SecurityPkg OpalPasswordDxe: Use PP actions to enable BlockSID.

Update the implementation, use physical presence defined actions to
update the BlockSid related status.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
index bd12d5ad8010f3ecd9c5ab905ad82ae34c1876a1..c9b1f8e5ea47433035e38fbc1db5336c58290921 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.c
@@ -416,28 +416,15 @@ ReadyToBootCallback (
   IN VOID             *Context\r
   )\r
 {\r
-  EFI_STATUS          Status;\r
-  OPAL_DRIVER_DEVICE* Itr;\r
-  TCG_RESULT          Result;\r
-  OPAL_EXTRA_INFO_VAR OpalExtraInfo;\r
-  UINTN               DataSize;\r
-  OPAL_SESSION        Session;\r
+  OPAL_DRIVER_DEVICE                         *Itr;\r
+  TCG_RESULT                                 Result;\r
+  OPAL_SESSION                               Session;\r
+  UINT32                                     PpStorageFlag;\r
 \r
   gBS->CloseEvent (Event);\r
 \r
-  DataSize = sizeof (OPAL_EXTRA_INFO_VAR);\r
-  Status = gRT->GetVariable (\r
-                  OPAL_EXTRA_INFO_VAR_NAME,\r
-                  &gOpalExtraInfoVariableGuid,\r
-                  NULL,\r
-                  &DataSize,\r
-                  &OpalExtraInfo\r
-                  );\r
-  if (EFI_ERROR (Status)) {\r
-    return;\r
-  }\r
-\r
-  if (OpalExtraInfo.EnableBlockSid == TRUE) {\r
+  PpStorageFlag = TcgPhysicalPresenceStorageLibReturnStorageFlags();\r
+  if ((PpStorageFlag & TCG_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID) != 0) {\r
     //\r
     // Send BlockSID command to each Opal disk\r
     //\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.h b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.h
index 213c139e0145d17d3acdb7ae6d7c1e89642ee6c7..b04d0532d821d69cd803c3076f563ddbf0cab651 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.h
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalDriver.h
@@ -16,8 +16,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define _OPAL_DRIVER_H_\r
 \r
 #include <PiDxe.h>\r
-\r
-#include <Guid/OpalPasswordExtraInfoVariable.h>\r
+#include <IndustryStandard/TcgPhysicalPresence.h>\r
 \r
 #include <Protocol/PciIo.h>\r
 #include <Protocol/SmmCommunication.h>\r
@@ -40,6 +39,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/UefiHiiServicesLib.h>\r
 #include <Library/TcgStorageOpalLib.h>\r
 #include <Library/OpalPasswordSupportLib.h>\r
+#include <Library/TcgPhysicalPresenceStorageLib.h>\r
 \r
 #define EFI_DRIVER_NAME_UNICODE L"1.0 UEFI Opal Driver"\r
 \r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
index ee73697d80a95ccedd155e9859278266b7aaa710..5e3106acf6b0700a6b9fdb40a1f49c75cb9c2cef 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHii.c
@@ -90,23 +90,63 @@ HiiSetCurrentConfiguration(
   VOID\r
   )\r
 {\r
-  EFI_STATUS                            Status;\r
-  OPAL_EXTRA_INFO_VAR                   OpalExtraInfo;\r
-  UINTN                                 DataSize;\r
+  UINT32                                       PpStorageFlag;\r
+  EFI_STRING                                   NewString;\r
 \r
   gHiiConfiguration.NumDisks = GetDeviceCount();\r
 \r
-  DataSize = sizeof (OPAL_EXTRA_INFO_VAR);\r
-  Status = gRT->GetVariable (\r
-                  OPAL_EXTRA_INFO_VAR_NAME,\r
-                  &gOpalExtraInfoVariableGuid,\r
-                  NULL,\r
-                  &DataSize,\r
-                  &OpalExtraInfo\r
-                  );\r
-  if (!EFI_ERROR (Status)) {\r
-    gHiiConfiguration.EnableBlockSid = OpalExtraInfo.EnableBlockSid;\r
+  //\r
+  // Update the BlockSID status string.\r
+  //\r
+  PpStorageFlag = TcgPhysicalPresenceStorageLibReturnStorageFlags();\r
+\r
+  if ((PpStorageFlag & TCG_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID) != 0) {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_ENABLED), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
