* [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
@ 2019-01-23 6:42 Maggie Chu
0 siblings, 0 replies; 4+ messages in thread
From: Maggie Chu @ 2019-01-23 6:42 UTC (permalink / raw)
To: edk2-devel; +Cc: Chao Zhang, Jiewen Yao, Eric Dong
https://bugzilla.tianocore.org/show_bug.cgi?id=1484
Add a PCD for skipping password prompt and device unlock flow
so that other pre-OS applications are able to take over Opal devices unlock flow.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
---
SecurityPkg/SecurityPkg.dec | 6 ++++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 4 ++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++
3 files changed, 13 insertions(+)
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 2708e7953c..05ab71ced0 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -428,6 +428,12 @@
# @Prompt Possible TPM2 Interrupt Number buffer
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D
+ ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>
+ # TRUE - Skip unlock device flow.<BR>
+ # FALSE - Does not skip unlock device flow.<BR>
+ # @Prompt Skip Opal DXE driver unlock device flow.
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x0001001E
+
[PcdsDynamic, PcdsDynamicEx]
## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 38268539fb..4969225b2a 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -969,6 +969,10 @@ OpalDriverRequestPassword (
TCG_RESULT Ret;
CHAR16 *PopUpString;
+ if (PcdGetBool (PcdSkipOpalDxeUnlock)) {
+ return;
+ }
+
if (Dev == NULL) {
return;
}
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
index cfa55dded7..11e58b95cd 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
@@ -75,5 +75,8 @@
[Guids]
gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event
+[Pcd]
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES
+
[Depex]
gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
@ 2019-01-28 7:37 Maggie Chu
0 siblings, 0 replies; 4+ messages in thread
From: Maggie Chu @ 2019-01-28 7:37 UTC (permalink / raw)
To: edk2-devel; +Cc: Chao Zhang, Jiewen Yao, Eric Dong
https://bugzilla.tianocore.org/show_bug.cgi?id=1484
Add a PCD for skipping password prompt and device unlock flow
so that other pre-OS applications are able to take over Opal devices unlock flow.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
---
SecurityPkg/SecurityPkg.dec | 6 ++++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 4 ++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++
3 files changed, 13 insertions(+)
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 2708e7953c..05ab71ced0 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -428,6 +428,12 @@
# @Prompt Possible TPM2 Interrupt Number buffer
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D
+ ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>
+ # TRUE - Skip unlock device flow.<BR>
+ # FALSE - Does not skip unlock device flow.<BR>
+ # @Prompt Skip Opal DXE driver unlock device flow.
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x0001001E
+
[PcdsDynamic, PcdsDynamicEx]
## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 38268539fb..734c5f06ff 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -988,6 +988,10 @@ OpalDriverRequestPassword (
IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature);
+ if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) {
+ return;
+ }
+
while (Count < MAX_PASSWORD_TRY_COUNT) {
Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc);
if (PressEsc) {
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
index cfa55dded7..11e58b95cd 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
@@ -75,5 +75,8 @@
[Guids]
gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event
+[Pcd]
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES
+
[Depex]
gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
@ 2019-01-30 6:40 Maggie Chu
2019-01-31 2:51 ` Dong, Eric
0 siblings, 1 reply; 4+ messages in thread
From: Maggie Chu @ 2019-01-30 6:40 UTC (permalink / raw)
To: edk2-devel; +Cc: Chao Zhang, Jiewen Yao, Eric Dong
https://bugzilla.tianocore.org/show_bug.cgi?id=1484
Add a PCD for skipping password prompt and device unlock flow
so that other pre-OS applications are able to take over Opal devices unlock flow.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
---
SecurityPkg/SecurityPkg.dec | 6 ++++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 4 ++++
SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++
3 files changed, 13 insertions(+)
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 2708e7953c..70c9ff28a8 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -428,6 +428,12 @@
# @Prompt Possible TPM2 Interrupt Number buffer
gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D
+ ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>
+ # TRUE - Skip unlock device flow.<BR>
+ # FALSE - Does not skip unlock device flow.<BR>
+ # @Prompt Skip Opal DXE driver unlock device flow.
