SecurityPkg/OpalPassword: Fixed input correct password not works issue

[mirror_edk2.git] / SecurityPkg / Tcg / Opal / OpalPassword / OpalDriver.c

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 1b55bbe4ecb840f12c32cd2002cfe42b753e087b..e3f5056953bb21809354364bb14ac11a37116cbb 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -27,7 +27,7 @@ EFI_GUID mOpalDeviceNvmeGuid = OPAL_DEVICE_NVME_GUID;
 BOOLEAN                 mOpalEndOfDxe = FALSE;\r
 OPAL_REQUEST_VARIABLE   *mOpalRequestVariable = NULL;\r
 UINTN                   mOpalRequestVariableSize = 0;\r
-CHAR16                  mPopUpString[256];\r
+CHAR16                  mPopUpString[100];\r
 \r
 typedef struct {\r
   UINT32                   Address;\r
@@ -105,13 +105,12 @@ OpalSupportGetAvailableActions(
   }\r
 \r
   //\r
-  // Psid revert is available for any device with media encryption support\r
-  // Revert is allowed for any device with media encryption support, however it requires\r
+  // Psid revert is available for any device with media encryption support or pyrite 2.0 type support.\r
   //\r
-  if (SupportedAttributes->MediaEncryption) {\r
+  if (SupportedAttributes->PyriteSscV2 || SupportedAttributes->MediaEncryption) {\r
 \r
     //\r
-    // Only allow psid revert if media encryption is enabled.\r
+    // Only allow psid revert if media encryption is enabled or pyrite 2.0 type support..\r
     // Otherwise, someone who steals a disk can psid revert the disk and the user Data is still\r
     // intact and accessible\r
     //\r
@@ -657,15 +656,18 @@ OpalEndOfDxeEventNotify (
   @param[in]  Dev           The device which need Psid to process Psid Revert\r
                             OPAL request.\r
   @param[in]  PopUpString   Pop up string.\r
+  @param[in]  PopUpString2  Pop up string in line 2.\r
+\r
   @param[out] PressEsc      Whether user escape function through Press ESC.\r
 \r
-  @retval Password string if success. NULL if failed.\r
+  @retval Psid string if success. NULL if failed.\r
 \r
 **/\r
 CHAR8 *\r
 OpalDriverPopUpPsidInput (\r
   IN OPAL_DRIVER_DEVICE     *Dev,\r
   IN CHAR16                 *PopUpString,\r
+  IN CHAR16                 *PopUpString2,\r
   OUT BOOLEAN               *PressEsc\r
   )\r
 {\r
@@ -685,14 +687,26 @@ OpalDriverPopUpPsidInput (
   InputLength = 0;\r
   while (TRUE) {\r
     Mask[InputLength] = L'_';\r
-    CreatePopUp (\r
-      EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
-      &InputKey,\r
-      PopUpString,\r
-      L"---------------------",\r
-      Mask,\r
-      NULL\r
-    );\r
+    if (PopUpString2 == NULL) {\r
+      CreatePopUp (\r
+        EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
+        &InputKey,\r
+        PopUpString,\r
+        L"---------------------",\r
+        Mask,\r
+        NULL\r
+      );\r
+    } else {\r
+      CreatePopUp (\r
+        EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
+        &InputKey,\r
+        PopUpString,\r
+        PopUpString2,\r
+        L"---------------------",\r
+        Mask,\r
+        NULL\r
+      );\r
+    }\r
 \r
     //\r
     // Check key.\r
@@ -908,11 +922,13 @@ OpalDriverPopUpPasswordInput (
 }\r
 \r
 /**\r
-  Check if disk is locked, show popup window and ask for password if it is.\r
+  Get pop up string.\r
 \r
-  @param[in] Dev            The device which need to be unlocked.\r
+  @param[in] Dev            The OPAL device.\r
   @param[in] RequestString  Request string.\r
 \r
+  @return Pop up string.\r
+\r
 **/\r
 CHAR16 *\r
 OpalGetPopUpString (\r
@@ -920,15 +936,10 @@ OpalGetPopUpString (
   IN CHAR16             *RequestString\r
   )\r
 {\r
-  UINTN                 StrLength;\r
-\r
-  StrLength = StrLen (RequestString) + 1 + MAX (StrLen (Dev->Name16), StrLen (L"Disk"));\r
-  ASSERT (StrLength < sizeof (mPopUpString) / sizeof (CHAR16));\r
-\r
   if (Dev->Name16 == NULL) {\r
-    UnicodeSPrint (mPopUpString, StrLength + 1, L"%s Disk", RequestString);\r
+    UnicodeSPrint (mPopUpString, sizeof (mPopUpString), L"%s Disk", RequestString);\r
   } else {\r
-    UnicodeSPrint (mPopUpString, StrLength + 1, L"%s %s", RequestString, Dev->Name16);\r
+    UnicodeSPrint (mPopUpString, sizeof (mPopUpString), L"%s %s", RequestString, Dev->Name16);\r
   }\r
 \r
   return mPopUpString;\r
@@ -1065,6 +1076,15 @@ OpalDriverRequestPassword (
         break;\r
       }\r
 \r
+      //\r
+      // Check whether opal device's Tries value has reach the TryLimit value, if yes, force a shutdown\r
+      // before accept new password.\r
+      //\r
+      if (Ret == TcgResultFailureInvalidType) {\r
