Browse Source

SecurityPkg: Add a PCD to skip Opal password prompt

https://bugzilla.tianocore.org/show_bug.cgi?id=1484
Add a PCD for skipping password prompt and device unlock flow.
so that other pre-OS applications are able to take over Opal
devices unlock flow.

Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Maggie Chu <maggie.chu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
Chu, Maggie 5 years ago
parent
commit
8a9301cdd7

+ 6 - 0
SecurityPkg/SecurityPkg.dec

@@ -428,6 +428,12 @@
   # @Prompt Possible TPM2 Interrupt Number buffer
   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2PossibleIrqNumBuf|{0x00, 0x00, 0x00, 0x00}|VOID*|0x0001001D
 
+  ## Indicates if Opal DXE driver skip unlock device flow.<BR><BR>
+  #   TRUE  - Skip unlock device flow.<BR>
+  #   FALSE - Does not skip unlock device flow.<BR>
+  # @Prompt Skip Opal DXE driver unlock device flow.
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock|FALSE|BOOLEAN|0x00010020
+
 [PcdsDynamic, PcdsDynamicEx]
 
   ## This PCD indicates Hash mask for TPM 2.0. Bit definition strictly follows TCG Algorithm Registry.<BR><BR>

+ 4 - 0
SecurityPkg/Tcg/Opal/OpalPassword/OpalDriver.c

@@ -988,6 +988,10 @@ OpalDriverRequestPassword (
 
     IsLocked = OpalDeviceLocked (&Dev->OpalDisk.SupportedAttributes, &Dev->OpalDisk.LockingFeature);
 
+    if (IsLocked && PcdGetBool (PcdSkipOpalDxeUnlock)) {
+      return;
+    }
+
     while (Count < MAX_PASSWORD_TRY_COUNT) {
       Password = OpalDriverPopUpPasswordInput (Dev, PopUpString, NULL, &PressEsc);
       if (PressEsc) {

+ 3 - 0
SecurityPkg/Tcg/Opal/OpalPassword/OpalPasswordDxe.inf

@@ -75,5 +75,8 @@
 [Guids]
   gEfiEndOfDxeEventGroupGuid                    ## CONSUMES             ## Event
 
+[Pcd]
+  gEfiSecurityPkgTokenSpaceGuid.PcdSkipOpalDxeUnlock  ## CONSUMES
+
 [Depex]
   gEfiHiiStringProtocolGuid AND gEfiHiiDatabaseProtocolGuid