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020
+
[PcdsDynamic, PcdsDynamicEx]
## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
index 38268539fb..734c5f06ff 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
@@ -988,6 +988,10 @@ OpalDriverRequestPassword (
IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature);
+ if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) {
+ return;
+ }
+
while (Count < MAX_PASSWORD_TRY_COUNT) {
Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc);
if (PressEsc) {
diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
index cfa55dded7..11e58b95cd 100644
--- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
+++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
@@ -75,5 +75,8 @@
[Guids]
gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event
+[Pcd]
+ gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES
+
[Depex]
gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid
--
2.16.2.windows.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
2019-01-30 6:40 [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt Maggie Chu
@ 2019-01-31 2:51 ` Dong, Eric
0 siblings, 0 replies; 4+ messages in thread
From: Dong, Eric @ 2019-01-31 2:51 UTC (permalink / raw)
To: Chu, Maggie, edk2-devel@lists.01.org; +Cc: Zhang, Chao B, Yao, Jiewen
Hi Maggie,
Thanks for your contribution!
Reviewed-by: Eric Dong <eric.dong@intel.com>
And pushed: 8a9301cdd75439e781754014f514fa06d99140d1
Thanks,
Eric
> -----Original Message-----
> From: Chu, Maggie
> Sent: Wednesday, January 30, 2019 2:41 PM
> To: edk2-devel@lists.01.org
> Cc: Zhang, Chao B <chao.b.zhang@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Dong, Eric <eric.dong@intel.com>
> Subject: [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt
>
> https://bugzilla.tianocore.org/show_bug.cgi?id=1484
> Add a PCD for skipping password prompt and device unlock flow so that
> other pre-OS applications are able to take over Opal devices unlock flow.
>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Maggie Chu <maggie.chu@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> ---
> SecurityPkg/SecurityPkg.dec | 6 ++++++
> SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 4 ++++
> SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 3 +++
> 3 files changed, 13 insertions(+)
>
> diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index
> 2708e7953c..70c9ff28a8 100644
> --- a/SecurityPkg/SecurityPkg.dec
> +++ b/SecurityPkg/SecurityPkg.dec
> @@ -428,6 +428,12 @@
> # @Prompt Possible TPM2 Interrupt Number buffer
> gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00,
> 0x00, 0x00}|VOID*|0x0001001D
>
> + ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>
> + # TRUE - Skip unlock device flow.<BR>
> + # FALSE - Does not skip unlock device flow.<BR>
> + # @Prompt Skip Opal DXE driver unlock device flow.
> +
> +
> gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0
> x000
> + 10020
> +
> [PcdsDynamic, PcdsDynamicEx]
>
> ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows
> TCG Algorithm Registry.<BR><BR> diff --git
> a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
> b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
> index 38268539fb..734c5f06ff 100644
> --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
> +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c
> @@ -988,6 +988,10 @@ OpalDriverRequestPassword (
>
> IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes,
> &Dev->OpalDisk.LockingFeature);
>
> + if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) {
> + return;
> + }
> +
> while (Count < MAX_PASSWORD_TRY_COUNT) {
> Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL,
> &PressEsc);
> if (PressEsc) {
> diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
> b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
> index cfa55dded7..11e58b95cd 100644
> --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
> +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf
> @@ -75,5 +75,8 @@
> [Guids]
> gEfiEndOfDxeEventGroupGuid ## CONSUMES ## Event
>
> +[Pcd]
> + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES
> +
> [Depex]
> gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid
> --
> 2.16.2.windows.1
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-01-31 2:51 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-30 6:40 [PATCH] SecurityPkg: Add a PCD to skip Opal password prompt Maggie Chu
2019-01-31 2:51 ` Dong, Eric
-- strict thread matches above, loose matches on Subject: below --
2019-01-28 7:37 Maggie Chu
2019-01-23 6:42 Maggie Chu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox