SecurityPkg/Library/OpalPasswordSupportLib/OpalPasswordSupportLib.c - third_party/edk2 - Git at Google

 /** @file
   Implementation of Opal password support library.

 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
 http://opensource.org/licenses/bsd-license.php

 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

 **/

 #include "OpalPasswordSupportNotify.h"

 LIST_ENTRY           mDeviceList = INITIALIZE_LIST_HEAD_VARIABLE (mDeviceList);
 BOOLEAN              gInSmm = FALSE;
 EFI_GUID             gOpalPasswordNotifyProtocolGuid = OPAL_PASSWORD_NOTIFY_PROTOCOL_GUID;

 /**

   The function performs determines the available actions for the OPAL_DISK provided.

   @param[in]   SupportedAttributes   The support attribute for the device.
   @param[in]   LockingFeature        The locking status for the device.
   @param[in]   OwnerShip             The ownership for the device.
   @param[out]  AvalDiskActions       Pointer to fill-out with appropriate disk actions.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportGetAvailableActions(
   IN  OPAL_DISK_SUPPORT_ATTRIBUTE      *SupportedAttributes,
   IN  TCG_LOCKING_FEATURE_DESCRIPTOR   *LockingFeature,
   IN  UINT16                           OwnerShip,
   OUT OPAL_DISK_ACTIONS                *AvalDiskActions
   )
 {
   BOOLEAN ExistingPassword;

   NULL_CHECK(AvalDiskActions);

   AvalDiskActions->AdminPass = 1;
   AvalDiskActions->UserPass = 0;
   AvalDiskActions->DisableUser = 0;
   AvalDiskActions->Unlock = 0;

   //
   // Revert is performed on locking sp, so only allow if locking sp is enabled
   //
   if (LockingFeature->LockingEnabled) {
     AvalDiskActions->Revert = 1;
   }

   //
   // Psid revert is available for any device with media encryption support
   // Revert is allowed for any device with media encryption support, however it requires
   //
   if (SupportedAttributes->MediaEncryption) {

     //
     // Only allow psid revert if media encryption is enabled.
     // Otherwise, someone who steals a disk can psid revert the disk and the user Data is still
     // intact and accessible
     //
     AvalDiskActions->PsidRevert = 1;
     AvalDiskActions->RevertKeepDataForced = 0;

     //
     // Secure erase is performed by generating a new encryption key
     // this is only available is encryption is supported
     //
     AvalDiskActions->SecureErase = 1;
   } else {
     AvalDiskActions->PsidRevert = 0;
     AvalDiskActions->SecureErase = 0;

     //
     // If no media encryption is supported, then a revert (using password) will not
     // erase the Data (since you can't generate a new encryption key)
     //
     AvalDiskActions->RevertKeepDataForced = 1;
   }

   if (LockingFeature->Locked) {
     AvalDiskActions->Unlock = 1;
   } else {
     AvalDiskActions->Unlock = 0;
   }

   //
   // Only allow user to set password if an admin password exists
   //
   ExistingPassword = OpalUtilAdminPasswordExists(OwnerShip, LockingFeature);
   AvalDiskActions->UserPass = ExistingPassword;

   //
   // This will still show up even if there isn't a user, which is fine
   //
   AvalDiskActions->DisableUser = ExistingPassword;

   return TcgResultSuccess;
 }

 /**
   Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      Psid               PSID of device to revert.
   @param[in]      PsidLength         Length of PSID in bytes.
   @param[in]      DevicePath         The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportPsidRevert(
   IN OPAL_SESSION              *Session,
   IN VOID                      *Psid,
   IN UINT32                    PsidLength,
   IN EFI_DEVICE_PATH_PROTOCOL  *DevicePath
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Psid);

   Ret = OpalUtilPsidRevert (Session, Psid, PsidLength);
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, 0, NULL);
   }

   return Ret;
 }

 /**
   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
   sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password,
   and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      OldPassword        Current admin password
   @param[in]      OldPasswordLength  Length of current admin password in bytes
   @param[in]      NewPassword        New admin password to set
   @param[in]      NewPasswordLength  Length of new password in bytes
   @param[in]      DevicePath         The device path for the opal devcie.
   @param[in]      SetAdmin           Whether set admin password or user password.
                                      TRUE for admin, FALSE for user.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportSetPassword(
   IN OPAL_SESSION              *Session,
   IN VOID                      *OldPassword,
   IN UINT32                    OldPasswordLength,
   IN VOID                      *NewPassword,
   IN UINT32                    NewPasswordLength,
   IN EFI_DEVICE_PATH_PROTOCOL  *DevicePath,
   IN BOOLEAN                   SetAdmin
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(OldPassword);
   NULL_CHECK(NewPassword);

   if (SetAdmin) {
     Ret = OpalUtilSetAdminPassword(Session, OldPassword, OldPasswordLength, NewPassword, NewPasswordLength);
   } else {
     Ret = OpalUtilSetUserPassword(Session, OldPassword, OldPasswordLength, NewPassword, NewPasswordLength);
   }
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, NewPasswordLength, NewPassword);
   }

   return Ret;
 }

 /**
   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      Password           Admin password
   @param[in]      PasswordLength     Length of password in bytes
   @param[out]     PasswordFailed     Indicates if password failed (start session didn't work)
   @param[in]      DevicePath         The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportDisableUser(
   IN  OPAL_SESSION              *Session,
   IN  VOID                      *Password,
   IN  UINT32                    PasswordLength,
   OUT BOOLEAN                   *PasswordFailed,
   IN  EFI_DEVICE_PATH_PROTOCOL  *DevicePath
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Password);
   NULL_CHECK(PasswordFailed);

   Ret = OpalUtilDisableUser(Session, Password, PasswordLength, PasswordFailed);
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, PasswordLength, Password);
   }

   return Ret;
 }

 /**
   Enable Opal Feature for the input device.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      Msid               Msid
   @param[in]      MsidLength         Msid Length
   @param[in]      Password           Admin password
   @param[in]      PassLength         Length of password in bytes
   @param[in]      DevicePath         The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportEnableOpalFeature (
   IN OPAL_SESSION              *Session,
   IN VOID                      *Msid,
   IN UINT32                    MsidLength,
   IN VOID                      *Password,
   IN UINT32                    PassLength,
   IN EFI_DEVICE_PATH_PROTOCOL  *DevicePath
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Msid);
   NULL_CHECK(Password);

