From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.151; helo=mga17.intel.com; envelope-from=maggie.chu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id EB25A2194D3B8 for ; Tue, 29 Jan 2019 22:41:01 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 29 Jan 2019 22:41:01 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,540,1539673200"; d="scan'208";a="120582700" Received: from chumaggi-mobl.gar.corp.intel.com ([10.5.245.233]) by fmsmga008.fm.intel.com with ESMTP; 29 Jan 2019 22:41:00 -0800 From: Maggie Chu To: edk2-devel@lists.01.org Cc: Chao Zhang , Jiewen Yao , Eric Dong Date: Wed, 30 Jan 2019 14:40:51 +0800 Message-Id: <20190130064051.7704-1-maggie.chu@intel.com> X-Mailer: git-send-email 2.14.2.windows.3 Subject: [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jan 2019 06:41:02 -0000 https://bugzilla.tianocore.org/show_bug.cgi?id=1484 Add a PCD for skipping password prompt and device unlock flow so that other pre-OS applications are able to take over Opal devices unlock flow. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Maggie Chu Cc: Chao Zhang Cc: Jiewen Yao Cc: Eric Dong --- SecurityPkg/SecurityPkg.dec | 6 ++++++ SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 4 ++++ SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++ 3 files changed, 13 insertions(+) diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 2708e7953c..70c9ff28a8 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -428,6 +428,12 @@ # @Prompt Possible TPM2 Interrupt Number buffer gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D + ## Indicates if Opal DXE driver skip unlock device flow.

+ # TRUE - Skip unlock device flow.
+ # FALSE - Does not skip unlock device flow.
+ # @Prompt Skip Opal DXE driver unlock device flow. + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020 + [PcdsDynamic, PcdsDynamicEx] ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.

diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c index 38268539fb..734c5f06ff 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c @@ -988,6 +988,10 @@ OpalDriverRequestPassword ( IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature); + if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) { + return; + } + while (Count < MAX_PASSWORD_TRY_COUNT) { Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc); if (PressEsc) { diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf index cfa55dded7..11e58b95cd 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf @@ -75,5 +75,8 @@ [Guids] gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event +[Pcd] + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES + [Depex] gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid -- 2.16.2.windows.1