1 /** @file 2 Public API for Opal Core library. 3 4 Copyright (c) 2016, Intel Corporation. All rights reserved.<BR> 5 This program and the accompanying materials 6 are licensed and made available under the terms and conditions of the BSD License 7 which accompanies this distribution. The full text of the license may be found at 8 http://opensource.org/licenses/bsd-license.php 9 10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, 11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. 12 13 **/ 14 #include <Uefi.h> 15 #include <Library/BaseLib.h> 16 #include <Library/DebugLib.h> 17 #include <Library/TcgStorageOpalLib.h> 18 19 20 /** 21 Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method. 22 23 @param[in] Session, The session info for one opal device. 24 @param[in] Psid PSID of device to revert. 25 @param[in] PsidLength Length of PSID in bytes. 26 27 **/ 28 TCG_RESULT 29 EFIAPI 30 OpalUtilPsidRevert( 31 OPAL_SESSION *Session, 32 const VOID *Psid, 33 UINT32 PsidLength 34 ) 35 { 36 UINT8 MethodStatus; 37 TCG_RESULT Ret; 38 39 NULL_CHECK(Session); 40 NULL_CHECK(Psid); 41 42 Ret = OpalStartSession( 43 Session, 44 OPAL_UID_ADMIN_SP, 45 TRUE, 46 PsidLength, 47 Psid, 48 OPAL_ADMIN_SP_PSID_AUTHORITY, 49 &MethodStatus); 50 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 51 Ret = OpalPsidRevert(Session); 52 if (Ret != TcgResultSuccess) { 53 // 54 // If revert was successful, session was already ended by TPer, so only end session on failure 55 // 56 OpalEndSession(Session); 57 } 58 } 59 60 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 61 Ret = TcgResultFailure; 62 } 63 64 return Ret; 65 } 66 67 /** 68 Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY, 69 sets the OPAL_UID_ADMIN_SP_C_PIN_SID column with the new password, 70 and activates the locking SP to copy SID PIN to Admin1 Locking SP PIN 71 72 @param[in] Session, The session info for one opal device. 73 @param[in] GeneratedSid Generated SID of disk 74 @param[in] SidLength Length of generatedSid in bytes 75 @param[in] Password New admin password to set 76 @param[in] PassLength Length of password in bytes 77 78 **/ 79 TCG_RESULT 80 EFIAPI 81 OpalUtilSetAdminPasswordAsSid( 82 OPAL_SESSION *Session, 83 const VOID *GeneratedSid, 84 UINT32 SidLength, 85 const VOID *Password, 86 UINT32 PassLength 87 ) 88 { 89 UINT8 MethodStatus; 90 TCG_RESULT Ret; 91 92 NULL_CHECK(Session); 93 NULL_CHECK(GeneratedSid); 94 NULL_CHECK(Password); 95 96 Ret = OpalStartSession( 97 Session, 98 OPAL_UID_ADMIN_SP, 99 TRUE, 100 SidLength, 101 GeneratedSid, 102 OPAL_ADMIN_SP_SID_AUTHORITY, 103 &MethodStatus 104 ); 105 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 106 DEBUG ((DEBUG_INFO, "start session with admin SP as SID authority failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus)); 107 goto done; 108 } 109 110 // 111 // 1. Update SID = new Password 112 // 113 Ret = OpalSetPassword( 114 Session, 115 OPAL_UID_ADMIN_SP_C_PIN_SID, 116 Password, 117 PassLength, 118 &MethodStatus 119 ); 120 121 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 122 OpalEndSession(Session); 123 DEBUG ((DEBUG_INFO, "set Password failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus)); 124 goto done; 125 } 126 127 // 128 // 2. Activate locking SP 129 // 130 Ret = OpalActivateLockingSp(Session, &MethodStatus); 131 OpalEndSession(Session); 132 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 133 DEBUG ((DEBUG_INFO, "activate locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus)); 134 goto done; 135 } 136 137 done: 138 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 139 Ret = TcgResultFailure; 140 } 141 return Ret; 142 } 143 144 /** 145 146 Opens a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 147 and updates the specified locking range with the provided column values 148 149 @param[in] Session, The session info for one opal device. 