   Ret = OpalUtilSetAdminPasswordAsSid(
                           Session,
                           Msid,
                           MsidLength,
                           Password,
                           PassLength
                           );
   if (Ret == TcgResultSuccess) {
     //
     // Enable global locking range
     //
     Ret = OpalUtilSetOpalLockingRange(
                               Session,
                               Password,
                               PassLength,
                               OPAL_LOCKING_SP_LOCKING_GLOBALRANGE,
                               0,
                               0,
                               TRUE,
                               TRUE,
                               FALSE,
                               FALSE
                               );
   }

   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, PassLength, Password);
   }

   return Ret;
 }

 /**
   Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      KeepUserData       TRUE to keep existing Data on the disk, or FALSE to erase it
   @param[in]      Password           Admin password
   @param[in]      PasswordLength     Length of password in bytes
   @param[in]      Msid               Msid
   @param[in]      MsidLength         Msid Length
   @param[out]     PasswordFailed     indicates if password failed (start session didn't work)
   @param[in]      DevicePath         The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportRevert(
   IN  OPAL_SESSION              *Session,
   IN  BOOLEAN                   KeepUserData,
   IN  VOID                      *Password,
   IN  UINT32                    PasswordLength,
   IN  VOID                      *Msid,
   IN  UINT32                    MsidLength,
   OUT BOOLEAN                   *PasswordFailed,
   IN  EFI_DEVICE_PATH_PROTOCOL  *DevicePath
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Password);
   NULL_CHECK(Msid);
   NULL_CHECK(PasswordFailed);

   Ret = OpalUtilRevert(Session, KeepUserData, Password, PasswordLength, PasswordFailed, Msid, MsidLength);
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, 0, NULL);
   }

   return Ret;
 }

 /**
   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
   and updates the global locking range ReadLocked and WriteLocked columns to FALSE.

   @param[in]      Session            The opal session for the opal device.
   @param[in]      Password           Admin or user password
   @param[in]      PasswordLength     Length of password in bytes
   @param[in]      DevicePath         The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportUnlock(
   IN OPAL_SESSION               *Session,
   IN VOID                       *Password,
   IN UINT32                     PasswordLength,
   IN EFI_DEVICE_PATH_PROTOCOL   *DevicePath
   )
 {
   TCG_RESULT   Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Password);

   Ret = OpalUtilUpdateGlobalLockingRange(Session, Password, PasswordLength, FALSE, FALSE);
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, PasswordLength, Password);
   }

   return Ret;
 }

 /**
   Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
   and updates the global locking range ReadLocked and WriteLocked columns to TRUE.

   @param[in]      Session             The opal session for the opal device.
   @param[in]      Password            Admin or user password
   @param[in]      PasswordLength      Length of password in bytes
   @param[in]      DevicePath          The device path for the opal devcie.

 **/
 TCG_RESULT
 EFIAPI
 OpalSupportLock(
   IN OPAL_SESSION               *Session,
   IN VOID                       *Password,
   IN UINT32                     PasswordLength,
   IN EFI_DEVICE_PATH_PROTOCOL   *DevicePath
   )
 {
   TCG_RESULT  Ret;

   NULL_CHECK(Session);
   NULL_CHECK(Password);

   Ret = OpalUtilUpdateGlobalLockingRange(Session, Password, PasswordLength, TRUE, TRUE);
   if (Ret == TcgResultSuccess && !gInSmm) {
     OpalSupportSendPasword (DevicePath, PasswordLength, Password);
   }

   return Ret;
 }

 /**
   Initialize the communicate Buffer using DataSize and Function.

   @param[out]      DataPtr          Points to the Data in the communicate Buffer.
   @param[in]       DataSize         The Data Size to send to SMM.
   @param[in]       Function         The function number to initialize the communicate Header.

   @retval EFI_INVALID_PARAMETER     The Data Size is too big.
   @retval EFI_SUCCESS               Find the specified variable.

 **/
 VOID*
 OpalInitCommunicateBuffer (
   OUT     VOID                              **DataPtr OPTIONAL,
   IN      UINTN                             DataSize,
   IN      UINTN                             Function
   )
 {
   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
   OPAL_SMM_COMMUNICATE_HEADER               *SmmFunctionHeader;
   VOID                                      *Buffer;
   EDKII_PI_SMM_COMMUNICATION_REGION_TABLE   *SmmCommRegionTable;
   EFI_MEMORY_DESCRIPTOR                     *SmmCommMemRegion;
   UINTN                                     Index;
   UINTN                                     Size;
   EFI_STATUS                                Status;

   Buffer = NULL;
   Status = EfiGetSystemConfigurationTable (
              &gEdkiiPiSmmCommunicationRegionTableGuid,
              (VOID **) &SmmCommRegionTable
              );
   if (EFI_ERROR (Status)) {
     return NULL;
   }

   ASSERT (SmmCommRegionTable != NULL);
   SmmCommMemRegion = (EFI_MEMORY_DESCRIPTOR *) (SmmCommRegionTable + 1);
   Size = 0;
   for (Index = 0; Index < SmmCommRegionTable->NumberOfEntries; Index++) {
     if (SmmCommMemRegion->Type == EfiConventionalMemory) {
       Size = EFI_PAGES_TO_SIZE ((UINTN) SmmCommMemRegion->NumberOfPages);
       if (Size >= (DataSize + OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data))) {
         break;
       }
     }
     SmmCommMemRegion = (EFI_MEMORY_DESCRIPTOR *) ((UINT8 *) SmmCommMemRegion + SmmCommRegionTable->DescriptorSize);
   }
   ASSERT (Index < SmmCommRegionTable->NumberOfEntries);

   Buffer = (VOID*)(UINTN)SmmCommMemRegion->PhysicalStart;
   ASSERT (Buffer != NULL);

   SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) Buffer;
   CopyGuid (&SmmCommunicateHeader->HeaderGuid, &gOpalPasswordNotifyProtocolGuid);
   SmmCommunicateHeader->MessageLength = DataSize + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data);

   SmmFunctionHeader = (OPAL_SMM_COMMUNICATE_HEADER *) SmmCommunicateHeader->Data;
   SmmFunctionHeader->Function = Function;
   if (DataPtr != NULL) {
     *DataPtr = SmmFunctionHeader->Data;
   }

   return Buffer;
 }

 /**
   Send the Data in communicate Buffer to SMM.

