OpalPasswordPei.c

Go to the documentation of this file.

 
#include "OpalPasswordPei.h"
 
EFI_GUID  mOpalDeviceLockBoxGuid = OPAL_DEVICE_LOCKBOX_GUID;
 
EFI_STATUS
EFIAPI
SecurityReceiveData (
  IN  EFI_STORAGE_SECURITY_COMMAND_PROTOCOL  *This,
  IN  UINT32                                 MediaId,
  IN  UINT64                                 Timeout,
  IN  UINT8                                  SecurityProtocolId,
  IN  UINT16                                 SecurityProtocolSpecificData,
  IN  UINTN                                  PayloadBufferSize,
  OUT VOID                                   *PayloadBuffer,
  OUT UINTN                                  *PayloadTransferSize
  )
{
  OPAL_PEI_DEVICE  *PeiDev;
 
  PeiDev = OPAL_PEI_DEVICE_FROM_THIS (This);
  if (PeiDev == NULL) {
    return EFI_DEVICE_ERROR;
  }
 
  return PeiDev->SscPpi->ReceiveData (
                           PeiDev->SscPpi,
                           PeiDev->DeviceIndex,
                           SSC_PPI_GENERIC_TIMEOUT,
                           SecurityProtocolId,
                           SecurityProtocolSpecificData,
                           PayloadBufferSize,
                           PayloadBuffer,
                           PayloadTransferSize
                           );
}
 
EFI_STATUS
EFIAPI
SecuritySendData (
  IN EFI_STORAGE_SECURITY_COMMAND_PROTOCOL  *This,
  IN UINT32                                 MediaId,
  IN UINT64                                 Timeout,
  IN UINT8                                  SecurityProtocolId,
  IN UINT16                                 SecurityProtocolSpecificData,
  IN UINTN                                  PayloadBufferSize,
  IN VOID                                   *PayloadBuffer
  )
{
  OPAL_PEI_DEVICE  *PeiDev;
 
  PeiDev = OPAL_PEI_DEVICE_FROM_THIS (This);
  if (PeiDev == NULL) {
    return EFI_DEVICE_ERROR;
  }
 
  return PeiDev->SscPpi->SendData (
                           PeiDev->SscPpi,
                           PeiDev->DeviceIndex,
                           SSC_PPI_GENERIC_TIMEOUT,
                           SecurityProtocolId,
                           SecurityProtocolSpecificData,
                           PayloadBufferSize,
                           PayloadBuffer
                           );
}
 
BOOLEAN
IsOpalDeviceLocked (
  OPAL_PEI_DEVICE  *OpalDev,
  BOOLEAN          *BlockSidSupported
  )
{
  OPAL_SESSION                    Session;
  OPAL_DISK_SUPPORT_ATTRIBUTE     SupportedAttributes;
  TCG_LOCKING_FEATURE_DESCRIPTOR  LockingFeature;
  UINT16                          OpalBaseComId;
  TCG_RESULT                      Ret;
 
  Session.Sscp    = &OpalDev->Sscp;
  Session.MediaId = 0;
 
  Ret = OpalGetSupportedAttributesInfo (&Session, &SupportedAttributes, &OpalBaseComId);
  if (Ret != TcgResultSuccess) {
    return FALSE;
  }
 
  Session.OpalBaseComId = OpalBaseComId;
  *BlockSidSupported    = SupportedAttributes.BlockSid == 1 ? TRUE : FALSE;
 
  Ret = OpalGetLockingInfo (&Session, &LockingFeature);
  if (Ret != TcgResultSuccess) {
    return FALSE;
  }
 
  return OpalDeviceLocked (&SupportedAttributes, &LockingFeature);
}
 
VOID
UnlockOpalPassword (
  IN OPAL_PEI_DEVICE  *OpalDev
  )
{
  TCG_RESULT    Result;
  OPAL_SESSION  Session;
  BOOLEAN       BlockSidSupport;
  UINT32        PpStorageFlags;
  BOOLEAN       BlockSIDEnabled;
 
  BlockSidSupport = FALSE;
  if (IsOpalDeviceLocked (OpalDev, &BlockSidSupport)) {
    ZeroMem (&Session, sizeof (Session));
    Session.Sscp          = &OpalDev->Sscp;
    Session.MediaId       = 0;
    Session.OpalBaseComId = OpalDev->Device->OpalBaseComId;
 
    Result = OpalUtilUpdateGlobalLockingRange (
               &Session,
               OpalDev->Device->Password,
               OpalDev->Device->PasswordLength,
               FALSE,
               FALSE
               );
    DEBUG ((
      DEBUG_INFO,
      "%a() OpalUtilUpdateGlobalLockingRange() Result = 0x%x\n",
      __func__,
      Result
      ));
  }
 
  PpStorageFlags = Tcg2PhysicalPresenceLibGetManagementFlags ();
  if ((PpStorageFlags & TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID) != 0) {
    BlockSIDEnabled = TRUE;
  } else {
    BlockSIDEnabled = FALSE;
  }
 
  if (BlockSIDEnabled && BlockSidSupport) {
    DEBUG ((DEBUG_INFO, "OpalPassword: S3 phase send BlockSid command to device!\n"));
    ZeroMem (&Session, sizeof (Session));
    Session.Sscp          = &OpalDev->Sscp;
    Session.MediaId       = 0;
    Session.OpalBaseComId = OpalDev->Device->OpalBaseComId;
    Result                = OpalBlockSid (&Session, TRUE);
    DEBUG ((
      DEBUG_INFO,
      "%a() OpalBlockSid() Result = 0x%x\n",
      __func__,
      Result
      ));
  }
}
 