+        Count = MAX_PASSWORD_TRY_COUNT;\r
+        break;\r
+      }\r
+\r
       Count++;\r
 \r
       do {\r
@@ -1372,6 +1392,8 @@ ProcessOpalRequestPsidRevert (
   EFI_INPUT_KEY         Key;\r
   TCG_RESULT            Ret;\r
   CHAR16                *PopUpString;\r
+  CHAR16                *PopUpString2;\r
+  UINTN                 BufferSize;\r
 \r
   if (Dev == NULL) {\r
     return;\r
@@ -1381,6 +1403,20 @@ ProcessOpalRequestPsidRevert (
 \r
   PopUpString = OpalGetPopUpString (Dev, RequestString);\r
 \r
+  if (Dev->OpalDisk.EstimateTimeCost > MAX_ACCEPTABLE_REVERTING_TIME) {\r
+    BufferSize = StrSize (L"Warning: Revert action will take about ####### seconds, DO NOT power off system during the revert action!");\r
+    PopUpString2 = AllocateZeroPool (BufferSize);\r
+    ASSERT (PopUpString2 != NULL);\r
+    UnicodeSPrint (\r
+        PopUpString2,\r
+        BufferSize,\r
+        L"WARNING: Revert action will take about %d seconds, DO NOT power off system during the revert action!",\r
+        Dev->OpalDisk.EstimateTimeCost\r
+      );\r
+  } else {\r
+    PopUpString2 = NULL;\r
+  }\r
+\r
   Count = 0;\r
 \r
   ZeroMem(&Session, sizeof(Session));\r
@@ -1389,7 +1425,7 @@ ProcessOpalRequestPsidRevert (
   Session.OpalBaseComId = Dev->OpalDisk.OpalBaseComId;\r
 \r
   while (Count < MAX_PSID_TRY_COUNT) {\r
-    Psid = OpalDriverPopUpPsidInput (Dev, PopUpString, &PressEsc);\r
+    Psid = OpalDriverPopUpPsidInput (Dev, PopUpString, PopUpString2, &PressEsc);\r
     if (PressEsc) {\r
         do {\r
           CreatePopUp (\r
@@ -1403,7 +1439,7 @@ ProcessOpalRequestPsidRevert (
 \r
         if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {\r
           gST->ConOut->ClearScreen(gST->ConOut);\r
-          return;\r
+          goto Done;\r
         } else {\r
           //\r
           // Let user input Psid again.\r
@@ -1459,6 +1495,11 @@ ProcessOpalRequestPsidRevert (
     } while (Key.UnicodeChar != CHAR_CARRIAGE_RETURN);\r
     gST->ConOut->ClearScreen(gST->ConOut);\r
   }\r
+\r
+Done:\r
+  if (PopUpString2 != NULL) {\r
+    FreePool (PopUpString2);\r
+  }\r
 }\r
 \r
 /**\r
@@ -1485,6 +1526,8 @@ ProcessOpalRequestRevert (
   TCG_RESULT            Ret;\r
   BOOLEAN               PasswordFailed;\r
   CHAR16                *PopUpString;\r
+  CHAR16                *PopUpString2;\r
+  UINTN                 BufferSize;\r
 \r
   if (Dev == NULL) {\r
     return;\r
@@ -1494,6 +1537,20 @@ ProcessOpalRequestRevert (
 \r
   PopUpString = OpalGetPopUpString (Dev, RequestString);\r
 \r
+  if (Dev->OpalDisk.EstimateTimeCost > MAX_ACCEPTABLE_REVERTING_TIME) {\r
+    BufferSize = StrSize (L"Warning: Revert action will take about ####### seconds, DO NOT power off system during the revert action!");\r
+    PopUpString2 = AllocateZeroPool (BufferSize);\r
+    ASSERT (PopUpString2 != NULL);\r
+    UnicodeSPrint (\r
+        PopUpString2,\r
+        BufferSize,\r
+        L"WARNING: Revert action will take about %d seconds, DO NOT power off system during the revert action!",\r
+        Dev->OpalDisk.EstimateTimeCost\r
+      );\r
+  } else {\r
+    PopUpString2 = NULL;\r
+  }\r
+\r
   Count = 0;\r
 \r
   ZeroMem(&Session, sizeof(Session));\r
@@ -1502,7 +1559,7 @@ ProcessOpalRequestRevert (
   Session.OpalBaseComId = Dev->OpalDisk.OpalBaseComId;\r
 \r
   while (Count < MAX_PASSWORD_TRY_COUNT) {\r
-    Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc);\r
+    Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, PopUpString2, &PressEsc);\r
     if (PressEsc) {\r
         do {\r
           CreatePopUp (\r
@@ -1516,7 +1573,7 @@ ProcessOpalRequestRevert (
 \r
         if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {\r
           gST->ConOut->ClearScreen(gST->ConOut);\r
-          return;\r
+          goto Done;\r
         } else {\r
           //\r
           // Let user input password again.\r
@@ -1599,6 +1656,11 @@ ProcessOpalRequestRevert (
     } while (Key.UnicodeChar != CHAR_CARRIAGE_RETURN);\r
     gST->ConOut->ClearScreen(gST->ConOut);\r
   }\r
+\r
+Done:\r
+  if (PopUpString2 != NULL) {\r
+    FreePool (PopUpString2);\r
+  }\r
 }\r
 \r
 /**\r
@@ -2340,6 +2402,7 @@ ReadyToBootCallback (
         Session.MediaId = Itr->OpalDisk.MediaId;\r
         Session.OpalBaseComId = Itr->OpalDisk.OpalBaseComId;\r
 \r
+        DEBUG ((DEBUG_INFO, "OpalPassword: ReadyToBoot point, send BlockSid command to device!\n"));\r
         Result = OpalBlockSid (&Session, TRUE);  // HardwareReset must always be TRUE\r
         if (Result != TcgResultSuccess) {\r
           DEBUG ((DEBUG_ERROR, "OpalBlockSid fail\n"));\r