150 @param[in] Password New admin password to set 151 @param[in] PassLength Length of password in bytes 152 @param[in] LockingRangeUid Locking range UID to set values 153 @param[in] RangeStart Value to set RangeStart column for Locking Range 154 @param[in] RangeLength Value to set RangeLength column for Locking Range 155 @param[in] ReadLockEnabled Value to set readLockEnabled column for Locking Range 156 @param[in] WriteLockEnabled Value to set writeLockEnabled column for Locking Range 157 @param[in] ReadLocked Value to set ReadLocked column for Locking Range 158 @param[in] WriteLocked Value to set WriteLocked column for Locking Range 159 160 **/ 161 TCG_RESULT 162 EFIAPI 163 OpalUtilSetOpalLockingRange( 164 OPAL_SESSION *Session, 165 const VOID *Password, 166 UINT32 PassLength, 167 TCG_UID LockingRangeUid, 168 UINT64 RangeStart, 169 UINT64 RangeLength, 170 BOOLEAN ReadLockEnabled, 171 BOOLEAN WriteLockEnabled, 172 BOOLEAN ReadLocked, 173 BOOLEAN WriteLocked 174 ) 175 { 176 UINT8 MethodStatus; 177 TCG_RESULT Ret; 178 179 NULL_CHECK(Session); 180 NULL_CHECK(Password); 181 182 // 183 // Start session with Locking SP using current admin Password 184 // 185 Ret = OpalStartSession( 186 Session, 187 OPAL_UID_LOCKING_SP, 188 TRUE, 189 PassLength, 190 Password, 191 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 192 &MethodStatus); 193 if ((Ret != TcgResultSuccess) || (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS)) { 194 DEBUG ((DEBUG_INFO, "start session with locking SP failed: Ret=%d MethodStatus=%u\n", Ret, MethodStatus)); 195 goto done; 196 } 197 198 // 199 // Enable locking range 200 // 201 Ret = OpalSetLockingRange( 202 Session, 203 LockingRangeUid, 204 RangeStart, 205 RangeLength, 206 ReadLockEnabled, 207 WriteLockEnabled, 208 ReadLocked, 209 WriteLocked, 210 &MethodStatus); 211 212 OpalEndSession(Session); 213 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 214 DEBUG ((DEBUG_INFO, "set locking range failed: Ret=%d MethodStatus=0x%x\n", Ret, MethodStatus)); 215 } 216 217 done: 218 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 219 Ret = TcgResultFailure; 220 } 221 return Ret; 222 } 223 224 /** 225 Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY, 226 sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password, 227 and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password. 228 229 @param[in] Session, The session info for one opal device. 230 @param[in] OldPassword Current admin password 231 @param[in] OldPasswordLength Length of current admin password in bytes 232 @param[in] NewPassword New admin password to set 233 @param[in] NewPasswordLength Length of new password in bytes 234 235 **/ 236 TCG_RESULT 237 EFIAPI 238 OpalUtilSetAdminPassword( 239 OPAL_SESSION *Session, 240 const VOID *OldPassword, 241 UINT32 OldPasswordLength, 242 const VOID *NewPassword, 243 UINT32 NewPasswordLength 244 ) 245 { 246 TCG_RESULT Ret; 247 UINT8 MethodStatus; 248 249 NULL_CHECK(Session); 250 NULL_CHECK(OldPassword); 251 NULL_CHECK(NewPassword); 252 253 // 254 // Unknown ownership 255 // 256 Ret = OpalStartSession( 257 Session, 258 OPAL_UID_ADMIN_SP, 259 TRUE, 260 OldPasswordLength, 261 OldPassword, 262 OPAL_ADMIN_SP_SID_AUTHORITY, 263 &MethodStatus 264 ); 265 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 266 DEBUG ((DEBUG_INFO, "start session with admin SP using old Password failed\n")); 267 goto done; 268 } 269 270 // 271 // Update SID = new pw 272 // 273 Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, NewPassword, NewPasswordLength, &MethodStatus); 274 OpalEndSession(Session); 275 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 276 DEBUG ((DEBUG_INFO, "set new admin SP Password failed\n")); 277 goto done; 278 } 279 280 Ret = OpalStartSession( 281 Session, 282 OPAL_UID_LOCKING_SP, 283 TRUE, 284 OldPasswordLength, 285 OldPassword, 286 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 