SecurityPkg/OpalPassword: Add PCD to skip password prompt

https://bugzilla.tianocore.org/show_bug.cgi?id=1801
Add a PCD for skipping password prompt in device unlocked status.
Previous change only support if storage device is in locked status.
This change is added to support the case that security status of the
storage device is unlocked.

Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 3314f1854be474034a3a855ad3abde1b3faca54d..96db80c2d2fa95d06a66fafc9dcc4b54fef77b31 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -422,11 +422,11 @@
   # @Prompt Possible TPM2 Interrupt Number buffer\r
   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D\r
 \r
-  ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>\r
-  #   TRUE  - Skip unlock device flow.<BR>\r
-  #   FALSE - Does not skip unlock device flow.<BR>\r
-  # @Prompt Skip Opal DXE driver unlock device flow.\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020\r
+  ## Indicates if Opal DXE driver skip password prompt.<BR><BR>\r
+  #   TRUE  - Skip password prompt.<BR>\r
+  #   FALSE - Does not skip password prompt.<BR>\r
+  # @Prompt Skip Opal DXE driver password prompt.\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalPasswordPrompt|FALSE|BOOLEAN|0x00010020\r
 \r
 [PcdsDynamic, PcdsDynamicEx]\r
 \r

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 965205c0b22447f46a6070018eed23a04379f0d5..e14fa32354ea09c7665e661c95ba0dcbe48e7c63 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -899,8 +899,20 @@ OpalDriverRequestPassword (
 \r
     IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature);\r
 \r
-    if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) {\r
-      return;\r
+    //\r
+    // Add PcdSkipOpalPasswordPrompt to determin whether to skip password prompt.\r
+    // Due to board design, device may not power off during system warm boot, which result in\r
+    // security status remain unlocked status, hence we add device security status check here.\r
+    //\r
+    // If device is in the locked status, device keeps locked and system continues booting.\r
+    // If device is in the unlocked status, system is forced shutdown to support security requirement.\r
+    //\r
+    if (PcdGetBool (PcdSkipOpalPasswordPrompt)) {\r
+      if (IsLocked) {\r
+        return;\r
+      } else {\r
+        gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);\r
+      }\r
     }\r
 \r
     while (Count < MAX_PASSWORD_TRY_COUNT) {\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
index e74f147aaa09f1cc38a3ff063812bf3e0cefab5b..87519198c0d875336f86de011ed902adb93cc9d7 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
@@ -71,7 +71,7 @@
   gS3StorageDeviceInitListGuid                  ## SOMETIMES_PRODUCES ## UNDEFINED\r
 \r
 [Pcd]\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock  ## CONSUMES\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalPasswordPrompt  ## CONSUMES\r
 \r
 [Depex]\r
   gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid\r