SecurityPkg/HddPassword: Add a PCD to skip Hdd password prompt

https://bugzilla.tianocore.org/show_bug.cgi?id=1876
Add a PCD for skipping Hdd password prompt.
If device is in the locked status while attempting to skip
password prompt, device will keep locked and system
continue to boot.
If device is in the unlocked status while attempting to skip
password prompt, system will be forced shutdown.

Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>

diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.c b/SecurityPkg/HddPassword/HddPasswordDxe.c
index 253af9f78fa4145c3af7d0c4cbad1c7e379e953a..b0d795b6597fa0df2ad91d90375de1ddde2bde65 100644 (file)
--- a/SecurityPkg/HddPassword/HddPasswordDxe.c
+++ b/SecurityPkg/HddPassword/HddPasswordDxe.c
@@ -1345,6 +1345,22 @@ HddPasswordRequestPassword (
   //\r
   if ((ConfigFormEntry->IfrData.SecurityStatus.Supported) &&\r
       (ConfigFormEntry->IfrData.SecurityStatus.Enabled)) {\r
+\r
+     //\r
+     // Add PcdSkipHddPasswordPrompt to determin whether to skip password prompt.\r
+     // Due to board design, device may not power off during system warm boot, which result in\r
+     // security status remain unlocked status, hence we add device security status check here.\r
+     //\r
+     // If device is in the locked status, device keeps locked and system continues booting.\r
+     // If device is in the unlocked status, system is forced shutdown for security concern.\r
+     //\r
+     if (PcdGetBool (PcdSkipHddPasswordPrompt)) {\r
+       if (ConfigFormEntry->IfrData.SecurityStatus.Locked) {\r
+         return;\r
+       } else {\r
+         gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);\r
+       }\r
+    }\r
     //\r
     // As soon as the HDD password is in enabled state, we pop up a window to unlock hdd\r
     // no matter it's really in locked or unlocked state.\r

diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.inf b/SecurityPkg/HddPassword/HddPasswordDxe.inf
index f7550079ed29a2cec7abf840b3050007cdc0e612..06e8755ffcc6601d134c91fcd10ba0e2442fd9e4 100644 (file)
--- a/SecurityPkg/HddPassword/HddPasswordDxe.inf
+++ b/SecurityPkg/HddPassword/HddPasswordDxe.inf
@@ -34,6 +34,7 @@
   MdePkg/MdePkg.dec\r
   MdeModulePkg/MdeModulePkg.dec\r
   CryptoPkg/CryptoPkg.dec\r
+  SecurityPkg/SecurityPkg.dec\r
 \r
 [LibraryClasses]\r
   BaseLib\r
@@ -64,6 +65,9 @@
   gEfiPciIoProtocolGuid                         ## CONSUMES\r
   gEdkiiVariableLockProtocolGuid                ## CONSUMES\r
 \r
+[Pcd]\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt  ## CONSUMES\r
+\r
 [Depex]\r
   gEfiVariableWriteArchProtocolGuid\r
 \r

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 96db80c2d2fa95d06a66fafc9dcc4b54fef77b31..1d43a69bc690a909d52fa7b36fca62c2931de7a3 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -428,6 +428,12 @@
   # @Prompt Skip Opal DXE driver password prompt.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalPasswordPrompt|FALSE|BOOLEAN|0x00010020\r
 \r
+  ## Indicates if Hdd Password driver skip password prompt.<BR><BR>\r
+  #   TRUE  - Skip password prompt.<BR>\r
+  #   FALSE - Does not skip password prompt.<BR>\r
+  # @Prompt Skip Hdd Password prompt.\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt|FALSE|BOOLEAN|0x00010021\r
+\r
 [PcdsDynamic, PcdsDynamicEx]\r
 \r
   ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>\r