From nobody Wed Nov 27 04:51:44 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+41194+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+41194+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1558508699; cv=none; d=zoho.com; s=zohoarc; b=niyj8JyWx7Fr5hgfxJtePdzmojum68C/MWCL5FhZ3ba7RFSn6RT7eGxOuxlLZ37OMgPexQIqBH4Ez1erNAwjNrpfPdLPLc9mpTT/c4U15axija4n4+gtcJ7GWHEMYra17+kMUmWSO3Wz6+wDMYxPWv/+iKucpx9Bga3lsD4h45w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1558508699; h=Cc:Date:From:List-Id:List-Unsubscribe:Message-ID:Reply-To:Sender:Subject:To:ARC-Authentication-Results; bh=omZdZcp2pjJt2AQ6+rDKj/aC3BmXxidcfh5zNbnQVFw=; b=Tb9WQdQ3S8fw4sJvapRWtuNiZRlLyV4pyg141cK4SpaHTEztiyWht9XT59qb3SqTXFKlvgsYKvQC+/Y99j/1bKHGajkmRao7Uu5QEmpsD160Gzpi9gVCuXy/w6luQR3AByj7wCssrpcssQQVHP/ll9feiEdRJBU6Nz+hYtKic3E= ARC-Authentication-Results: i=1; mx.zoho.com; dkim=pass; spf=pass (zoho.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+41194+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1558508699693317.916794473462; Wed, 22 May 2019 00:04:59 -0700 (PDT) Return-Path: X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by groups.io with SMTP; Wed, 22 May 2019 00:04:58 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 May 2019 00:04:57 -0700 X-ExtLoop1: 1 X-Received: from chumaggi-mobl.gar.corp.intel.com ([10.5.244.127]) by fmsmga005.fm.intel.com with ESMTP; 22 May 2019 00:04:56 -0700 From: "Maggie Chu" To: devel@edk2.groups.io Cc: Eric Dong , Chao Zhang , Jiewen Yao Subject: [edk2-devel] [PATCH] SecurityPkg/OpalPassword: Add PCD to skip password prompt Date: Wed, 22 May 2019 15:04:43 +0800 Message-Id: <20190522070443.21064-1-maggie.chu@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,maggie.chu@intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1558508699; bh=6ooH2FQs+id7xcpIfE61vn6+wA/OEepIYYyDERvhu/o=; h=Cc:Date:From:Reply-To:Subject:To; b=DFUv3ZgHL5mJBWkIlDrd+gAbbbdsi47G9zWX9LKSYa1ArNSUMTxdMfFwd22+VHFD3aF AhaT8xi58PSbtNwqKSHM2ntTj6nGFMLFUQMT8FqCwlL4zhEbeuwc/tzvAEdTPbQFNPWu4 f82gdA8tTWuliMQPsDE0wvA+7tlJVUr+Jqg= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" https://bugzilla.tianocore.org/show_bug.cgi?id=3D1801 Add a PCD for skipping password prompt in device unlocked status. Previous change only support if storage device is in locked status. This change is added to support the case that security status of the storage device is unlocked. Signed-off-by: Maggie Chu Cc: Eric Dong Cc: Chao Zhang Cc: Jiewen Yao Reviewed-by: Eric Dong --- SecurityPkg/SecurityPkg.dec | 10 +++++----- SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c | 16 ++++++++++++++-- SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf | 2 +- 3 files changed, 20 insertions(+), 8 deletions(-) diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 3314f1854b..96db80c2d2 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -422,11 +422,11 @@ # @Prompt Possible TPM2 Interrupt Number buffer gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00= , 0x00}|VOID*|0x0001001D =20 - ## Indicates if Opal DXE driver skip unlock device flow.

- # TRUE - Skip unlock device flow.
- # FALSE - Does not skip unlock device flow.
- # @Prompt Skip Opal DXE driver unlock device flow. - gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010= 020 + ## Indicates if Opal DXE driver skip password prompt.

+ # TRUE - Skip password prompt.
+ # FALSE - Does not skip password prompt.
+ # @Prompt Skip Opal DXE driver password prompt. + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalPasswordPrompt|FALSE|BOOLEAN|0x= 00010020 =20 [PcdsDynamic, PcdsDynamicEx] =20 diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c b/SecurityPkg/T= cg/Opal/OpalPassword/OpalDriver.c index 965205c0b2..e14fa32354 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c @@ -899,8 +899,20 @@ OpalDriverRequestPassword ( =20 IsLocked =3D OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &De= v->OpalDisk.LockingFeature); =20 - if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) { - return; + // + // Add PcdSkipOpalPasswordPrompt to determin whether to skip password = prompt. + // Due to board design, device may not power off during system warm bo= ot, which result in + // security status remain unlocked status, hence we add device securit= y status check here. + // + // If device is in the locked status, device keeps locked and system c= ontinues booting. + // If device is in the unlocked status, system is forced shutdown to s= upport security requirement. + // + if (PcdGetBool (PcdSkipOpalPasswordPrompt)) { + if (IsLocked) { + return; + } else { + gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL); + } } =20 while (Count < MAX_PASSWORD_TRY_COUNT) { diff --git a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf b/Securi= tyPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf index e74f147aaa..87519198c0 100644 --- a/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf +++ b/SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf @@ -71,7 +71,7 @@ gS3StorageDeviceInitListGuid ## SOMETIMES_PRODUCES ## U= NDEFINED =20 [Pcd] - gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock ## CONSUMES + gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalPasswordPrompt ## CONSUMES =20 [Depex] gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid --=20 2.16.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#41194): https://edk2.groups.io/g/devel/message/41194 Mute This Topic: https://groups.io/mt/31717459/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-