+  } else {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_DISABLED), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
+  }\r
+  HiiSetString(gHiiPackageListHandle, STRING_TOKEN(STR_BLOCKSID_STATUS1), NewString, NULL);\r
+  FreePool (NewString);\r
+\r
+  if ((PpStorageFlag & TCG_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID) != 0) {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_DISK_INFO_ENABLE_BLOCKSID_TRUE), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
+  } else {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_DISK_INFO_ENABLE_BLOCKSID_FALSE), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
+  }\r
+  HiiSetString(gHiiPackageListHandle, STRING_TOKEN(STR_BLOCKSID_STATUS2), NewString, NULL);\r
+  FreePool (NewString);\r
+\r
+  if ((PpStorageFlag & TCG_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID) != 0) {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_DISK_INFO_DISABLE_BLOCKSID_TRUE), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
+  } else {\r
+    NewString = HiiGetString (gHiiPackageListHandle, STRING_TOKEN(STR_DISK_INFO_DISABLE_BLOCKSID_FALSE), NULL);\r
+    if (NewString == NULL) {\r
+      DEBUG ((DEBUG_INFO,  "HiiSetCurrentConfiguration: HiiGetString( ) failed\n"));\r
+      return;\r
+    }\r
   }\r
+  HiiSetString(gHiiPackageListHandle, STRING_TOKEN(STR_BLOCKSID_STATUS3), NewString, NULL);\r
+  FreePool (NewString);\r
 }\r
 \r
 /**\r
@@ -400,6 +440,7 @@ DriverCallback(
 {\r
   HII_KEY    HiiKey;\r
   UINT8      HiiKeyId;\r
+  UINT32     PpRequest;\r
 \r
   if (ActionRequest != NULL) {\r
     *ActionRequest = EFI_BROWSER_ACTION_REQUEST_NONE;\r
@@ -469,9 +510,47 @@ DriverCallback(
         return EFI_SUCCESS;\r
 \r
       case HII_KEY_ID_BLOCKSID:\r
-        HiiSetBlockSid(Value->b);\r
+        switch (Value->u8) {\r
+          case 0:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;\r
+            break;\r
+\r
+          case 1:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_ENABLE_BLOCK_SID;\r
+            break;\r
+\r
+          case 2:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_DISABLE_BLOCK_SID;\r
+            break;\r
+\r
+          case 3:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_ENABLE_BLOCK_SID_FUNC_TRUE;\r
+            break;\r
+\r
+          case 4:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_ENABLE_BLOCK_SID_FUNC_FALSE;\r
+            break;\r
+\r
+          case 5:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_DISABLE_BLOCK_SID_FUNC_TRUE;\r
+            break;\r
+\r
+          case 6:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_SET_PP_REQUIRED_FOR_DISABLE_BLOCK_SID_FUNC_FALSE;\r
+            break;\r
+\r
+          default:\r
+            PpRequest = TCG2_PHYSICAL_PRESENCE_NO_ACTION;\r
+            DEBUG ((DEBUG_ERROR, "Invalid value input!\n"));\r
+            break;\r
+        }\r
+        HiiSetBlockSidAction(PpRequest);\r
+\r
         *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;\r
         return EFI_SUCCESS;\r
+\r
+      default:\r
+        break;\r
     }\r
   }\r
 \r
@@ -1090,25 +1169,27 @@ HiiPasswordEntered(
 \r
 **/\r
 EFI_STATUS\r
-HiiSetBlockSid (\r
-  BOOLEAN          Enable\r
+HiiSetBlockSidAction (\r
+  IN UINT32          PpRequest\r
   )\r
 {\r
-  EFI_STATUS                            Status;\r
-  OPAL_EXTRA_INFO_VAR                   OpalExtraInfo;\r
-  UINTN                                 DataSize;\r
-\r
-  Status = EFI_SUCCESS;\r
-\r
-  OpalExtraInfo.EnableBlockSid = Enable;\r
-  DataSize = sizeof (OPAL_EXTRA_INFO_VAR);\r
-  Status = gRT->SetVariable (\r
-                 OPAL_EXTRA_INFO_VAR_NAME,\r
-                 &gOpalExtraInfoVariableGuid,\r
-                 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_NON_VOLATILE,\r
-                 DataSize,\r
-                 &OpalExtraInfo\r
-                 );\r
+  UINT32                           ReturnCode;\r
+  EFI_STATUS                       Status;\r
+\r
+  //\r
+  // Process TCG Physical Presence request just after trusted console is ready\r
+  // Platform can connect trusted consoles and then call the below function.\r
+  //\r
+  ReturnCode = TcgPhysicalPresenceStorageLibSubmitRequestToPreOSFunction (PpRequest, 0);\r
+  if (ReturnCode == TCG_PP_SUBMIT_REQUEST_TO_PREOS_SUCCESS) {\r
+    Status = EFI_SUCCESS;\r
+  } else if (ReturnCode == TCG_PP_SUBMIT_REQUEST_TO_PREOS_GENERAL_FAILURE) {\r
+    Status = EFI_OUT_OF_RESOURCES;\r
+  } else if (ReturnCode == TCG_PP_SUBMIT_REQUEST_TO_PREOS_NOT_IMPLEMENTED) {\r
+    Status = EFI_UNSUPPORTED;\r
+  } else {\r
+    Status = EFI_DEVICE_ERROR;\r
+  }\r
 \r
   return Status;\r
 }\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormStrings.uni b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormStrings.uni
index 754dbf776b1d126de887628fd02b1dce819f3ffe..4cfbde3f847e5ecb8e8fe5aac1fe5e17f0ff4124 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormStrings.uni
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiFormStrings.uni
@@ -54,9 +54,21 @@
 #string STR_DISK_INFO_REVERT                     #language en-US "Admin Revert to factory default and Disable"\r
 #string STR_DISK_INFO_DISABLE_USER               #language en-US "Disable User"\r
 #string STR_DISK_INFO_ENABLE_FEATURE             #language en-US "Enable Feature"\r
-#string STR_DISK_INFO_ENABLE_BLOCKSID            #language en-US "Enable BlockSID"\r
-#string STR_ENABLED                              #language en-US "Enabled"\r
-#string STR_DISABLED                             #language en-US "Disabled"\r
+#string STR_DISK_INFO_ENABLE_BLOCKSID            #language en-US "TCG Storage Action"\r
+#string STR_ENABLED                              #language en-US "Enable BlockSID"\r
+#string STR_DISABLED                             #language en-US "Disable BlockSID"\r
+\r
+#string STR_NONE                                 #language en-US "None"\r
+#string STR_DISK_INFO_ENABLE_BLOCKSID_TRUE       #language en-US "Require physical presence when remote enable BlockSID"\r
+#string STR_DISK_INFO_ENABLE_BLOCKSID_FALSE      #language en-US "Not require physical presence when remote enable BlockSID"\r
+#string STR_DISK_INFO_DISABLE_BLOCKSID_TRUE      #language en-US "Require physical presence when remote disable BlockSID"\r
+#string STR_DISK_INFO_DISABLE_BLOCKSID_FALSE     #language en-US "Not require physical presence when remote disable BlockSID"\r
+\r
+#string STR_BLOCKSID_STATUS_HELP                 #language en-US "BlockSID action change status"\r
+#string STR_BLOCKSID_STATUS                      #language en-US "Current BlockSID Status:"\r
+#string STR_BLOCKSID_STATUS1                     #language en-US ""\r
+#string STR_BLOCKSID_STATUS2                     #language en-US ""\r
+#string STR_BLOCKSID_STATUS3                     #language en-US ""\r
 \r
 #string STR_DISK_INFO_GOTO_LOCK_HELP             #language en-US "Lock the disk"\r
 #string STR_DISK_INFO_GOTO_UNLOCK_HELP           #language en-US "Unlock the disk"\r
@@ -66,7 +78,7 @@
 #string STR_DISK_INFO_GOTO_PSID_REVERT_HELP      #language en-US "Revert the disk to factory defaults"\r
 #string STR_DISK_INFO_GOTO_DISABLE_USER_HELP     #language en-US "Disable User"\r
 #string STR_DISK_INFO_GOTO_ENABLE_FEATURE_HELP   #language en-US "Enable Feature"\r
-#string STR_DISK_INFO_GOTO_ENABLE_BLOCKSID_HELP  #language en-US "Enable to send BlockSID command"\r
+#string STR_DISK_INFO_GOTO_ENABLE_BLOCKSID_HELP  #language en-US "Change BlockSID actions, includes enable or disable BlockSID, Require or not require physical presence when remote enable or disable BlockSID"\r