   @param[in]   Buffer                 Points to the Data in the communicate Buffer.
   @param[in]   DataSize               This Size of the function Header and the Data.

   @retval      EFI_SUCCESS            Success is returned from the functin in SMM.
   @retval      Others                 Failure is returned from the function in SMM.

 **/
 EFI_STATUS
 OpalSendCommunicateBuffer (
   IN      VOID                              *Buffer,
   IN      UINTN                             DataSize
   )
 {
   EFI_STATUS                                Status;
   UINTN                                     CommSize;
   EFI_SMM_COMMUNICATE_HEADER                *SmmCommunicateHeader;
   OPAL_SMM_COMMUNICATE_HEADER               *SmmFunctionHeader;
   EFI_SMM_COMMUNICATION_PROTOCOL            *SmmCommunication;

   Status = gBS->LocateProtocol (&gEfiSmmCommunicationProtocolGuid, NULL, (VOID **) &SmmCommunication);
   if (EFI_ERROR (Status)) {
     return Status;
   }

   CommSize = DataSize + OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data);
   Status = SmmCommunication->Communicate (SmmCommunication, Buffer, &CommSize);
   if (EFI_ERROR (Status)) {
     return Status;
   }

   SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) Buffer;
   SmmFunctionHeader    = (OPAL_SMM_COMMUNICATE_HEADER *)SmmCommunicateHeader->Data;

   return  SmmFunctionHeader->ReturnStatus;
 }

 /**
   Transfer the password to the smm driver.

   @param[in]  DevicePath     The device path for the opal devcie.
   @param      PasswordLen    The input password length.
   @param      Password       Input password buffer.

   @retval  EFI_SUCCESS       Do the required action success.
   @retval  Others            Error occured.

 **/
 EFI_STATUS
 EFIAPI
 OpalSupportSendPasword(
   EFI_DEVICE_PATH_PROTOCOL    *DevicePath,
   UINTN                       PasswordLen,
   VOID                        *Password
   )
 {
   OPAL_COMM_DEVICE_LIST   *Parameter;
   VOID                    *Buffer;
   UINTN                   Length;
   EFI_STATUS              Status;
   UINTN                   DevicePathLen;

   Parameter = NULL;
   Buffer = NULL;

   if (DevicePath == NULL) {
     //
     // Assume DevicePath == NULL only when library used by SMM driver
     // and should not run to here, just return success.
     //
     return EFI_SUCCESS;
   }

   DevicePathLen = GetDevicePathSize (DevicePath);
   Length = OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath) + DevicePathLen;
   Buffer = OpalInitCommunicateBuffer((VOID**)&Parameter, Length, SMM_FUNCTION_SET_OPAL_PASSWORD);
   if (Buffer == NULL) {
     return EFI_OUT_OF_RESOURCES;
   }

   if (Password != NULL) {
     CopyMem((VOID*)Parameter->Password, Password, PasswordLen);
     Parameter->PasswordLength = (UINT8)PasswordLen;
   }
   CopyMem (&Parameter->OpalDevicePath, DevicePath, DevicePathLen);

   Status = OpalSendCommunicateBuffer(Buffer, Length);
   if (EFI_ERROR(Status)) {
     goto EXIT;
   }

 EXIT:
   ZeroMem(Parameter, Length);
   return Status;
 }

 /**
   Get saved Opal device list.

   @retval      return opal device list.

 **/
 LIST_ENTRY*
 EFIAPI
 OpalSupportGetOpalDeviceList (
   VOID
   )
 {
   return &mDeviceList;
 }

 /**
   Check if the password is full zero.

   @param[in]   Password       Points to the Data Buffer

   @retval      TRUE           This password string is full zero.
   @retval      FALSE          This password string is not full zero.

 **/
 BOOLEAN
 OpalPasswordIsFullZero (
   IN UINT8                    *Password
   )
 {
   UINTN                       Index;

   for (Index = 0; Index < OPAL_PASSWORD_MAX_LENGTH; Index++) {
     if (Password[Index] != 0) {
       return FALSE;
     }
   }

   return TRUE;
 }

 /**
   Save hdd password to SMM.

   @param[in] DevicePath                Input device path info for the device.
   @param[in] Password                  The hdd password of attached ATA device.
   @param[in] PasswordLength            The hdd password length.

   @retval EFI_OUT_OF_RESOURCES    Insufficient resources to create database record
   @retval EFI_SUCCESS             The function has been successfully executed.

 **/
 EFI_STATUS
 OpalSavePasswordToSmm (
   IN  EFI_DEVICE_PATH_PROTOCOL      *DevicePath,
   IN  UINT8                         *Password,
   IN  UINT8                         PasswordLength
   )
 {
   OPAL_DISK_AND_PASSWORD_INFO       *List;
   OPAL_DISK_AND_PASSWORD_INFO       *Dev;
   LIST_ENTRY                        *Entry;
   UINTN                             DevicePathLen;

   DevicePathLen = GetDevicePathSize (DevicePath);

   for (Entry = mDeviceList.ForwardLink; Entry != &mDeviceList; Entry = Entry->ForwardLink) {
     List = BASE_CR (Entry, OPAL_DISK_AND_PASSWORD_INFO, Link);
     if (CompareMem (&List->OpalDevicePath, DevicePath, DevicePathLen) == 0) {
       CopyMem(List->Password, Password, OPAL_PASSWORD_MAX_LENGTH);
       return EFI_SUCCESS;
     }
   }

   Dev = AllocateZeroPool (OFFSET_OF (OPAL_DISK_AND_PASSWORD_INFO, OpalDevicePath) + DevicePathLen);
   if (Dev == NULL) {
     return EFI_OUT_OF_RESOURCES;
   }

   Dev->PasswordLength = PasswordLength;
   CopyMem(&(Dev->Password), Password, OPAL_PASSWORD_MAX_LENGTH);
   CopyMem(&(Dev->OpalDevicePath), DevicePath, DevicePathLen);

   InsertHeadList (&mDeviceList, &Dev->Link);

   return EFI_SUCCESS;
 }

 /**
   Communication service SMI Handler entry.

