Re: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol

["Ni, Ray" <ray.ni@intel.com>]

Jiewen,
The structure field is named "Version" while the macro is ended with "_REVISION".
Is there a special reason for such inconsistency?

Thanks,
Ray

> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Thursday, November 7, 2019 9:38 PM
> To: devel@edk2.groups.io
> Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> 
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> Cc: Yun Lou <yun.lou@intel.com>
> Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
>  1 file changed, 128 insertions(+)
>  create mode 100644
> Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> 
> diff --git
> a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> y.h
> b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> y.h
> new file mode 100644
> index 0000000000..b151781de2
> --- /dev/null
> +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> +++ ityPolicy.h
> @@ -0,0 +1,128 @@
> +/** @file
> +  Platform Device Security Policy Protocol definition
> +
> +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +
> +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> +
> +#include <Uefi.h>
> +#include <Protocol/DeviceSecurity.h>
> +
> +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> interface adheres.
> +//          All future revisions must be backwards compatible.
> +//          If a future version is not back wards compatible it is not the same
> GUID.
> +//
> +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> 0x00010000
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> adheres.
> +//          All future revisions must be backwards compatible.
> +//
> +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> +
> +///
> +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> +///
> +#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
> +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
> +
> +///
> +/// The device security policy data structure /// typedef struct {
> +  UINT32     Version;
> +  UINT32     MeasurementPolicy;
> +  UINT32     AuthenticationPolicy;
> +} EDKII_DEVICE_SECURITY_POLICY;
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> adheres.
> +//          All future revisions must be backwards compatible.
> +//
> +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> +
> +///
> +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> +#define
> EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> +
> +///
> +/// The device security state data structure /// typedef struct {
> +  UINT32     Version;
> +  UINT32     MeasurementState;
> +  UINT32     AuthenticationState;
> +} EDKII_DEVICE_SECURITY_STATE;
> +
> +/**
> +  This function returns the device security policy associated with the device.
> +
> +  The device security driver may call this interface to get the
> + platform policy  for the specific device and determine if the
> + measurement or authentication  is required.
> +
> +  @param[in]  This                   The protocol instance pointer.
> +  @param[in]  DeviceId               The Identifier for the device.
> +  @param[out] DeviceSecurityPolicy   The Device Security Policy associated
> with the device.
> +
> +  @retval EFI_SUCCESS                The device security policy is returned
> +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> specific Device.
> +**/
> +typedef
> +EFI_STATUS
> +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> +  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
> +  );
> +
> +/**
> +  This function sets the device state based upon the authentication result.
> +
> +  The device security driver may call this interface to give the
> + platform  a notify based upon the measurement or authentication result.
> +  If the authentication or measurement fails, the platform may choose:
> +  1) Do nothing.
> +  2) Disable this device or slot temporarily and continue boot.
> +  3) Reset the platform and retry again.
> +  4) Disable this device or slot permanently.
> +  5) Any other platform specific action.
> +
> +  @param[in]  This                   The protocol instance pointer.
> +  @param[in]  DeviceId               The Identifier for the device.
> +  @param[in]  DeviceSecurityState    The Device Security state associated
> with the device.
> +
> +  @retval EFI_SUCCESS                The device state is set.
> +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> specific Device.
> +**/
> +typedef
> +EFI_STATUS
> +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> +  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
> +  );
> +
> +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> +  UINT32                                      Version;
> +  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
> +  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
> +};
> +
> +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> +
> +#endif
> --
> 2.19.2.windows.1