1. Patchew
  2. EDK2
  3. View series

[edk2-devel] [PATCH] SecurityPkg/HddPassword: Add a PCD to skip Hdd password prompt

Maggie Chu posted 1 patch 4 years, 10 months ago
Failed in applying to current master (apply log)
SecurityPkg/HddPassword/HddPasswordDxe.c   | 16 ++++++++++++++++
SecurityPkg/HddPassword/HddPasswordDxe.inf |  4 ++++
SecurityPkg/SecurityPkg.dec                |  6 ++++++
3 files changed, 26 insertions(+)
[edk2-devel] [PATCH] SecurityPkg/HddPassword: Add a PCD to skip Hdd password prompt
Posted by Maggie Chu 4 years, 10 months ago 
https://bugzilla.tianocore.org/show_bug.cgi?id=1876
Add a PCD for skipping Hdd password prompt.
If device is in the locked status while attempting to skip
password prompt, device will keep locked and system
continue to boot.
If device is in the unlocked status while attempting to skip
password prompt, system will be forced shutdown.

Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
---
 SecurityPkg/HddPassword/HddPasswordDxe.c   | 16 ++++++++++++++++
 SecurityPkg/HddPassword/HddPasswordDxe.inf |  4 ++++
 SecurityPkg/SecurityPkg.dec                |  6 ++++++
 3 files changed, 26 insertions(+)

diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.c b/SecurityPkg/HddPassword/HddPasswordDxe.c
index 253af9f78f..b0d795b659 100644
--- a/SecurityPkg/HddPassword/HddPasswordDxe.c
+++ b/SecurityPkg/HddPassword/HddPasswordDxe.c
@@ -1345,6 +1345,22 @@ HddPasswordRequestPassword (
   //
   if ((ConfigFormEntry->IfrData.SecurityStatus.Supported) &&
       (ConfigFormEntry->IfrData.SecurityStatus.Enabled)) {
+
+     //
+     // Add PcdSkipHddPasswordPrompt to determin whether to skip password prompt.
+     // Due to board design, device may not power off during system warm boot, which result in
+     // security status remain unlocked status, hence we add device security status check here.
+     //
+     // If device is in the locked status, device keeps locked and system continues booting.
+     // If device is in the unlocked status, system is forced shutdown for security concern.
+     //
+     if (PcdGetBool (PcdSkipHddPasswordPrompt)) {
+       if (ConfigFormEntry->IfrData.SecurityStatus.Locked) {
+         return;
+       } else {
+         gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);
+       }
+    }
     //
     // As soon as the HDD password is in enabled state, we pop up a window to unlock hdd
     // no matter it's really in locked or unlocked state.
diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.inf b/SecurityPkg/HddPassword/HddPasswordDxe.inf
index f7550079ed..06e8755ffc 100644
--- a/SecurityPkg/HddPassword/HddPasswordDxe.inf
+++ b/SecurityPkg/HddPassword/HddPasswordDxe.inf
@@ -34,6 +34,7 @@
   MdePkg/MdePkg.dec
   MdeModulePkg/MdeModulePkg.dec
   CryptoPkg/CryptoPkg.dec
+  SecurityPkg/SecurityPkg.dec
 
 [LibraryClasses]
   BaseLib
@@ -64,6 +65,9 @@
   gEfiPciIoProtocolGuid                         ## CONSUMES
   gEdkiiVariableLockProtocolGuid                ## CONSUMES
 
+[Pcd]
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt  ## CONSUMES
+
 [Depex]
   gEfiVariableWriteArchProtocolGuid
 
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 3314f1854b..82929fe38e 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -428,6 +428,12 @@
   # @Prompt Skip Opal DXE driver unlock device flow.
   gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020
 
+  ## Indicates if Hdd Password driver skip password prompt.<BR><BR>
+  #   TRUE  - Skip password prompt.<BR>
+  #   FALSE - Does not skip password prompt.<BR>
+  # @Prompt Skip Hdd Password prompt.
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt|FALSE|BOOLEAN|0x00010021
+
 [PcdsDynamic, PcdsDynamicEx]
 
   ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>
-- 
2.16.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#42084): https://edk2.groups.io/g/devel/message/42084
Mute This Topic: https://groups.io/mt/32002537/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH] SecurityPkg/HddPassword: Add a PCD to skip Hdd password prompt
Posted by Dong, Eric 4 years, 10 months ago 
Hi Maggie,

