SecurityPkg/OpalPassword: Add support for pyrite 2.0 devices.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 4133e503e2fc58c8109d7e17f42260d72a9e9ebb..8733564f00b3043c9775329a20068747de40c615 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -105,13 +105,12 @@ OpalSupportGetAvailableActions(
   }\r
 \r
   //\r
-  // Psid revert is available for any device with media encryption support\r
-  // Revert is allowed for any device with media encryption support, however it requires\r
+  // Psid revert is available for any device with media encryption support or pyrite 2.0 type support.\r
   //\r
-  if (SupportedAttributes->MediaEncryption) {\r
+  if (SupportedAttributes->PyriteSscV2 || SupportedAttributes->MediaEncryption) {\r
 \r
     //\r
-    // Only allow psid revert if media encryption is enabled.\r
+    // Only allow psid revert if media encryption is enabled or pyrite 2.0 type support..\r
     // Otherwise, someone who steals a disk can psid revert the disk and the user Data is still\r
     // intact and accessible\r
     //\r
@@ -657,6 +656,8 @@ OpalEndOfDxeEventNotify (
   @param[in]  Dev           The device which need Psid to process Psid Revert\r
                             OPAL request.\r
   @param[in]  PopUpString   Pop up string.\r
+  @param[in]  PopUpString2  Pop up string in line 2.\r
+\r
   @param[out] PressEsc      Whether user escape function through Press ESC.\r
 \r
   @retval Psid string if success. NULL if failed.\r
@@ -666,6 +667,7 @@ CHAR8 *
 OpalDriverPopUpPsidInput (\r
   IN OPAL_DRIVER_DEVICE     *Dev,\r
   IN CHAR16                 *PopUpString,\r
+  IN CHAR16                 *PopUpString2,\r
   OUT BOOLEAN               *PressEsc\r
   )\r
 {\r
@@ -689,6 +691,7 @@ OpalDriverPopUpPsidInput (
       EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
       &InputKey,\r
       PopUpString,\r
+      PopUpString2,\r
       L"---------------------",\r
       Mask,\r
       NULL\r
@@ -1369,6 +1372,8 @@ ProcessOpalRequestPsidRevert (
   EFI_INPUT_KEY         Key;\r
   TCG_RESULT            Ret;\r
   CHAR16                *PopUpString;\r
+  CHAR16                *PopUpString2;\r
+  UINTN                 BufferSize;\r
 \r
   if (Dev == NULL) {\r
     return;\r
@@ -1378,6 +1383,20 @@ ProcessOpalRequestPsidRevert (
 \r
   PopUpString = OpalGetPopUpString (Dev, RequestString);\r
 \r
+  if (Dev->OpalDisk.EstimateTimeCost > MAX_ACCEPTABLE_REVERTING_TIME) {\r
+    BufferSize = StrSize (L"Warning: Revert action will take about ####### seconds, DO NOT power off system during the revert action!");\r
+    PopUpString2 = AllocateZeroPool (BufferSize);\r
+    ASSERT (PopUpString2 != NULL);\r
+    UnicodeSPrint (\r
+        PopUpString2,\r
+        BufferSize,\r
+        L"WARNING: Revert action will take about %d seconds, DO NOT power off system during the revert action!",\r
+        Dev->OpalDisk.EstimateTimeCost\r
+      );\r
+  } else {\r
+    PopUpString2 = NULL;\r
+  }\r
+\r
   Count = 0;\r
 \r
   ZeroMem(&Session, sizeof(Session));\r
@@ -1386,7 +1405,7 @@ ProcessOpalRequestPsidRevert (
   Session.OpalBaseComId = Dev->OpalDisk.OpalBaseComId;\r
 \r
   while (Count < MAX_PSID_TRY_COUNT) {\r
-    Psid = OpalDriverPopUpPsidInput (Dev, PopUpString, &PressEsc);\r
+    Psid = OpalDriverPopUpPsidInput (Dev, PopUpString, PopUpString2, &PressEsc);\r
     if (PressEsc) {\r
         do {\r
           CreatePopUp (\r
@@ -1400,7 +1419,7 @@ ProcessOpalRequestPsidRevert (
 \r
         if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {\r
           gST->ConOut->ClearScreen(gST->ConOut);\r
-          return;\r
+          goto Done;\r
         } else {\r
           //\r
           // Let user input Psid again.\r
@@ -1456,6 +1475,11 @@ ProcessOpalRequestPsidRevert (
     } while (Key.UnicodeChar != CHAR_CARRIAGE_RETURN);\r
     gST->ConOut->ClearScreen(gST->ConOut);\r
   }\r
+\r
+Done:\r
+  if (PopUpString2 != NULL) {\r
+    FreePool (PopUpString2);\r
+  }\r
 }\r
 \r
 /**\r
@@ -1482,6 +1506,8 @@ ProcessOpalRequestRevert (
   TCG_RESULT            Ret;\r
   BOOLEAN               PasswordFailed;\r
   CHAR16                *PopUpString;\r
+  CHAR16                *PopUpString2;\r
+  UINTN                 BufferSize;\r
 \r
   if (Dev == NULL) {\r
     return;\r
@@ -1491,6 +1517,20 @@ ProcessOpalRequestRevert (
 \r
   PopUpString = OpalGetPopUpString (Dev, RequestString);\r
 \r
+  if (Dev->OpalDisk.EstimateTimeCost > MAX_ACCEPTABLE_REVERTING_TIME) {\r
+    BufferSize = StrSize (L"Warning: Revert action will take about ####### seconds, DO NOT power off system during the revert action!");\r
+    PopUpString2 = AllocateZeroPool (BufferSize);\r
+    ASSERT (PopUpString2 != NULL);\r
+    UnicodeSPrint (\r
+        PopUpString2,\r
+        BufferSize,\r
+        L"WARNING: Revert action will take about %d seconds, DO NOT power off system during the revert action!",\r
+        Dev->OpalDisk.EstimateTimeCost\r
+      );\r
+  } else {\r
+    PopUpString2 = NULL;\r
+  }\r
+\r
   Count = 0;\r
 \r
   ZeroMem(&Session, sizeof(Session));\r
@@ -1499,7 +1539,7 @@ ProcessOpalRequestRevert (
   Session.OpalBaseComId = Dev->OpalDisk.OpalBaseComId;\r
 \r
   while (Count < MAX_PASSWORD_TRY_COUNT) {\r
-    Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc);\r
+    Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, PopUpString2, &PressEsc);\r
     if (PressEsc) {\r
         do {\r
           CreatePopUp (\r
@@ -1513,7 +1553,7 @@ ProcessOpalRequestRevert (
 \r
         if (Key.UnicodeChar == CHAR_CARRIAGE_RETURN) {\r
           gST->ConOut->ClearScreen(gST->ConOut);\r
-          return;\r
+          goto Done;\r
         } else {\r
           //\r
           // Let user input password again.\r
@@ -1596,6 +1636,11 @@ ProcessOpalRequestRevert (
     } while (Key.UnicodeChar != CHAR_CARRIAGE_RETURN);\r
     gST->ConOut->ClearScreen(gST->ConOut);\r
   }\r
+\r
+Done:\r
+  if (PopUpString2 != NULL) {\r
+    FreePool (PopUpString2);\r
+  }\r
 }\r
 \r
 /**\r
@@ -2337,6 +2382,7 @@ ReadyToBootCallback (
         Session.MediaId = Itr->OpalDisk.MediaId;\r
         Session.OpalBaseComId = Itr->OpalDisk.OpalBaseComId;\r
 \r
+        DEBUG ((DEBUG_INFO, "OpalPassword: ReadyToBoot point, send BlockSid command to device!\n"));\r
