diff options
| author | Hao Wu <hao.a.wu@intel.com> | 2019-01-15 16:33:09 +0800 |
|---|---|---|
| committer | Hao Wu <hao.a.wu@intel.com> | 2019-02-22 08:20:08 +0800 |
| commit | e8959f81003ccd80317b820f00287897191796ee (patch) | |
| tree | e437fc6af3b9e3220e8978f1e95abee0fe9c3f42 /SecurityPkg/HddPassword/HddPasswordCommon.h | |
| parent | a3efbc29c45183fe69bcb311c2d974ddc4e7c00a (diff) | |
| download | edk2-e8959f81003ccd80317b820f00287897191796ee.tar.gz edk2-e8959f81003ccd80317b820f00287897191796ee.tar.bz2 edk2-e8959f81003ccd80317b820f00287897191796ee.zip | |
SecurityPkg/HddPassword: Add Security feature set support for ATA dev
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1529
This commit will add the 'Security feature set' support for ATA devices.
According to the AT Attachment 8 - ATA/ATAPI Command Set (ATA8-ACS)
specification, the Security feature set is an optional feature. In
summary, the feature is a password system that restricts access to user
data stored on an ATA device. A more detailed introduction of this feature
can be referred from the ATA8-ACS spec.
The HddPassword driver is composed of 2 parts:
* A DXE driver and
* A PEI driver
The DXE driver consumes EFI_ATA_PASS_THRU_PROTOCOL instances and installs
an HII GUI to manage the devices. If the managing device supports Security
feature set, the HII page will provide the user with the ability to
set/update/disable the password for this device. Also, if a password is
being set via the Security feature set, a popup window will show during
boot requesting the user to input password.
Another feature supported by this driver is that for those managing
devices with password set, they will be automatically unlocked during the
S3 resume. This is done by the co-work of the DXE driver and the PEI
driver:
The DXE driver will save the password and the identification information
for these devices into a LockBox, which is only allowed to restore during
S3 resume.
The PEI driver, during S3 resume, will restore the content in the LockBox
and will consume EDKII_PEI_ATA_PASS_THRU_PPI instances to unlock devices.
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
Diffstat (limited to 'SecurityPkg/HddPassword/HddPasswordCommon.h')
| -rw-r--r-- | SecurityPkg/HddPassword/HddPasswordCommon.h | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/SecurityPkg/HddPassword/HddPasswordCommon.h b/SecurityPkg/HddPassword/HddPasswordCommon.h new file mode 100644 index 0000000000..b904b7d39e --- /dev/null +++ b/SecurityPkg/HddPassword/HddPasswordCommon.h @@ -0,0 +1,61 @@ +/** @file
+ HDD Password common header file.
+
+ Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+
+ This program and the accompanying materials
+ are licensed and made available under the terms and conditions
+ of the BSD License which accompanies this distribution. The
+ full text of the license may be found at
+ http://opensource.org/licenses/bsd-license.php
+
+ THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef _HDD_PASSWORD_COMMON_H_
+#define _HDD_PASSWORD_COMMON_H_
+
+//
+// The payload length of HDD related ATA commands
+//
+#define HDD_PAYLOAD 512
+
+#define ATA_SECURITY_SET_PASSWORD_CMD 0xF1
+#define ATA_SECURITY_UNLOCK_CMD 0xF2
+#define ATA_SECURITY_FREEZE_LOCK_CMD 0xF5
+#define ATA_SECURITY_DIS_PASSWORD_CMD 0xF6
+
+//
+// The max retry count specified in ATA 8 spec.
+//
+#define MAX_HDD_PASSWORD_RETRY_COUNT 5
+
+//
+// According to ATA spec, the max length of hdd password is 32 bytes
+//
+#define HDD_PASSWORD_MAX_LENGTH 32
+
+#define HDD_PASSWORD_DEVICE_INFO_GUID { 0x96d877ad, 0x48af, 0x4b39, { 0x9b, 0x27, 0x4d, 0x97, 0x43, 0x9, 0xae, 0x47 } }
+
+typedef struct {
+ UINT8 Bus;
+ UINT8 Device;
+ UINT8 Function;
+ UINT8 Reserved;
+ UINT16 Port;
+ UINT16 PortMultiplierPort;
+} HDD_PASSWORD_DEVICE;
+
+//
+// It will be used to unlock HDD password for S3.
+//
+typedef struct {
+ HDD_PASSWORD_DEVICE Device;
+ CHAR8 Password[HDD_PASSWORD_MAX_LENGTH];
+ UINT32 DevicePathLength;
+ EFI_DEVICE_PATH_PROTOCOL DevicePath[];
+} HDD_PASSWORD_DEVICE_INFO;
+
+#endif // _HDD_PASSWORD_COMMON_H_
|