Reviewed-by: Eric Dong <eric.dong@intel.com>

And pushed: 9e2416ae2e1d26c6e6daa58353de519745bb322d

Thanks,
Eric

> -----Original Message-----
> From: Chu, Maggie
> Sent: Monday, June 10, 2019 6:19 PM
> To: devel@edk2.groups.io
> Cc: Zhang, Chao B <chao.b.zhang@intel.com>; Yao, Jiewen
> <jiewen.yao@intel.com>; Dong, Eric <eric.dong@intel.com>
> Subject: [PATCH] SecurityPkg/HddPassword: Add a PCD to skip Hdd
> password prompt
> 
> https://bugzilla.tianocore.org/show_bug.cgi?id=1876
> Add a PCD for skipping Hdd password prompt.
> If device is in the locked status while attempting to skip password prompt,
> device will keep locked and system continue to boot.
> If device is in the unlocked status while attempting to skip password prompt,
> system will be forced shutdown.
> 
> Signed-off-by: Maggie Chu <maggie.chu@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> ---
>  SecurityPkg/HddPassword/HddPasswordDxe.c   | 16 ++++++++++++++++
>  SecurityPkg/HddPassword/HddPasswordDxe.inf |  4 ++++
>  SecurityPkg/SecurityPkg.dec                |  6 ++++++
>  3 files changed, 26 insertions(+)
> 
> diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.c
> b/SecurityPkg/HddPassword/HddPasswordDxe.c
> index 253af9f78f..b0d795b659 100644
> --- a/SecurityPkg/HddPassword/HddPasswordDxe.c
> +++ b/SecurityPkg/HddPassword/HddPasswordDxe.c
> @@ -1345,6 +1345,22 @@ HddPasswordRequestPassword (
>    //
>    if ((ConfigFormEntry->IfrData.SecurityStatus.Supported) &&
>        (ConfigFormEntry->IfrData.SecurityStatus.Enabled)) {
> +
> +     //
> +     // Add PcdSkipHddPasswordPrompt to determin whether to skip
> password prompt.
> +     // Due to board design, device may not power off during system warm
> boot, which result in
> +     // security status remain unlocked status, hence we add device security
> status check here.
> +     //
> +     // If device is in the locked status, device keeps locked and system
> continues booting.
> +     // If device is in the unlocked status, system is forced shutdown for
> security concern.
> +     //
> +     if (PcdGetBool (PcdSkipHddPasswordPrompt)) {
> +       if (ConfigFormEntry->IfrData.SecurityStatus.Locked) {
> +         return;
> +       } else {
> +         gRT->ResetSystem (EfiResetShutdown, EFI_SUCCESS, 0, NULL);
> +       }
> +    }
>      //
>      // As soon as the HDD password is in enabled state, we pop up a window
> to unlock hdd
>      // no matter it's really in locked or unlocked state.
> diff --git a/SecurityPkg/HddPassword/HddPasswordDxe.inf
> b/SecurityPkg/HddPassword/HddPasswordDxe.inf
> index f7550079ed..06e8755ffc 100644
> --- a/SecurityPkg/HddPassword/HddPasswordDxe.inf
> +++ b/SecurityPkg/HddPassword/HddPasswordDxe.inf
> @@ -34,6 +34,7 @@
>    MdePkg/MdePkg.dec
>    MdeModulePkg/MdeModulePkg.dec
>    CryptoPkg/CryptoPkg.dec
> +  SecurityPkg/SecurityPkg.dec
> 
>  [LibraryClasses]
>    BaseLib
> @@ -64,6 +65,9 @@
>    gEfiPciIoProtocolGuid                         ## CONSUMES
>    gEdkiiVariableLockProtocolGuid                ## CONSUMES
> 
> +[Pcd]
> +  gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt  ##
> CONSUMES
> +
>  [Depex]
>    gEfiVariableWriteArchProtocolGuid
> 
> diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index
> 3314f1854b..82929fe38e 100644
> --- a/SecurityPkg/SecurityPkg.dec
> +++ b/SecurityPkg/SecurityPkg.dec
> @@ -428,6 +428,12 @@
>    # @Prompt Skip Opal DXE driver unlock device flow.
> 
> gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0
> x00010020
> 
> +  ## Indicates if Hdd Password driver skip password prompt.<BR><BR>
> +  #   TRUE  - Skip password prompt.<BR>
> +  #   FALSE - Does not skip password prompt.<BR>
> +  # @Prompt Skip Hdd Password prompt.
> +
> +
> gEfiSecurityPkgTokenSpaceGuid.PcdSkipHddPasswordPrompt|FALSE|BOOLE
> AN|0
> + x00010021
> +
>  [PcdsDynamic, PcdsDynamicEx]
> 
>    ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows
> TCG Algorithm Registry.<BR><BR>
> --
> 2.16.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#42236): https://edk2.groups.io/g/devel/message/42236
Mute This Topic: https://groups.io/mt/32002537/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.