 \r
 /////////////////////////////////   DISK ACTION MENU FORM   /////////////////////////////////\r
 #string STR_DISK_ACTION_LBL                     #language en-US " "\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiPrivate.h b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiPrivate.h
index bb086bd35f5e90c83a7c734b7fbf084a6e6cd093..a7709dd63dba415301fe81c198fbbf72ca733ceb 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiPrivate.h
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalHiiPrivate.h
@@ -211,15 +211,15 @@ HiiPasswordEntered(
 /**\r
   Update block sid info.\r
 \r
-  @param      Enable         Enable/disable BlockSid.\r
+  @param      PpRequest      Input the Pp Request.\r
 \r
   @retval  EFI_SUCCESS       Do the required action success.\r
   @retval  Others            Other error occur.\r
 \r
 **/\r
 EFI_STATUS\r
-HiiSetBlockSid (\r
-  BOOLEAN          Enable\r
+HiiSetBlockSidAction (\r
+  UINT32          PpRequest\r
   );\r
 \r
 /**\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordDxe.inf
index 703c1b6039ad2cbb0af1ade322f3e280cc98b00d..91c4bfc6965d0d7d378e986c0a39b08e79573c07 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordDxe.inf
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordDxe.inf
@@ -62,6 +62,7 @@
   OpalPasswordSupportLib\r
   UefiLib\r
   TcgStorageOpalLib\r
+  TcgPhysicalPresenceStorageLib\r
 \r
 [Protocols]\r
   gEfiHiiConfigAccessProtocolGuid               ## PRODUCES\r

diff --git a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordForm.vfr b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordForm.vfr
index 88cc2a1c4e989826ed0a1cabd35618cf7393d144..218e0f442ce6ed950f53f753f8b4bc4a0a88f12a 100644 (file)
--- a/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordForm.vfr
+++ b/SecurityPkg/Tcg/Opal/OpalPasswordDxe/OpalPasswordForm.vfr
@@ -118,15 +118,38 @@ form formid = FORMID_VALUE_MAIN_MENU,
 \r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
+    grayoutif TRUE;\r
+      text\r
+          help    = STRING_TOKEN(STR_BLOCKSID_STATUS_HELP),\r
+          text    = STRING_TOKEN(STR_BLOCKSID_STATUS);\r
+      text\r
+          help    = STRING_TOKEN(STR_BLOCKSID_STATUS_HELP),\r
+          text    = STRING_TOKEN(STR_BLOCKSID_STATUS1);\r
+      text\r
+          help    = STRING_TOKEN(STR_BLOCKSID_STATUS_HELP),\r
+          text    = STRING_TOKEN(STR_BLOCKSID_STATUS2);\r
+      text\r
+          help    = STRING_TOKEN(STR_BLOCKSID_STATUS_HELP),\r
+          text    = STRING_TOKEN(STR_BLOCKSID_STATUS3);\r
+      subtitle text = STRING_TOKEN(STR_NULL);\r
+    endif;\r
+\r
     oneof varid   = OpalHiiConfig.EnableBlockSid,\r
       questionid  = 0x8017, // 32791,\r
       prompt      = STRING_TOKEN(STR_DISK_INFO_ENABLE_BLOCKSID),\r
       help        = STRING_TOKEN(STR_DISK_INFO_GOTO_ENABLE_BLOCKSID_HELP),\r
       flags       = INTERACTIVE,\r
-      option text = STRING_TOKEN(STR_DISABLED), value = 0, flags = DEFAULT | MANUFACTURING | RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_NONE), value = 0, flags = DEFAULT | MANUFACTURING | RESET_REQUIRED;\r
       option text = STRING_TOKEN(STR_ENABLED), value = 1, flags = RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_DISABLED), value = 2, flags = RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_DISK_INFO_ENABLE_BLOCKSID_TRUE), value = 3, flags = RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_DISK_INFO_ENABLE_BLOCKSID_FALSE), value = 4, flags = RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_DISK_INFO_DISABLE_BLOCKSID_TRUE), value = 5, flags = RESET_REQUIRED;\r
+      option text = STRING_TOKEN(STR_DISK_INFO_DISABLE_BLOCKSID_FALSE), value = 6, flags = RESET_REQUIRED;\r
     endoneof;\r
 \r
+\r
+\r
 endform;  // MAIN MENU FORM\r
 \r
 //\r