Commit Graph

29 Commits

Author SHA1 Message Date
Eric Dong 50e6bb98ee SecurityPkg OpalPasswordSmm: Consume SmmIoLib.
Update code to consume SmmIoLib to check Mmio validation.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-04 08:32:38 +08:00
Hao Wu 5d7f27aab2 SecurityPkg/Opal: Refine casting expression result to bigger size
There are cases that the operands of an expression are all with rank less
than UINT64/INT64 and the result of the expression is explicitly cast to
UINT64/INT64 to fit the target size.

An example will be:
UINT32 a,b;
// a and b can be any unsigned int type with rank less than UINT64, like
// UINT8, UINT16, etc.
UINT64 c;
c = (UINT64) (a + b);

Some static code checkers may warn that the expression result might
overflow within the rank of "int" (integer promotions) and the result is
then cast to a bigger size.

The commit refines codes by the following rules:
1). When the expression is possible to overflow the range of unsigned int/
int:
c = (UINT64)a + b;

2). When the expression will not overflow within the rank of "int", remove
the explicit type casts:
c = a + b;

3). When the expression will be cast to pointer of possible greater size:
UINT32 a,b;
VOID *c;
c = (VOID *)(UINTN)(a + b); --> c = (VOID *)((UINTN)a + b);

4). When one side of a comparison expression contains only operands with
rank less than UINT32:
UINT8 a;
UINT16 b;
UINTN c;
if ((UINTN)(a + b) > c) {...} --> if (((UINT32)a + b) > c) {...}

For rule 4), if we remove the 'UINTN' type cast like:
if (a + b > c) {...}
The VS compiler will complain with warning C4018 (signed/unsigned
mismatch, level 3 warning) due to promoting 'a + b' to type 'int'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-03-06 14:33:24 +08:00
Dandan Bi 26f7580566 SecurityPkg/OpalPasswordDxe: Make comments align with the function
Cc: Eric Dong <eric.dong@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2016-12-14 21:34:37 +08:00
Eric Dong 34c2ce6529 SecurityPkg OpalPasswordDxe: Use PP actions to enable BlockSID
Update the implementation to use PP BlockSID related actions.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2016-11-28 14:50:43 +08:00
Eric Dong 252b891b2b Revert old "Enable BlockSid related PP actions" patch series.
New solution for this issue will be provided.

This reverts commits from d1947ce509
to bda034c34d.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-23 16:30:03 +08:00
Eric Dong 01dd077315 SecurityPkg OpalPasswordDxe: Clean PSID buffer.
Change callback handler type to avoid saving PSID info in
browser temp buffer. Also clean the buffer after using it.

Cc: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:57 +08:00
Eric Dong bee13c0021 SecurityPkg OpalPasswordDxe: Clean password buffer.
Cc: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:57 +08:00
Eric Dong 9de81c126c SecurityPkg OpalPasswordDxe: Use PP actions to enable BlockSID.
Update the implementation, use physical presence defined actions to
update the BlockSid related status.

Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
2016-11-21 15:37:56 +08:00
Zhang, Chao B 0ab475c9a1 SecurityPkg: Fix typos in comments
This patch fixes the following typos:
- intialized -> initialized
- TURE -> TRUE
- successull -> successfully
- hanlder -> handler
- funciton -> function
- Seperator -> Separator
- Sumbit -> Submit
Also convert EFI_D_ERROR to DEBUG_ERROR for some debug messages.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Gary Lin <glin@suse.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-11-15 15:45:31 +08:00
Eric Dong 0acd8df45f SecurityPkg OpalPasswordSmm: Fix S3 resume failure.
Changes includes:
1.Check SMM device list before update it to avoid duplicate creation.
2.Clean up the configuration buffer before use it in S3 resume phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-10-12 13:19:47 +08:00
Dong, Eric 4636e4426a SecurityPkg OpalPasswordDxe: Fix buffer overflow issue.
In current code, PSID is processed as string and the length is 0x20.
Current code only reserved 0x20 length buffer for it, no extra buffer
for the '\0'. When driver call UnicodeStrToAsciiStrS to convert PSID,
it search the '\0' for the end. So extra dirty data saved in PSID
info which caused PSID revert action failed. This patch reserved
extra 1 byte data for the '\0'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2016-08-03 09:21:27 +08:00
Eric Dong c9a0755572 SecurityPkg OpalPasswordSmm: Remove useless code.
EdkII not allow to use #if in source code, also
the code in it already unused. so just remove this
code.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-07-11 10:38:20 +08:00
Star Zeng b7c7179338 SecurityPkg: Replace UnicodeStrToAsciiStr/AsciiStrToUnicodeStr
It is the follow up of 3ab41b7a32
to replace UnicodeStrToAsciiStr/AsciiStrToUnicodeStr with
UnicodeStrToAsciiStrS/AsciiStrToUnicodeStrS.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Chao Zhang <chao.b.zhang@intel.com>
2016-06-21 12:46:25 +08:00
Eric Dong 0efc3be0af SecurityPkg OpalPasswordDxe: gray out menu instead of suppress it.
For current implementation, if the device is pyrite type, driver
will suppress the "keep user data" option. Base on the feedback
from user, they prefer to keep the menu but gray out it. Now base
on this feedback to update the driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-06-16 10:41:37 +08:00
Eric Dong 72a05f849f SecurityPkg OpalPasswordDxe: Error handling enhance when input password.
Enhance the error handling:
1. When the device is unlocked at BIOS phase and system does a warm reboot,
the device may be still in unlock status if it uses external power. For
such case, we would still popup password window to ask user input. If
user presses ESC key here, we would force the system shut down or ask
user input again to avoid security hole.
2. When user reach max retry count, force shutdown.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-12 13:07:20 +08:00
Dandan Bi eafbd7a232 Security/OpalPasswordDxe: Enhance the logic in RouteConfig/ExtractConfig
Make the implementation of RouteConfig/ExtractConfig function
follow the UEFI spec.

Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2016-05-11 11:25:52 +08:00
Eric Dong 3f250a944d SecurityPkg OpalPasswordSmm: Always execute BlockSid command.
The BlockSid feature is not depend on lock status,
so move the send BlockSid command out of unlock process.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:48 +08:00
Eric Dong 69cd129471 SecurityPkg OpalPasswordSmm: Enhance BlockSid Logic.
BlockSid feature can be retrieve from the header info.
Update the logic, check BlockSid capability before use it.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:47 +08:00
Eric Dong be08755355 SecurityPkg OpalPasswordDxe: Check BlockSid capability before send command.
Not all opal device support BlockSid feature. So Add
code logic to check the capability before send BlockSid
command.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:47 +08:00
Eric Dong 8d3d84508f SecurityPkg OpalPasswordDxe: Change BlockSid position.
The BlockSid feature is a global level feature instead
of device level feature. So move the menu from device page
to the main page.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-05 12:52:46 +08:00
Eric Dong f14307489f SecurityPkg OpalPasswordDxe: Install menu without device dependency.
Change design to always install opal menu.
Current implementation only install menu when device connect.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-05-04 10:57:05 +08:00
Eric Dong 009264f5cf SecurityPkg-Opal(2): Enhance AHCI Bar MMIO region check.
This patch enhance OPAL password SMM driver to check SMM bar is valid MMIO
besides outside of SMRAM.

This is designed to meet Microsoft WSMT table definition on FIXED_COMM_BUFFERS
requirement.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-29 12:49:25 +08:00
Eric Dong 8207d79b30 SecurityPkg OpalPasswordDxe: Clean up debug message in OpalHii.c
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-08 10:40:53 +08:00
Eric Dong ea2a6eb786 SecurityPkg OpalPasswordDxe: Suppress option for special device.
According to current Pyrite SSC Spec 1.00, there is no parameter
for RevertSP method. So suppress KeepUserData option for the
Pyrite Ssc type device.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-08 10:40:37 +08:00
Eric Dong b4ddf0eb49 SecurityPkg OpalPasswordDxe: Check the pointer before use it.
Check the pointer before use it to make the code more safely.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:15 +08:00
Eric Dong 7fb312f257 SecurityPkg OpalPasswordDxe: Remove the hard code debug build option.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:14 +08:00
Eric Dong 9348813c4b SecurityPkg OpalPasswordSmm: Remove the hard code build option.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-04-06 13:03:13 +08:00
Eric Dong cb274a2703 SecurityPkg: OpalPasswordSmm: Add Opal password Smm driver.
This driver used to unlock device in S3 resume phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-03-29 15:37:30 +08:00
Eric Dong a06875e1f0 SecurityPkg: OpalPasswordDxe: Add Opal password dxe driver.
This driver used to enables opal feature in bios.
It adds setup menu and unlock device process in boot phase.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2016-03-29 15:37:30 +08:00