   This SMI handler provides services for saving HDD password and saving S3 boot script when ready to boot.

   @param[in]     DispatchHandle  The unique handle assigned to this handler by SmiHandlerRegister().
   @param[in]     RegisterContext Points to an optional handler context which was specified when the
                                  handler was registered.
   @param[in, out] CommBuffer     A pointer to a collection of Data in memory that will
                                  be conveyed from a non-SMM environment into an SMM environment.
   @param[in, out] CommBufferSize The Size of the CommBuffer.

   @retval EFI_SUCCESS                         The interrupt was handled and quiesced. No other handlers
                                               should still be called.
   @retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED  The interrupt has been quiesced but other handlers should
                                               still be called.
   @retval EFI_WARN_INTERRUPT_SOURCE_PENDING   The interrupt is still pending and other handlers should still
                                               be called.
   @retval EFI_INTERRUPT_PENDING               The interrupt could not be quiesced.
 **/
 EFI_STATUS
 EFIAPI
 SmmOpalPasswordHandler (
   IN     EFI_HANDLE                 DispatchHandle,
   IN     CONST VOID                 *RegisterContext,
   IN OUT VOID                       *CommBuffer,
   IN OUT UINTN                      *CommBufferSize
   )
 {
   EFI_STATUS                        Status;
   OPAL_SMM_COMMUNICATE_HEADER       *SmmFunctionHeader;
   UINTN                             TempCommBufferSize;
   UINTN                             RemainedDevicePathSize;
   OPAL_COMM_DEVICE_LIST             *DeviceBuffer;

   if (CommBuffer == NULL || CommBufferSize == NULL) {
     return EFI_SUCCESS;
   }

   Status = EFI_SUCCESS;
   DeviceBuffer = NULL;

   TempCommBufferSize = *CommBufferSize;
   if (TempCommBufferSize < OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data)) {
     return EFI_SUCCESS;
   }
   SmmFunctionHeader = (OPAL_SMM_COMMUNICATE_HEADER *)CommBuffer;

   switch (SmmFunctionHeader->Function) {
     case SMM_FUNCTION_SET_OPAL_PASSWORD:
       if (TempCommBufferSize <= OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath)) {
         return EFI_SUCCESS;
       }

       DeviceBuffer = AllocateCopyPool (TempCommBufferSize - OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data), SmmFunctionHeader->Data);
       if (DeviceBuffer == NULL) {
         Status = EFI_OUT_OF_RESOURCES;
         goto EXIT;
       }

       //
       // Validate the DevicePath.
       //
       RemainedDevicePathSize = TempCommBufferSize - OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data)
                                     - OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath);
       if (!IsDevicePathValid(&DeviceBuffer->OpalDevicePath, RemainedDevicePathSize) ||
           (RemainedDevicePathSize != GetDevicePathSize (&DeviceBuffer->OpalDevicePath))) {
         Status = EFI_SUCCESS;
         goto EXIT;
       }

       if (OpalPasswordIsFullZero (DeviceBuffer->Password) ||
           DeviceBuffer->PasswordLength == 0 ||
           DeviceBuffer->PasswordLength > OPAL_PASSWORD_MAX_LENGTH) {
         Status = EFI_INVALID_PARAMETER;
         goto EXIT;
       }
       //
       // The AsmLfence() call here is to ensure the above range checks for the
       // CommBuffer have been completed before calling into OpalSavePasswordToSmm().
       //
       AsmLfence ();

       Status = OpalSavePasswordToSmm (&DeviceBuffer->OpalDevicePath, DeviceBuffer->Password, DeviceBuffer->PasswordLength);
       break;

     default:
       Status = EFI_UNSUPPORTED;
       break;
   }

 EXIT:
   SmmFunctionHeader->ReturnStatus = Status;

   if (DeviceBuffer != NULL) {
     FreePool (DeviceBuffer);
   }

   //
   // Return EFI_SUCCESS cause only one handler can be trigged.
   // so return EFI_WARN_INTERRUPT_SOURCE_PENDING to make all handler can be trigged.
   //
   return EFI_WARN_INTERRUPT_SOURCE_PENDING;
 }

 /**
   The constructor function.

   Register SMI handler when link to SMM driver.

   @retval EFI_SUCCESS   The constructor always returns EFI_SUCCESS.

 **/
 EFI_STATUS
 EFIAPI
 OpalPasswordSupportLibConstructor (
   VOID
   )
 {
   EFI_SMM_BASE2_PROTOCOL         *SmmBase2;
   EFI_SMM_SYSTEM_TABLE2          *Smst;
   EFI_HANDLE                     SmmHandle;
   EFI_STATUS                     Status;

   Status = gBS->LocateProtocol (&gEfiSmmBase2ProtocolGuid, NULL, (VOID**) &SmmBase2);
   if (EFI_ERROR (Status)) {
     return RETURN_SUCCESS;
   }
   Status = SmmBase2->InSmm (SmmBase2, &gInSmm);
   if (EFI_ERROR (Status)) {
     return RETURN_SUCCESS;
   }
   if (!gInSmm) {
     return RETURN_SUCCESS;
   }

   //
   // Good, we are in SMM
   //
   Status = SmmBase2->GetSmstLocation (SmmBase2, &Smst);
   if (EFI_ERROR (Status)) {
     return RETURN_SUCCESS;
   }

   SmmHandle = NULL;
   Status    = Smst->SmiHandlerRegister (SmmOpalPasswordHandler, &gOpalPasswordNotifyProtocolGuid, &SmmHandle);
   ASSERT_EFI_ERROR (Status);

   return EFI_SUCCESS;
 }

 /**
   The Destructor function.

   Clean the saved opal device list.

   @retval EFI_SUCCESS   The constructor always returns EFI_SUCCESS.

 **/
 EFI_STATUS
 EFIAPI
 OpalPasswordSupportLibDestructor (
   VOID
   )
 {
   OPAL_DISK_AND_PASSWORD_INFO  *Device;

   while (!IsListEmpty (&mDeviceList)) {
     Device = BASE_CR (mDeviceList.ForwardLink, OPAL_DISK_AND_PASSWORD_INFO, Link);

     RemoveEntryList (&Device->Link);
     FreePool (Device);
   }

   return EFI_SUCCESS;
 }
	/** @file
	Implementation of Opal password support library.

	Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
	This program and the accompanying materials
	are licensed and made available under the terms and conditions of the BSD License
	which accompanies this distribution. The full text of the license may be found at
	http://opensource.org/licenses/bsd-license.php

	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

	**/

	#include "OpalPasswordSupportNotify.h"

	LIST_ENTRY mDeviceList = INITIALIZE_LIST_HEAD_VARIABLE (mDeviceList);
	BOOLEAN gInSmm = FALSE;
	EFI_GUID gOpalPasswordNotifyProtocolGuid = OPAL_PASSWORD_NOTIFY_PROTOCOL_GUID;

	/**

	The function performs determines the available actions for the OPAL_DISK provided.

	@param[in] SupportedAttributes The support attribute for the device.
	@param[in] LockingFeature The locking status for the device.
	@param[in] OwnerShip The ownership for the device.
	@param[out] AvalDiskActions Pointer to fill-out with appropriate disk actions.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportGetAvailableActions(
	IN OPAL_DISK_SUPPORT_ATTRIBUTE *SupportedAttributes,
	IN TCG_LOCKING_FEATURE_DESCRIPTOR *LockingFeature,
	IN UINT16 OwnerShip,
	OUT OPAL_DISK_ACTIONS *AvalDiskActions
	)
	{
	BOOLEAN ExistingPassword;

	NULL_CHECK(AvalDiskActions);

	AvalDiskActions->AdminPass = 1;
	AvalDiskActions->UserPass = 0;
	AvalDiskActions->DisableUser = 0;
	AvalDiskActions->Unlock = 0;

	//
	// Revert is performed on locking sp, so only allow if locking sp is enabled
	//
	if (LockingFeature->LockingEnabled) {
	AvalDiskActions->Revert = 1;
	}

	//
	// Psid revert is available for any device with media encryption support
	// Revert is allowed for any device with media encryption support, however it requires
	//
	if (SupportedAttributes->MediaEncryption) {

	//
	// Only allow psid revert if media encryption is enabled.
	// Otherwise, someone who steals a disk can psid revert the disk and the user Data is still
	// intact and accessible
	//
	AvalDiskActions->PsidRevert = 1;
	AvalDiskActions->RevertKeepDataForced = 0;

	//
	// Secure erase is performed by generating a new encryption key
	// this is only available is encryption is supported
	//
	AvalDiskActions->SecureErase = 1;
	} else {
	AvalDiskActions->PsidRevert = 0;
	AvalDiskActions->SecureErase = 0;

	//
	// If no media encryption is supported, then a revert (using password) will not
	// erase the Data (since you can't generate a new encryption key)
	//
	AvalDiskActions->RevertKeepDataForced = 1;
	}

	if (LockingFeature->Locked) {
	AvalDiskActions->Unlock = 1;
	} else {
	AvalDiskActions->Unlock = 0;
	}

	//
	// Only allow user to set password if an admin password exists
	//
	ExistingPassword = OpalUtilAdminPasswordExists(OwnerShip, LockingFeature);
	AvalDiskActions->UserPass = ExistingPassword;

	//
	// This will still show up even if there isn't a user, which is fine
	//
	AvalDiskActions->DisableUser = ExistingPassword;

	return TcgResultSuccess;
	}

	/**
	Creates a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts device using Admin SP Revert method.

	@param[in] Session The opal session for the opal device.
	@param[in] Psid PSID of device to revert.
	@param[in] PsidLength Length of PSID in bytes.
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportPsidRevert(
	IN OPAL_SESSION *Session,
	IN VOID *Psid,
	IN UINT32 PsidLength,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Psid);

	Ret = OpalUtilPsidRevert (Session, Psid, PsidLength);
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, 0, NULL);
	}

	return Ret;
	}

	/**
	Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_SID_AUTHORITY,
	sets OPAL_UID_ADMIN_SP_C_PIN_SID with the new password,
	and sets OPAL_LOCKING_SP_C_PIN_ADMIN1 with the new password.

	@param[in] Session The opal session for the opal device.
	@param[in] OldPassword Current admin password
	@param[in] OldPasswordLength Length of current admin password in bytes
	@param[in] NewPassword New admin password to set
	@param[in] NewPasswordLength Length of new password in bytes
	@param[in] DevicePath The device path for the opal devcie.
	@param[in] SetAdmin Whether set admin password or user password.
	TRUE for admin, FALSE for user.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportSetPassword(
	IN OPAL_SESSION *Session,
	IN VOID *OldPassword,
	IN UINT32 OldPasswordLength,
	IN VOID *NewPassword,
	IN UINT32 NewPasswordLength,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath,
	IN BOOLEAN SetAdmin
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(OldPassword);
	NULL_CHECK(NewPassword);

	if (SetAdmin) {
	Ret = OpalUtilSetAdminPassword(Session, OldPassword, OldPasswordLength, NewPassword, NewPasswordLength);
	} else {
	Ret = OpalUtilSetUserPassword(Session, OldPassword, OldPasswordLength, NewPassword, NewPasswordLength);
	}
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, NewPasswordLength, NewPassword);
	}

	return Ret;
	}

	/**
	Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_ADMIN1_AUTHORITY and disables the User1 authority.

	@param[in] Session The opal session for the opal device.
	@param[in] Password Admin password
	@param[in] PasswordLength Length of password in bytes
	@param[out] PasswordFailed Indicates if password failed (start session didn't work)
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportDisableUser(
	IN OPAL_SESSION *Session,
	IN VOID *Password,
	IN UINT32 PasswordLength,
	OUT BOOLEAN *PasswordFailed,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Password);
	NULL_CHECK(PasswordFailed);

	Ret = OpalUtilDisableUser(Session, Password, PasswordLength, PasswordFailed);
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, PasswordLength, Password);
	}

	return Ret;
	}

	/**
	Enable Opal Feature for the input device.

	@param[in] Session The opal session for the opal device.
	@param[in] Msid Msid
	@param[in] MsidLength Msid Length
	@param[in] Password Admin password
	@param[in] PassLength Length of password in bytes
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportEnableOpalFeature (
	IN OPAL_SESSION *Session,
	IN VOID *Msid,
	IN UINT32 MsidLength,
	IN VOID *Password,
	IN UINT32 PassLength,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Msid);
	NULL_CHECK(Password);

	Ret = OpalUtilSetAdminPasswordAsSid(
	Session,
	Msid,
	MsidLength,
	Password,
	PassLength
	);
	if (Ret == TcgResultSuccess) {
	//
	// Enable global locking range
	//
	Ret = OpalUtilSetOpalLockingRange(
	Session,
	Password,
	PassLength,
	OPAL_LOCKING_SP_LOCKING_GLOBALRANGE,
	0,
	0,
	TRUE,
	TRUE,
	FALSE,
	FALSE
	);
	}

	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, PassLength, Password);
	}

	return Ret;
	}

	/**
	Opens a session with OPAL_UID_ADMIN_SP as OPAL_ADMIN_SP_PSID_AUTHORITY, then reverts the device using the RevertSP method.

	@param[in] Session The opal session for the opal device.
	@param[in] KeepUserData TRUE to keep existing Data on the disk, or FALSE to erase it
	@param[in] Password Admin password
	@param[in] PasswordLength Length of password in bytes
	@param[in] Msid Msid
	@param[in] MsidLength Msid Length
	@param[out] PasswordFailed indicates if password failed (start session didn't work)
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportRevert(
	IN OPAL_SESSION *Session,
	IN BOOLEAN KeepUserData,
	IN VOID *Password,
	IN UINT32 PasswordLength,
	IN VOID *Msid,
	IN UINT32 MsidLength,
	OUT BOOLEAN *PasswordFailed,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Password);
	NULL_CHECK(Msid);
	NULL_CHECK(PasswordFailed);

	Ret = OpalUtilRevert(Session, KeepUserData, Password, PasswordLength, PasswordFailed, Msid, MsidLength);
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, 0, NULL);
	}

	return Ret;
	}

	/**
	Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
	and updates the global locking range ReadLocked and WriteLocked columns to FALSE.

	@param[in] Session The opal session for the opal device.
	@param[in] Password Admin or user password
	@param[in] PasswordLength Length of password in bytes
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportUnlock(
	IN OPAL_SESSION *Session,
	IN VOID *Password,
	IN UINT32 PasswordLength,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Password);

	Ret = OpalUtilUpdateGlobalLockingRange(Session, Password, PasswordLength, FALSE, FALSE);
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, PasswordLength, Password);
	}

	return Ret;
	}

	/**
	Starts a session with OPAL_UID_LOCKING_SP as OPAL_LOCKING_SP_USER1_AUTHORITY or OPAL_LOCKING_SP_ADMIN1_AUTHORITY
	and updates the global locking range ReadLocked and WriteLocked columns to TRUE.

	@param[in] Session The opal session for the opal device.
	@param[in] Password Admin or user password
	@param[in] PasswordLength Length of password in bytes
	@param[in] DevicePath The device path for the opal devcie.

	**/
	TCG_RESULT
	EFIAPI
	OpalSupportLock(
	IN OPAL_SESSION *Session,
	IN VOID *Password,
	IN UINT32 PasswordLength,
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath
	)
	{
	TCG_RESULT Ret;

	NULL_CHECK(Session);
	NULL_CHECK(Password);

	Ret = OpalUtilUpdateGlobalLockingRange(Session, Password, PasswordLength, TRUE, TRUE);
	if (Ret == TcgResultSuccess && !gInSmm) {
	OpalSupportSendPasword (DevicePath, PasswordLength, Password);
	}

	return Ret;
	}

	/**
	Initialize the communicate Buffer using DataSize and Function.

	@param[out] DataPtr Points to the Data in the communicate Buffer.
	@param[in] DataSize The Data Size to send to SMM.
	@param[in] Function The function number to initialize the communicate Header.

	@retval EFI_INVALID_PARAMETER The Data Size is too big.
	@retval EFI_SUCCESS Find the specified variable.

	**/
	VOID*
	OpalInitCommunicateBuffer (
	OUT VOID **DataPtr OPTIONAL,
	IN UINTN DataSize,
	IN UINTN Function
	)
	{
	EFI_SMM_COMMUNICATE_HEADER *SmmCommunicateHeader;
	OPAL_SMM_COMMUNICATE_HEADER *SmmFunctionHeader;
	VOID *Buffer;
	EDKII_PI_SMM_COMMUNICATION_REGION_TABLE *SmmCommRegionTable;
	EFI_MEMORY_DESCRIPTOR *SmmCommMemRegion;
	UINTN Index;
	UINTN Size;
	EFI_STATUS Status;

	Buffer = NULL;
	Status = EfiGetSystemConfigurationTable (
	&gEdkiiPiSmmCommunicationRegionTableGuid,
	(VOID **) &SmmCommRegionTable
	);
	if (EFI_ERROR (Status)) {
	return NULL;
	}

	ASSERT (SmmCommRegionTable != NULL);
	SmmCommMemRegion = (EFI_MEMORY_DESCRIPTOR *) (SmmCommRegionTable + 1);
	Size = 0;
	for (Index = 0; Index < SmmCommRegionTable->NumberOfEntries; Index++) {
	if (SmmCommMemRegion->Type == EfiConventionalMemory) {
	Size = EFI_PAGES_TO_SIZE ((UINTN) SmmCommMemRegion->NumberOfPages);
	if (Size >= (DataSize + OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data))) {
	break;
	}
	}
	SmmCommMemRegion = (EFI_MEMORY_DESCRIPTOR ) ((UINT8 ) SmmCommMemRegion + SmmCommRegionTable->DescriptorSize);
	}
	ASSERT (Index < SmmCommRegionTable->NumberOfEntries);

	Buffer = (VOID*)(UINTN)SmmCommMemRegion->PhysicalStart;
	ASSERT (Buffer != NULL);

	SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) Buffer;
	CopyGuid (&SmmCommunicateHeader->HeaderGuid, &gOpalPasswordNotifyProtocolGuid);
	SmmCommunicateHeader->MessageLength = DataSize + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data);

	SmmFunctionHeader = (OPAL_SMM_COMMUNICATE_HEADER *) SmmCommunicateHeader->Data;
	SmmFunctionHeader->Function = Function;
	if (DataPtr != NULL) {
	*DataPtr = SmmFunctionHeader->Data;
	}

	return Buffer;
	}

	/**
	Send the Data in communicate Buffer to SMM.

	@param[in] Buffer Points to the Data in the communicate Buffer.
	@param[in] DataSize This Size of the function Header and the Data.

	@retval EFI_SUCCESS Success is returned from the functin in SMM.
	@retval Others Failure is returned from the function in SMM.

	**/
	EFI_STATUS
	OpalSendCommunicateBuffer (
	IN VOID *Buffer,
	IN UINTN DataSize
	)
	{
	EFI_STATUS Status;
	UINTN CommSize;
	EFI_SMM_COMMUNICATE_HEADER *SmmCommunicateHeader;
	OPAL_SMM_COMMUNICATE_HEADER *SmmFunctionHeader;
	EFI_SMM_COMMUNICATION_PROTOCOL *SmmCommunication;

	Status = gBS->LocateProtocol (&gEfiSmmCommunicationProtocolGuid, NULL, (VOID **) &SmmCommunication);
	if (EFI_ERROR (Status)) {
	return Status;
	}

	CommSize = DataSize + OFFSET_OF (EFI_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data);
	Status = SmmCommunication->Communicate (SmmCommunication, Buffer, &CommSize);
	if (EFI_ERROR (Status)) {
	return Status;
	}

	SmmCommunicateHeader = (EFI_SMM_COMMUNICATE_HEADER *) Buffer;
	SmmFunctionHeader = (OPAL_SMM_COMMUNICATE_HEADER *)SmmCommunicateHeader->Data;

	return SmmFunctionHeader->ReturnStatus;
	}

	/**
	Transfer the password to the smm driver.

	@param[in] DevicePath The device path for the opal devcie.
	@param PasswordLen The input password length.
	@param Password Input password buffer.

	@retval EFI_SUCCESS Do the required action success.
	@retval Others Error occured.

	**/
	EFI_STATUS
	EFIAPI
	OpalSupportSendPasword(
	EFI_DEVICE_PATH_PROTOCOL *DevicePath,
	UINTN PasswordLen,
	VOID *Password
	)
	{
	OPAL_COMM_DEVICE_LIST *Parameter;
	VOID *Buffer;
	UINTN Length;
	EFI_STATUS Status;
	UINTN DevicePathLen;

	Parameter = NULL;
	Buffer = NULL;

	if (DevicePath == NULL) {
	//
	// Assume DevicePath == NULL only when library used by SMM driver
	// and should not run to here, just return success.
	//
	return EFI_SUCCESS;
	}

	DevicePathLen = GetDevicePathSize (DevicePath);
	Length = OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath) + DevicePathLen;
	Buffer = OpalInitCommunicateBuffer((VOID**)&Parameter, Length, SMM_FUNCTION_SET_OPAL_PASSWORD);
	if (Buffer == NULL) {
	return EFI_OUT_OF_RESOURCES;
	}

	if (Password != NULL) {
	CopyMem((VOID*)Parameter->Password, Password, PasswordLen);
	Parameter->PasswordLength = (UINT8)PasswordLen;
	}
	CopyMem (&Parameter->OpalDevicePath, DevicePath, DevicePathLen);

	Status = OpalSendCommunicateBuffer(Buffer, Length);
	if (EFI_ERROR(Status)) {
	goto EXIT;
	}

	EXIT:
	ZeroMem(Parameter, Length);
	return Status;
	}

	/**
	Get saved Opal device list.

	@retval return opal device list.

	**/
	LIST_ENTRY*
	EFIAPI
	OpalSupportGetOpalDeviceList (
	VOID
	)
	{
	return &mDeviceList;
	}

	/**
	Check if the password is full zero.

	@param[in] Password Points to the Data Buffer

	@retval TRUE This password string is full zero.
	@retval FALSE This password string is not full zero.

	**/
	BOOLEAN
	OpalPasswordIsFullZero (
	IN UINT8 *Password
	)
	{
	UINTN Index;

	for (Index = 0; Index < OPAL_PASSWORD_MAX_LENGTH; Index++) {
	if (Password[Index] != 0) {
	return FALSE;
	}
	}

	return TRUE;
	}

	/**
	Save hdd password to SMM.

	@param[in] DevicePath Input device path info for the device.
	@param[in] Password The hdd password of attached ATA device.
	@param[in] PasswordLength The hdd password length.

	@retval EFI_OUT_OF_RESOURCES Insufficient resources to create database record
	@retval EFI_SUCCESS The function has been successfully executed.

	**/
	EFI_STATUS
	OpalSavePasswordToSmm (
	IN EFI_DEVICE_PATH_PROTOCOL *DevicePath,
	IN UINT8 *Password,
	IN UINT8 PasswordLength
	)
	{
	OPAL_DISK_AND_PASSWORD_INFO *List;
	OPAL_DISK_AND_PASSWORD_INFO *Dev;
	LIST_ENTRY *Entry;
	UINTN DevicePathLen;

	DevicePathLen = GetDevicePathSize (DevicePath);

	for (Entry = mDeviceList.ForwardLink; Entry != &mDeviceList; Entry = Entry->ForwardLink) {
	List = BASE_CR (Entry, OPAL_DISK_AND_PASSWORD_INFO, Link);
	if (CompareMem (&List->OpalDevicePath, DevicePath, DevicePathLen) == 0) {
	CopyMem(List->Password, Password, OPAL_PASSWORD_MAX_LENGTH);
	return EFI_SUCCESS;
	}
	}

	Dev = AllocateZeroPool (OFFSET_OF (OPAL_DISK_AND_PASSWORD_INFO, OpalDevicePath) + DevicePathLen);
	if (Dev == NULL) {
	return EFI_OUT_OF_RESOURCES;
	}

	Dev->PasswordLength = PasswordLength;
	CopyMem(&(Dev->Password), Password, OPAL_PASSWORD_MAX_LENGTH);
	CopyMem(&(Dev->OpalDevicePath), DevicePath, DevicePathLen);

	InsertHeadList (&mDeviceList, &Dev->Link);

	return EFI_SUCCESS;
	}

	/**
	Communication service SMI Handler entry.

	This SMI handler provides services for saving HDD password and saving S3 boot script when ready to boot.