VOID
UnlockOpalPasswordDevices (
  IN EDKII_PEI_STORAGE_SECURITY_CMD_PPI  *SscPpi
  )
{
  EFI_STATUS                Status;
  UINT8                     *DevInfoBuffer;
  UINT8                     DummyData;
  OPAL_DEVICE_LOCKBOX_DATA  *DevInfo;
  UINTN                     DevInfoLength;
  EFI_DEVICE_PATH_PROTOCOL  *SscDevicePath;
  UINTN                     SscDevicePathLength;
  UINTN                     SscDeviceNum;
  UINTN                     SscDeviceIndex;
  OPAL_PEI_DEVICE           OpalDev;
 
  //
  // Get OPAL devices info from LockBox.
  //
  DevInfoBuffer = &DummyData;
  DevInfoLength = sizeof (DummyData);
  Status        = RestoreLockBox (&mOpalDeviceLockBoxGuid, DevInfoBuffer, &DevInfoLength);
  if (Status == EFI_BUFFER_TOO_SMALL) {
    DevInfoBuffer = AllocatePages (EFI_SIZE_TO_PAGES (DevInfoLength));
    if (DevInfoBuffer != NULL) {
      Status = RestoreLockBox (&mOpalDeviceLockBoxGuid, DevInfoBuffer, &DevInfoLength);
    }
  }
 
  if ((DevInfoBuffer == NULL) || (DevInfoBuffer == &DummyData)) {
    return;
  } else if (EFI_ERROR (Status)) {
    FreePages (DevInfoBuffer, EFI_SIZE_TO_PAGES (DevInfoLength));
    return;
  }
 
  //
  // Go through all the devices managed by the SSC PPI instance.
  //
  Status = SscPpi->GetNumberofDevices (SscPpi, &SscDeviceNum);
  if (EFI_ERROR (Status)) {
    goto Exit;
  }
 
  for (SscDeviceIndex = 1; SscDeviceIndex <= SscDeviceNum; SscDeviceIndex++) {
    Status = SscPpi->GetDevicePath (
                       SscPpi,
                       SscDeviceIndex,
                       &SscDevicePathLength,
                       &SscDevicePath
                       );
    if (SscDevicePathLength <= sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
      //
      // Device path validity check.
      //
      continue;
    }
 
    //
    // Search the device in the restored LockBox.
    //
    for (DevInfo = (OPAL_DEVICE_LOCKBOX_DATA *)DevInfoBuffer;
         (UINTN)DevInfo < ((UINTN)DevInfoBuffer + DevInfoLength);
         DevInfo = (OPAL_DEVICE_LOCKBOX_DATA *)((UINTN)DevInfo + DevInfo->Length))
    {
      //
      // Find the matching device.
      //
      if ((DevInfo->DevicePathLength >= SscDevicePathLength) &&
          (CompareMem (
             DevInfo->DevicePath,
             SscDevicePath,
             SscDevicePathLength - sizeof (EFI_DEVICE_PATH_PROTOCOL)
             ) == 0))
      {
        OpalDev.Signature        = OPAL_PEI_DEVICE_SIGNATURE;
        OpalDev.Sscp.ReceiveData = SecurityReceiveData;
        OpalDev.Sscp.SendData    = SecuritySendData;
        OpalDev.Device           = DevInfo;
        OpalDev.Context          = NULL;
        OpalDev.SscPpi           = SscPpi;
        OpalDev.DeviceIndex      = SscDeviceIndex;
        UnlockOpalPassword (&OpalDev);
        break;
      }
    }
  }
 
Exit:
  ZeroMem (DevInfoBuffer, DevInfoLength);
  FreePages (DevInfoBuffer, EFI_SIZE_TO_PAGES (DevInfoLength));
}
 
EFI_STATUS
EFIAPI
OpalPasswordStorageSecurityPpiNotify (
  IN EFI_PEI_SERVICES           **PeiServices,
  IN EFI_PEI_NOTIFY_DESCRIPTOR  *NotifyDesc,
  IN VOID                       *Ppi
  )
{
  DEBUG ((DEBUG_INFO, "%a entered at S3 resume!\n", __func__));
 
  UnlockOpalPasswordDevices ((EDKII_PEI_STORAGE_SECURITY_CMD_PPI *)Ppi);
 
  DEBUG ((DEBUG_INFO, "%a exit at S3 resume!\n", __func__));
 
  return EFI_SUCCESS;
}
 
EFI_PEI_NOTIFY_DESCRIPTOR  mOpalPasswordStorageSecurityPpiNotifyDesc = {
  (EFI_PEI_PPI_DESCRIPTOR_NOTIFY_CALLBACK | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST),
  &gEdkiiPeiStorageSecurityCommandPpiGuid,
  OpalPasswordStorageSecurityPpiNotify
};
 
EFI_STATUS
EFIAPI
OpalPasswordPeiInit (
  IN EFI_PEI_FILE_HANDLE     FileHandle,
  IN CONST EFI_PEI_SERVICES  **PeiServices
  )
{
  EFI_STATUS     Status;
  EFI_BOOT_MODE  BootMode;
 
  Status = PeiServicesGetBootMode (&BootMode);
  if ((EFI_ERROR (Status)) || (BootMode != BOOT_ON_S3_RESUME)) {
    return EFI_UNSUPPORTED;
  }
 
  DEBUG ((DEBUG_INFO, "%a: Enters in S3 path.\n", __func__));
 
  Status = PeiServicesNotifyPpi (&mOpalPasswordStorageSecurityPpiNotifyDesc);
  ASSERT_EFI_ERROR (Status);
  return Status;
}