN UINTN                                    PayloadBufferSize,
 295   IN VOID                                     *PayloadBuffer
 296   );
 297
 298 #endif // _OPAL_PASSWORD_SMM_H_
 299