287 &MethodStatus 288 ); 289 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 290 DEBUG ((DEBUG_INFO, "start session with locking SP using old Password failed\n")); 291 goto done; 292 } 293 294 // 295 // Update admin locking SP to new pw 296 // 297 Ret = OpalSetPassword(Session, OPAL_LOCKING_SP_C_PIN_ADMIN1, NewPassword, NewPasswordLength, &MethodStatus); 298 OpalEndSession(Session); 299 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 300 DEBUG ((DEBUG_INFO, "set new locking SP Password failed\n")); 301 goto done; 302 } 303 304 done: 305 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 306 Ret = TcgResultFailure; 307 } 308 return Ret; 309 } 310 311 /** 312 Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY 313 and sets the User1 SP authority to enabled and sets the User1 password. 314 315 @param[in] Session, The session info for one opal device. 316 @param[in] OldPassword Current admin password 317 @param[in] OldPasswordLength Length of current admin password in bytes 318 @param[in] NewPassword New admin password to set 319 @param[in] NewPasswordLength Length of new password in bytes 320 321 **/ 322 TCG_RESULT 323 EFIAPI 324 OpalUtilSetUserPassword( 325 OPAL_SESSION *Session, 326 const VOID *OldPassword, 327 UINT32 OldPasswordLength, 328 const VOID *NewPassword, 329 UINT32 NewPasswordLength 330 ) 331 { 332 UINT8 MethodStatus; 333 TCG_RESULT Ret; 334 335 NULL_CHECK(Session); 336 NULL_CHECK(OldPassword); 337 NULL_CHECK(NewPassword); 338 339 // 340 // See if updating user1 authority 341 // 342 Ret = OpalStartSession( 343 Session, 344 OPAL_UID_LOCKING_SP, 345 TRUE, 346 OldPasswordLength, 347 OldPassword, 348 OPAL_LOCKING_SP_USER1_AUTHORITY, 349 &MethodStatus 350 ); 351 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 352 Ret = OpalSetPassword( 353 Session, 354 OPAL_LOCKING_SP_C_PIN_USER1, 355 NewPassword, 356 NewPasswordLength, 357 &MethodStatus 358 ); 359 OpalEndSession(Session); 360 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 361 return Ret; 362 } 363 } 364 365 // 366 // Setting Password for first time or setting Password as admin 367 // 368 369 // 370 // Start session with Locking SP using current admin Password 371 // 372 Ret = OpalStartSession( 373 Session, 374 OPAL_UID_LOCKING_SP, 375 TRUE, 376 OldPasswordLength, 377 OldPassword, 378 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 379 &MethodStatus 380 ); 381 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 382 DEBUG ((DEBUG_INFO, "StartSession with locking SP as admin1 authority failed\n")); 383 goto done; 384 } 385 386 // 387 // Enable User1 and set its PIN 388 // 389 Ret = OpalSetLockingSpAuthorityEnabledAndPin( 390 Session, 391 OPAL_LOCKING_SP_C_PIN_USER1, 392 OPAL_LOCKING_SP_USER1_AUTHORITY, 393 NewPassword, 394 NewPasswordLength, 395 &MethodStatus 396 ); 397 OpalEndSession(Session); 398 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 399 DEBUG ((DEBUG_INFO, "OpalSetLockingSpAuthorityEnabledAndPin failed\n")); 400 goto done; 401 } 402 403 done: 404 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 405 Ret = TcgResultFailure; 406 } 407 return Ret; 408 } 409 410 /** 411 Verify whether user input the correct password. 412 413 @param[in] Session, The session info for one opal device. 414 @param[in] Password Admin password 415 @param[in] PasswordLength Length of password in bytes 416 @param[in/out] HostSigningAuthority Use the Host signing authority type. 417 418 **/ 419 TCG_RESULT 420 EFIAPI 421 OpalUtilVerifyPassword ( 422 OPAL_SESSION *Session, 423 const VOID *Password, 424 UINT32 PasswordLength, 425 TCG_UID HostSigningAuthority 426 ) 427 { 428 TCG_RESULT Ret; 429 UINT8 MethodStatus; 430 431 NULL_CHECK(Session); 432 NULL_CHECK(Password); 433 434 Ret = OpalStartSession( 435 Session, 436 OPAL_UID_LOCKING_SP, 437 TRUE, 438 PasswordLength, 439 Password, 440 HostSigningAuthority, 441 &MethodStatus); 442 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 443 OpalEndSession(Session); 444 return TcgResultSuccess; 445 } 446 447 return TcgResultFailure; 448 } 449 450 /** 451 Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY 452 and generates a new global locking range key to erase the Data. 453 454 @param[in] Session, The session info for one opal device. 455 @param[in] Password Admin or user password 456 @param[in] PasswordLength Length of password in bytes 457 @param[in/out] PasswordFailed indicates if password failed (start session didn't work) 458 459 **/ 460 TCG_RESULT 461 EFIAPI 462 OpalUtilSecureErase( 463 OPAL_SESSION *Session, 464 const VOID *Password, 465 UINT32 PasswordLength, 466 BOOLEAN *PasswordFailed 467 ) 468 { 469 UINT8 MethodStatus; 470 TCG_RESULT Ret; 471 472 NULL_CHECK(Session); 473 NULL_CHECK(Password); 474 NULL_CHECK(PasswordFailed); 475 476 // 477 // Try to generate a new key with admin1 478 // 479 Ret = OpalStartSession( 480 Session, 481 OPAL_UID_LOCKING_SP, 482 TRUE, 483 PasswordLength, 484 Password, 485 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 486 &MethodStatus 487 ); 488 489 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 490 Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus); 491 *PasswordFailed = FALSE; 492 OpalEndSession(Session); 493 } else { 494 // 495 // Try to generate a new key with user1 496 // 497 Ret = OpalStartSession( 498 Session, 499 OPAL_UID_LOCKING_SP, 500 TRUE, 501 PasswordLength, 502 Password, 503 OPAL_LOCKING_SP_USER1_AUTHORITY, 504 &MethodStatus 505 ); 506 507 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 508 Ret = OpalGlobalLockingRangeGenKey(Session, &MethodStatus); 509 *PasswordFailed = FALSE; 510 OpalEndSession(Session); 511 } else { 512 *PasswordFailed = TRUE; 513 } 514 } 515 516 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 517 Ret = TcgResultFailure; 518 } 519 return Ret; 520 } 521 522 /** 523 Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority. 524 525 @param[in] Session, The session info for one opal device. 526 @param[in] Password Admin password 527 @param[in] PasswordLength Length of password in bytes 528 @param[in/out] PasswordFailed indicates if password failed (start session didn't work) 529 530 **/ 531 TCG_RESULT 532 EFIAPI 533 OpalUtilDisableUser( 534 OPAL_SESSION *Session, 535 const VOID *Password, 536 UINT32 PasswordLength, 537 BOOLEAN *PasswordFailed 538 ) 539 { 540 UINT8 MethodStatus; 541 TCG_RESULT Ret; 542 543 NULL_CHECK(Session); 544 NULL_CHECK(Password); 545 NULL_CHECK(PasswordFailed); 546 547 // 548 // Start session with Locking SP using current admin Password 549 // 550 Ret = OpalStartSession( 551 Session, 552 OPAL_UID_LOCKING_SP, 553 TRUE, 554 PasswordLength, 555 Password, 556 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 557 &MethodStatus 558 ); 559 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 560 DEBUG ((DEBUG_INFO, "StartSession with Locking SP as Admin1 failed\n")); 561 *PasswordFailed = TRUE; 562 goto done; 563 } 564 565 *PasswordFailed = FALSE; 566 Ret = OpalDisableUser(Session, &MethodStatus); 567 OpalEndSession(Session); 568 569 done: 570 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 571 Ret = TcgResultFailure; 572 } 573 return Ret; 574 } 575 576 /** 577 Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method. 578 579 @param[in] Session, The session info for one opal device. 580 @param[in] KeepUserData TRUE to keep existing Data on the disk, or FALSE to erase it 581 @param[in] Password Admin password 582 @param[in] PasswordLength Length of password in bytes 583 @param[in/out] PasswordFailed indicates if password failed (start session didn't work) 584 @param[in] Msid Msid info. 585 @param[in] MsidLength Msid data length. 586 587 **/ 588 TCG_RESULT 589 EFIAPI 590 OpalUtilRevert( 591 OPAL_SESSION *Session, 592 BOOLEAN KeepUserData, 593 const VOID *Password, 594 UINT32 PasswordLength, 595 BOOLEAN *PasswordFailed, 596 UINT8 *Msid, 597 UINT32 MsidLength 598 ) 599 { 600 UINT8 MethodStatus; 601 TCG_RESULT Ret; 602 603 NULL_CHECK(Session); 604 NULL_CHECK(Msid); 605 NULL_CHECK(Password); 606 NULL_CHECK(PasswordFailed); 607 608 Ret = OpalStartSession( 609 Session, 610 OPAL_UID_LOCKING_SP, 611 TRUE, 612 PasswordLength, 613 Password, 614 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 615 &MethodStatus 616 ); 617 618 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 619 DEBUG ((DEBUG_INFO, "error starting session: Ret=%d, MethodStatus=%u\n", Ret, MethodStatus)); 620 *PasswordFailed = TRUE; 621 goto done; 622 } 623 624 *PasswordFailed = FALSE; 625 // 626 // Try to revert with admin1 627 // 628 Ret = OpalAdminRevert(Session, KeepUserData, &MethodStatus); 629 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 630 // 631 // Device ends the session on successful revert, so only call OpalEndSession when fail. 632 // 633 DEBUG ((DEBUG_INFO, "OpalAdminRevert as admin failed\n")); 634 OpalEndSession(Session); 635 } 636 637 Ret = OpalUtilSetSIDtoMSID (Session, Password, PasswordLength, Msid, MsidLength); 638 639 done: 640 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 641 Ret = TcgResultFailure; 642 } 643 return Ret; 644 } 645 646 /** 647 After revert success, set SID to MSID. 648 649 @param Session, The session info for one opal device. 650 @param Password, Input password info. 651 @param PasswordLength, Input password length. 652 @param Msid Msid info. 653 @param MsidLength Msid data length. 654 655 **/ 656 TCG_RESULT 657 EFIAPI 658 OpalUtilSetSIDtoMSID ( 659 OPAL_SESSION *Session, 660 const VOID *Password, 661 UINT32 PasswordLength, 662 UINT8 *Msid, 663 UINT32 MsidLength 664 ) 665 { 666 TCG_RESULT Ret; 667 UINT8 MethodStatus; 668 669 NULL_CHECK(Session); 670 NULL_CHECK(Msid); 671 NULL_CHECK(Password); 672 673 // 674 // Start session with admin sp to update SID to MSID 675 // 676 Ret = OpalStartSession( 677 Session, 678 OPAL_UID_ADMIN_SP, 679 TRUE, 680 PasswordLength, 681 Password, 682 OPAL_ADMIN_SP_SID_AUTHORITY, 683 &MethodStatus 684 ); 685 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 686 goto done; 687 } 688 689 // 690 // Update SID pin 691 // 692 Ret = OpalSetPassword(Session, OPAL_UID_ADMIN_SP_C_PIN_SID, Msid, MsidLength, &MethodStatus); 693 OpalEndSession(Session); 694 695 done: 696 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 697 Ret = TcgResultFailure; 698 } 699 700 return Ret; 701 } 702 703 /** 704 Update global locking range. 705 706 @param Session, The session info for one opal device. 707 @param Password, Input password info. 708 @param PasswordLength, Input password length. 709 @param ReadLocked, Read lock info. 710 @param WriteLocked write lock info. 711 712 **/ 713 TCG_RESULT 714 EFIAPI 715 OpalUtilUpdateGlobalLockingRange( 716 OPAL_SESSION *Session, 717 const VOID *Password, 718 UINT32 PasswordLength, 719 BOOLEAN ReadLocked, 720 BOOLEAN WriteLocked 721 ) 722 { 723 UINT8 MethodStatus; 724 TCG_RESULT Ret; 725 726 NULL_CHECK(Session); 727 NULL_CHECK(Password); 728 729 // 730 // Try to start session with Locking SP as admin1 authority 731 // 732 Ret = OpalStartSession( 733 Session, 734 OPAL_UID_LOCKING_SP, 735 TRUE, 736 PasswordLength, 737 Password, 738 OPAL_LOCKING_SP_ADMIN1_AUTHORITY, 739 &MethodStatus 740 ); 741 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 742 Ret = OpalUpdateGlobalLockingRange( 743 Session, 744 ReadLocked, 745 WriteLocked, 746 &MethodStatus 747 ); 748 OpalEndSession(Session); 749 if (Ret == TcgResultSuccess && MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS) { 750 goto done; 751 } 752 } 753 754 if (MethodStatus == TCG_METHOD_STATUS_CODE_AUTHORITY_LOCKED_OUT) { 755 DEBUG ((DEBUG_INFO, "unlock as admin failed with AUTHORITY_LOCKED_OUT\n")); 756 goto done; 757 } 758 759 // 760 // Try user1 authority 761 // 762 Ret = OpalStartSession( 763 Session, 764 OPAL_UID_LOCKING_SP, 765 TRUE, 766 PasswordLength, 767 Password, 768 OPAL_LOCKING_SP_USER1_AUTHORITY, 769 &MethodStatus 770 ); 771 if (Ret != TcgResultSuccess || MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 772 DEBUG ((DEBUG_INFO, "StartSession with Locking SP as User1 failed\n")); 773 goto done; 774 } 775 776 Ret = OpalUpdateGlobalLockingRange(Session, ReadLocked, WriteLocked, &MethodStatus); 777 OpalEndSession(Session); 778 779 done: 780 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 781 Ret = TcgResultFailure; 782 } 783 return Ret; 784 } 785 786 /** 787 Update global locking range. 788 789 @param Session, The session info for one opal device. 790 @param Msid, The data buffer to save Msid info. 791 @param MsidBufferLength, The data buffer length for Msid. 792 @param MsidLength, The actual data length for Msid. 793 794 **/ 795 TCG_RESULT 796 EFIAPI 797 OpalUtilGetMsid( 798 OPAL_SESSION *Session, 799 UINT8 *Msid, 800 UINT32 MsidBufferLength, 801 UINT32 *MsidLength 802 ) 803 { 804 UINT8 MethodStatus; 805 TCG_RESULT Ret; 806 807 NULL_CHECK(Session); 808 NULL_CHECK(Msid); 809 NULL_CHECK(MsidLength); 810 811 Ret = OpalStartSession( 812 Session, 813 OPAL_UID_ADMIN_SP, 814 TRUE, 815 0, 816 NULL, 817 TCG_UID_NULL, 818 &MethodStatus 819 ); 820 if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) { 821 Ret = OpalGetMsid (Session, MsidBufferLength, Msid, MsidLength); 822 OpalEndSession (Session); 823 } 824 825 if (MethodStatus != TCG_METHOD_STATUS_CODE_SUCCESS) { 826 Ret = TcgResultFailure; 827 } 828 829 return Ret; 830 } 831 832 /** 833 834 The function determines who owns the device by attempting to start a session with different credentials. 835 If the SID PIN matches the MSID PIN, the no one owns the device. 836 If the SID PIN matches the ourSidPin, then "Us" owns the device. Otherwise it is unknown. 837 838 839 @param[in] Session The session info for one opal device. 840 @param Msid, The Msid info. 841 @param MsidLength, The data length for Msid. 842 843 **/ 844 OPAL_OWNER_SHIP 845 EFIAPI 846 OpalUtilDetermineOwnership( 847 OPAL_SESSION *Session, 848 UINT8 *Msid, 849 UINT32 MsidLength 850 ) 851 { 852 UINT8 MethodStatus; 853 TCG_RESULT Ret; 854 OPAL_OWNER_SHIP Owner; 855 856 if ((Session == NULL) || (Msid == NULL)) { 857 return OpalOwnershipUnknown; 858 } 859 860 Owner = OpalOwnershipUnknown; 861 // 862 // Start Session as SID_UID with ADMIN_SP using MSID PIN 863 // 864 Ret = OpalStartSession( 865 Session, 866 OPAL_UID_ADMIN_SP, 867 TRUE, 868 MsidLength, 869 Msid, 870 OPAL_ADMIN_SP_SID_AUTHORITY, 871 &MethodStatus); 872 if ((Ret == TcgResultSuccess) && (MethodStatus == TCG_METHOD_STATUS_CODE_SUCCESS)) { 873 // 874 // now we know that SID PIN == MSID PIN 875 // 876 Owner = OpalOwnershipNobody; 877 878 OpalEndSession(Session); 879 } 880 881 return Owner; 882 } 883 884 /** 885 886 The function returns if admin password exists. 887 888 @param[in] OwnerShip The owner ship of the opal device. 889 @param[in] LockingFeature The locking info of the opal device. 890 891 @retval TRUE Admin password existed. 892 @retval FALSE Admin password not existed. 893 894 **/ 895 BOOLEAN 896 EFIAPI 897 OpalUtilAdminPasswordExists( 898 IN UINT16 OwnerShip, 899 IN TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature 900 ) 901 { 902 NULL_CHECK(LockingFeature); 903 904 // if it is Unknown who owns the device 905 // then someone has set password previously through our UI 906 // because the SID would no longer match the generated SID (ownership us) 907 // or someone has set password using 3rd party software 908 909 // 910 // Locking sp enabled is checked b/c it must be enabled to change the PIN of the Admin1. 911 // 912 return (OwnerShip == OpalOwnershipUnknown && LockingFeature->LockingEnabled); 913 } 914 915