	@param[in] DispatchHandle The unique handle assigned to this handler by SmiHandlerRegister().
	@param[in] RegisterContext Points to an optional handler context which was specified when the
	handler was registered.
	@param[in, out] CommBuffer A pointer to a collection of Data in memory that will
	be conveyed from a non-SMM environment into an SMM environment.
	@param[in, out] CommBufferSize The Size of the CommBuffer.

	@retval EFI_SUCCESS The interrupt was handled and quiesced. No other handlers
	should still be called.
	@retval EFI_WARN_INTERRUPT_SOURCE_QUIESCED The interrupt has been quiesced but other handlers should
	still be called.
	@retval EFI_WARN_INTERRUPT_SOURCE_PENDING The interrupt is still pending and other handlers should still
	be called.
	@retval EFI_INTERRUPT_PENDING The interrupt could not be quiesced.
	**/
	EFI_STATUS
	EFIAPI
	SmmOpalPasswordHandler (
	IN EFI_HANDLE DispatchHandle,
	IN CONST VOID *RegisterContext,
	IN OUT VOID *CommBuffer,
	IN OUT UINTN *CommBufferSize
	)
	{
	EFI_STATUS Status;
	OPAL_SMM_COMMUNICATE_HEADER *SmmFunctionHeader;
	UINTN TempCommBufferSize;
	UINTN RemainedDevicePathSize;
	OPAL_COMM_DEVICE_LIST *DeviceBuffer;

	if (CommBuffer == NULL \|\| CommBufferSize == NULL) {
	return EFI_SUCCESS;
	}

	Status = EFI_SUCCESS;
	DeviceBuffer = NULL;

	TempCommBufferSize = *CommBufferSize;
	if (TempCommBufferSize < OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data)) {
	return EFI_SUCCESS;
	}
	SmmFunctionHeader = (OPAL_SMM_COMMUNICATE_HEADER *)CommBuffer;

	switch (SmmFunctionHeader->Function) {
	case SMM_FUNCTION_SET_OPAL_PASSWORD:
	if (TempCommBufferSize <= OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data) + OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath)) {
	return EFI_SUCCESS;
	}

	DeviceBuffer = AllocateCopyPool (TempCommBufferSize - OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data), SmmFunctionHeader->Data);
	if (DeviceBuffer == NULL) {
	Status = EFI_OUT_OF_RESOURCES;
	goto EXIT;
	}

	//
	// Validate the DevicePath.
	//
	RemainedDevicePathSize = TempCommBufferSize - OFFSET_OF (OPAL_SMM_COMMUNICATE_HEADER, Data)
	- OFFSET_OF (OPAL_COMM_DEVICE_LIST, OpalDevicePath);
	if (!IsDevicePathValid(&DeviceBuffer->OpalDevicePath, RemainedDevicePathSize) \|\|
	(RemainedDevicePathSize != GetDevicePathSize (&DeviceBuffer->OpalDevicePath))) {
	Status = EFI_SUCCESS;
	goto EXIT;
	}

	if (OpalPasswordIsFullZero (DeviceBuffer->Password) \|\|
	DeviceBuffer->PasswordLength == 0 \|\|
	DeviceBuffer->PasswordLength > OPAL_PASSWORD_MAX_LENGTH) {
	Status = EFI_INVALID_PARAMETER;
	goto EXIT;
	}
	//
	// The AsmLfence() call here is to ensure the above range checks for the
	// CommBuffer have been completed before calling into OpalSavePasswordToSmm().
	//
	AsmLfence ();

	Status = OpalSavePasswordToSmm (&DeviceBuffer->OpalDevicePath, DeviceBuffer->Password, DeviceBuffer->PasswordLength);
	break;

	default:
	Status = EFI_UNSUPPORTED;
	break;
	}

	EXIT:
	SmmFunctionHeader->ReturnStatus = Status;

	if (DeviceBuffer != NULL) {
	FreePool (DeviceBuffer);
	}

	//
	// Return EFI_SUCCESS cause only one handler can be trigged.
	// so return EFI_WARN_INTERRUPT_SOURCE_PENDING to make all handler can be trigged.
	//
	return EFI_WARN_INTERRUPT_SOURCE_PENDING;
	}

	/**
	The constructor function.

	Register SMI handler when link to SMM driver.

	@retval EFI_SUCCESS The constructor always returns EFI_SUCCESS.

	**/
	EFI_STATUS
	EFIAPI
	OpalPasswordSupportLibConstructor (
	VOID
	)
	{
	EFI_SMM_BASE2_PROTOCOL *SmmBase2;
	EFI_SMM_SYSTEM_TABLE2 *Smst;
	EFI_HANDLE SmmHandle;
	EFI_STATUS Status;

	Status = gBS->LocateProtocol (&gEfiSmmBase2ProtocolGuid, NULL, (VOID**) &SmmBase2);
	if (EFI_ERROR (Status)) {
	return RETURN_SUCCESS;
	}
	Status = SmmBase2->InSmm (SmmBase2, &gInSmm);
	if (EFI_ERROR (Status)) {
	return RETURN_SUCCESS;
	}
	if (!gInSmm) {
	return RETURN_SUCCESS;
	}

	//
	// Good, we are in SMM
	//
	Status = SmmBase2->GetSmstLocation (SmmBase2, &Smst);
	if (EFI_ERROR (Status)) {
	return RETURN_SUCCESS;
	}

	SmmHandle = NULL;
	Status = Smst->SmiHandlerRegister (SmmOpalPasswordHandler, &gOpalPasswordNotifyProtocolGuid, &SmmHandle);
	ASSERT_EFI_ERROR (Status);

	return EFI_SUCCESS;
	}

	/**
	The Destructor function.

	Clean the saved opal device list.

	@retval EFI_SUCCESS The constructor always returns EFI_SUCCESS.

	**/
	EFI_STATUS
	EFIAPI
	OpalPasswordSupportLibDestructor (
	VOID
	)
	{
	OPAL_DISK_AND_PASSWORD_INFO *Device;

	while (!IsListEmpty (&mDeviceList)) {
	Device = BASE_CR (mDeviceList.ForwardLink, OPAL_DISK_AND_PASSWORD_INFO, Link);

	RemoveEntryList (&Device->Link);
	FreePool (Device);
	}

	return EFI_SUCCESS;
	}