[edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Yao, Jiewen
jiewen.yao at intel.com
Fri Nov 8 07:01:23 UTC 2019
Good catch.
No special meaning.
I will use _VERSION.
Thank you
Yao Jiewen
> -----Original Message-----
> From: Ni, Ray <ray.ni at intel.com>
> Sent: Friday, November 8, 2019 3:00 PM
> To: Yao, Jiewen <jiewen.yao at intel.com>; devel at edk2.groups.io
> Cc: Chaganty, Rangasai V <rangasai.v.chaganty at intel.com>; Lou, Yun
> <yun.lou at intel.com>
> Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
>
> Jiewen,
> The structure field is named "Version" while the macro is ended with
> "_REVISION".
> Is there a special reason for such inconsistency?
>
> Thanks,
> Ray
>
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao at intel.com>
> > Sent: Thursday, November 7, 2019 9:38 PM
> > To: devel at edk2.groups.io
> > Cc: Ni, Ray <ray.ni at intel.com>; Chaganty, Rangasai V
> > <rangasai.v.chaganty at intel.com>; Lou, Yun <yun.lou at intel.com>
> > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > Security Policy protocol
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> >
> > Cc: Ray Ni <ray.ni at intel.com>
> > Cc: Rangasai V Chaganty <rangasai.v.chaganty at intel.com>
> > Cc: Yun Lou <yun.lou at intel.com>
> > Signed-off-by: Jiewen Yao <jiewen.yao at intel.com>
> > ---
> > .../Protocol/PlatformDeviceSecurityPolicy.h | 128 ++++++++++++++++++
> > 1 file changed, 128 insertions(+)
> > create mode 100644
> > Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> >
> > diff --git
> > a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > y.h
> > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > y.h
> > new file mode 100644
> > index 0000000000..b151781de2
> > --- /dev/null
> > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> > +++ ityPolicy.h
> > @@ -0,0 +1,128 @@
> > +/** @file
> > + Platform Device Security Policy Protocol definition
> > +
> > + Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > + SPDX-License-Identifier: BSD-2-Clause-Patent
> > +
> > +**/
> > +
> > +
> > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > +
> > +#include <Uefi.h>
> > +#include <Protocol/DeviceSecurity.h>
> > +
> > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> > interface adheres.
> > +// All future revisions must be backwards compatible.
> > +// If a future version is not back wards compatible it is not the same
> > GUID.
> > +//
> > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> > 0x00010000
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> > adheres.
> > +// All future revisions must be backwards compatible.
> > +//
> > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> > +
> > +///
> > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> > +///
> > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED BIT0
> > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED BIT0
> > +
> > +///
> > +/// The device security policy data structure /// typedef struct {
> > + UINT32 Version;
> > + UINT32 MeasurementPolicy;
> > + UINT32 AuthenticationPolicy;
> > +} EDKII_DEVICE_SECURITY_POLICY;
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> > adheres.
> > +// All future revisions must be backwards compatible.
> > +//
> > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> > +
> > +///
> > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS 0
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR BIT31
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> > +#define
> > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> > +
> > +///
> > +/// The device security state data structure /// typedef struct {
> > + UINT32 Version;
> > + UINT32 MeasurementState;
> > + UINT32 AuthenticationState;
> > +} EDKII_DEVICE_SECURITY_STATE;
> > +
> > +/**
> > + This function returns the device security policy associated with the device.
> > +
> > + The device security driver may call this interface to get the
> > + platform policy for the specific device and determine if the
> > + measurement or authentication is required.
> > +
> > + @param[in] This The protocol instance pointer.
> > + @param[in] DeviceId The Identifier for the device.
> > + @param[out] DeviceSecurityPolicy The Device Security Policy associated
> > with the device.
> > +
> > + @retval EFI_SUCCESS The device security policy is returned
> > + @retval EFI_UNSUPPORTED The function is unsupported for the
> > specific Device.
> > +**/
> > +typedef
> > +EFI_STATUS
> > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This,
> > + IN EDKII_DEVICE_IDENTIFIER *DeviceId,
> > + OUT EDKII_DEVICE_SECURITY_POLICY *DeviceSecurityPolicy
> > + );
> > +
> > +/**
> > + This function sets the device state based upon the authentication result.
> > +
> > + The device security driver may call this interface to give the
> > + platform a notify based upon the measurement or authentication result.
> > + If the authentication or measurement fails, the platform may choose:
> > + 1) Do nothing.
> > + 2) Disable this device or slot temporarily and continue boot.
> > + 3) Reset the platform and retry again.
> > + 4) Disable this device or slot permanently.
> > + 5) Any other platform specific action.
> > +
> > + @param[in] This The protocol instance pointer.
> > + @param[in] DeviceId The Identifier for the device.
> > + @param[in] DeviceSecurityState The Device Security state associated
> > with the device.
> > +
> > + @retval EFI_SUCCESS The device state is set.
> > + @retval EFI_UNSUPPORTED The function is unsupported for the
> > specific Device.
> > +**/
> > +typedef
> > +EFI_STATUS
> > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This,
> > + IN EDKII_DEVICE_IDENTIFIER *DeviceId,
> > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState
> > + );
> > +
> > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> > + UINT32 Version;
> > + EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY GetDevicePolicy;
> > + EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE NotifyDeviceState;
> > +};
> > +
> > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> > +
> > +#endif
> > --
> > 2.19.2.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#50292): https://edk2.groups.io/g/devel/message/50292
Mute This Topic: https://groups.io/mt/46027906/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list