         Result = OpalBlockSid (&Session, TRUE);  // HardwareReset must always be TRUE\r
         if (Result != TcgResultSuccess) {\r
           DEBUG ((DEBUG_ERROR, "OpalBlockSid fail\n"));\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.h b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.h
index 2154523e9318a291954b8c47e1cbec13197ad09d..3cfa80051fa47cf3593edbf260557d691be8db5c 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.h
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.h
@@ -75,6 +75,13 @@ extern EFI_COMPONENT_NAME2_PROTOCOL  gOpalComponentName2;
 #define PSID_CHARACTER_LENGTH   0x20\r
 #define MAX_PSID_TRY_COUNT      5\r
 \r
+//\r
+// The max timeout value assume the user can wait for the revert action. The unit of this macro is second.\r
+// If the revert time value bigger than this one, driver needs to popup a dialog to let user confirm the \r
+// revert action.\r
+//\r
+#define MAX_ACCEPTABLE_REVERTING_TIME    10\r
+\r
 #pragma pack(1)\r
 \r
 //\r
@@ -140,6 +147,8 @@ typedef struct {
   TCG_LOCKING_FEATURE_DESCRIPTOR                  LockingFeature;         // Locking Feature Descriptor retrieved from performing a Level 0 Discovery\r
   UINT8                                           PasswordLength;\r
   UINT8                                           Password[OPAL_MAX_PASSWORD_SIZE];\r
+\r
+  UINT32                                          EstimateTimeCost;\r
 } OPAL_DISK;\r
 \r
 //\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalHii.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalHii.c
index e4972227b669ff27ff2bdf1706f83bb5f657b9c4..4817f99eff7e7d31de5d4176b2649f6dfb2a2cf9 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalHii.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalHii.c
@@ -13,6 +13,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 **/\r
 \r
 #include "OpalHii.h"\r
+//\r
+// Character definitions\r
+//\r
+#define UPPER_LOWER_CASE_OFFSET 0x20\r
 \r
 //\r
 // This is the generated IFR binary Data for each formset defined in VFR.\r
@@ -520,6 +524,59 @@ GetDiskNameStringId(
   return 0;\r
 }\r
 \r
+/**\r
+  Confirm whether user truly want to do the revert action.\r
+\r
+  @param     OpalDisk            The device which need to do the revert action.\r
+\r
+  @retval  EFI_SUCCESS           Confirmed user want to do the revert action.\r
+**/\r
+EFI_STATUS\r
+HiiConfirmRevertAction (\r
+  IN OPAL_DISK                  *OpalDisk\r
+\r
+  )\r
+{\r
+  CHAR16                        Unicode[512];\r
+  EFI_INPUT_KEY                 Key;\r
+  CHAR16                        ApproveResponse;\r
+  CHAR16                        RejectResponse;\r
+\r
+  //\r
+  // When the estimate cost time bigger than MAX_ACCEPTABLE_REVERTING_TIME, pop up dialog to let user confirm\r
+  // the revert action.\r
+  //\r
+  if (OpalDisk->EstimateTimeCost < MAX_ACCEPTABLE_REVERTING_TIME) {\r
+    return EFI_SUCCESS;\r
+  }\r
+\r
+  ApproveResponse = L'Y';\r
+  RejectResponse  = L'N';\r
+\r
+  UnicodeSPrint(Unicode, StrSize(L"WARNING: Revert device needs about ####### seconds"), L"WARNING: Revert device needs about %d seconds", OpalDisk->EstimateTimeCost);\r
+\r
+  do {\r
+    CreatePopUp(\r
+        EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
+        &Key,\r
+        Unicode,\r
+        L" System should not be powered off until revert completion ",\r
+        L" ",\r
+        L" Press 'Y/y' to continue, press 'N/n' to cancal ",\r
+        NULL\r
+    );\r
+  } while (\r
+      ((Key.UnicodeChar | UPPER_LOWER_CASE_OFFSET) != (ApproveResponse | UPPER_LOWER_CASE_OFFSET)) &&\r
+      ((Key.UnicodeChar | UPPER_LOWER_CASE_OFFSET) != (RejectResponse | UPPER_LOWER_CASE_OFFSET))\r
+    );\r
+\r
+  if ((Key.UnicodeChar | UPPER_LOWER_CASE_OFFSET) == (RejectResponse | UPPER_LOWER_CASE_OFFSET)) {\r
+    return EFI_ABORTED;\r
+  }\r
+\r
+  return EFI_SUCCESS;\r
+}\r
+\r
 /**\r
   This function processes the results of changes in configuration.\r
 \r
@@ -588,6 +645,17 @@ DriverCallback(
     switch (HiiKeyId) {\r
       case HII_KEY_ID_GOTO_DISK_INFO:\r
         return HiiSelectDisk((UINT8)HiiKey.KeyBits.Index);\r
+\r
+      case HII_KEY_ID_REVERT:\r
+      case HII_KEY_ID_PSID_REVERT:\r
+        OpalDisk = HiiGetOpalDiskCB(gHiiConfiguration.SelectedDiskIndex);\r
+        if (OpalDisk != NULL) {\r
+          return HiiConfirmRevertAction (OpalDisk);\r
+        } else {\r
+          ASSERT (FALSE);\r
+          return EFI_SUCCESS;\r
+        }\r
+\r
     }\r
   } else if (Action == EFI_BROWSER_ACTION_CHANGED) {\r
     switch (HiiKeyId) {\r
@@ -1112,6 +1180,8 @@ OpalDiskInitialize (
 {\r
   TCG_RESULT                  TcgResult;\r
   OPAL_SESSION                Session;\r
+  UINT8                       ActiveDataRemovalMechanism;\r
+  UINT32                      RemovalMechanishLists[ResearvedMechanism];\r
 \r
   ZeroMem(&Dev->OpalDisk, sizeof(OPAL_DISK));\r
   Dev->OpalDisk.Sscp = Dev->Sscp;\r
@@ -1133,6 +1203,20 @@ OpalDiskInitialize (
     return EFI_DEVICE_ERROR;\r
   }\r
 \r
+  if (Dev->OpalDisk.SupportedAttributes.DataRemoval) {\r
+    TcgResult = OpalUtilGetDataRemovalMechanismLists (&Session, RemovalMechanishLists);\r
+    if (TcgResult != TcgResultSuccess) {\r
+      return EFI_DEVICE_ERROR;\r
+    }\r
+\r
+    TcgResult = OpalUtilGetActiveDataRemovalMechanism (&Session, Dev->OpalDisk.Msid, Dev->OpalDisk.MsidLength, &ActiveDataRemovalMechanism);\r
+    if (TcgResult != TcgResultSuccess) {\r
+      return EFI_DEVICE_ERROR;\r
+    }\r
+\r
+    Dev->OpalDisk.EstimateTimeCost = RemovalMechanishLists[ActiveDataRemovalMechanism];\r
+  }\r
+\r
   return OpalDiskUpdateStatus (&Dev->OpalDisk);\r
 }\r
 \r

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordPei.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordPei.c
index b4b2d4b3f0c8fe790d355466b928681bbc9a9336..edb47ca8bc797f05ff0b6b46e07a5f0839807462 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordPei.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordPei.c
@@ -635,6 +635,7 @@ UnlockOpalPassword (
     BlockSIDEnabled = FALSE;\r
   }\r
   if (BlockSIDEnabled && BlockSidSupport) {\r
+    DEBUG ((DEBUG_INFO, "OpalPassword: S3 phase send BlockSid command to device!\n"));\r
     ZeroMem(&Session, sizeof (Session));\r
     Session.Sscp = &OpalDev->Sscp;\r
     Session.MediaId = 0;\r