From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web12.5551.1573022911175034102 for ; Tue, 05 Nov 2019 22:48:31 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.31, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Nov 2019 22:48:30 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,272,1569308400"; d="scan'208";a="196103752" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by orsmga008.jf.intel.com with ESMTP; 05 Nov 2019 22:48:30 -0800 Received: from fmsmsx112.amr.corp.intel.com (10.18.116.6) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 5 Nov 2019 22:48:25 -0800 Received: from shsmsx106.ccr.corp.intel.com (10.239.4.159) by FMSMSX112.amr.corp.intel.com (10.18.116.6) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 5 Nov 2019 22:48:25 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX106.ccr.corp.intel.com ([169.254.10.248]) with mapi id 14.03.0439.000; Wed, 6 Nov 2019 14:48:22 +0800 From: "Yao, Jiewen" To: "devel@edk2.groups.io" , "Yao, Jiewen" CC: "Ni, Ray" , "Chaganty, Rangasai V" , "Lou, Yun" Subject: Re: [edk2-devel] [PATCH V2 5/6] IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. Thread-Topic: [edk2-devel] [PATCH V2 5/6] IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. Thread-Index: AQHVj+csxVAn3iBsJUixpWl/0rocEKd9vIlA Date: Wed, 6 Nov 2019 06:48:22 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F83EA6F@shsmsx102.ccr.corp.intel.com> References: <20191031123127.10900-1-jiewen.yao@intel.com> <15D2BB3F6D7204CF.23805@groups.io> In-Reply-To: <15D2BB3F6D7204CF.23805@groups.io> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMThhZTQzNjMtNjNhNi00ZmVkLWE1N2EtODhlNjIxNzcxODA3IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiUUVPaHp2bXN6NjNpUUxLa3lvSXJleWg5dEdZVndranYxUm1ZUFloMkRpU3RrcW50em1DVjFBWlhaSTJTVnEwbSJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Ray/Sai Would you please review this patch? We need this feature in next stable tag as planned. Thank you Yao Jiewen > -----Original Message----- > From: devel@edk2.groups.io On Behalf Of Yao, Jiew= en > Sent: Thursday, October 31, 2019 8:31 PM > To: devel@edk2.groups.io > Cc: Ni, Ray ; Chaganty, Rangasai V > ; Lou, Yun > Subject: [edk2-devel] [PATCH V2 5/6] > IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 >=20 > This driver provides the platform sample policy to measure > a NVMe card. >=20 > Cc: Ray Ni > Cc: Rangasai V Chaganty > Cc: Yun Lou > Signed-off-by: Jiewen Yao > --- >=20 > Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDeviceP= olicyD > xe/SamplePlatformDevicePolicyDxe.c | 189 ++++++++++++++++++++ >=20 > Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDeviceP= olicyD > xe/SamplePlatformDevicePolicyDxe.inf | 40 +++++ > 2 files changed, 229 insertions(+) >=20 > diff --git > a/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.c > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.c > new file mode 100644 > index 0000000000..1f01b961a8 > --- /dev/null > +++ > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.c > @@ -0,0 +1,189 @@ > +/** @file > + EDKII Device Security library for PCI device > + > +Copyright (c) 2019, Intel Corporation. All rights reserved.
> +SPDX-License-Identifier: BSD-2-Clause-Patent > + > +**/ > + > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > +#include > + > +EDKII_DEVICE_SECURITY_POLICY mDeviceSecurityPolicyNone =3D { > + 0x1, > + 0, > + 0, > +}; > +EDKII_DEVICE_SECURITY_POLICY mDeviceSecurityPolicyMeasurement= =3D { > + 0x1, > + EDKII_DEVICE_MEASUREMENT_POLICY_REQUIRED, > + 0, > +}; > + > +/** > + This function returns the device security policy associated with the = device. > + > + @param[in] This The protocol instance pointer. > + @param[in] DeviceId The Identifier for the device. > + @param[out] DeviceSecurityPolicy The Device Security Policy associa= ted > with the device. > + > + @retval EFI_SUCCESS The device security policy is retu= rned > +**/ > +EFI_STATUS > +EFIAPI > +GetDevicePolicy ( > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > + OUT EDKII_DEVICE_SECURITY_POLICY **DeviceSecurityPolicy > + ) > +{ > + EFI_STATUS Status; > + EFI_PCI_IO_PROTOCOL *PciIo; > + UINT16 PciVendorId; > + UINT16 PciDeviceId; > + > + *DeviceSecurityPolicy =3D &mDeviceSecurityPolicyNone; > + > + DEBUG ((DEBUG_INFO, "GetDevicePolicy - 0x%g\n", &DeviceId->DeviceType= )); > + > + if (!CompareGuid (&DeviceId->DeviceType, > &gEdkiiDeviceIdentifierTypePciGuid)) { > + return EFI_SUCCESS; > + } > + > + Status =3D gBS->HandleProtocol ( > + DeviceId->DeviceHandle, > + &gEdkiiDeviceIdentifierTypePciGuid, > + (VOID **)&PciIo > + ); > + if (EFI_ERROR(Status)) { > + DEBUG ((DEBUG_ERROR, "Locate - DeviceIdentifierTypePci - %r\n", Sta= tus)); > + return EFI_SUCCESS; > + } > + > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > PCI_VENDOR_ID_OFFSET, 1, &PciVendorId); > + ASSERT_EFI_ERROR(Status); > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_DEVICE_ID= _OFFSET, > 1, &PciDeviceId); > + ASSERT_EFI_ERROR(Status); > + DEBUG ((DEBUG_INFO, "PCI Info - %04x:%04x\n", PciVendorId, PciDeviceI= d)); > + > + if ((PciVendorId =3D=3D 0x8086) && (PciDeviceId =3D=3D 0x0B60)) { > + *DeviceSecurityPolicy =3D &mDeviceSecurityPolicyMeasurement; > + } > + > + return EFI_SUCCESS; > +} > + > +/** > + This function sets the device state based upon the authentication res= ult. > + > + @param[in] This The protocol instance pointer. > + @param[in] DeviceId The Identifier for the device. > + @param[in] DeviceSecurityState The Device Security state associat= ed with > the device. > + > + @retval EFI_SUCCESS The device state is set > +**/ > +EFI_STATUS > +EFIAPI > +SetDeviceState ( > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState > + ) > +{ > + EFI_STATUS Status; > + EFI_PCI_IO_PROTOCOL *PciIo; > + UINT16 PciVendorId; > + UINT16 PciDeviceId; > + UINTN Segment; > + UINTN Bus; > + UINTN Device; > + UINTN Function; > + > + DEBUG ((DEBUG_INFO, "SetDeviceState - 0x%g\n", &DeviceId->DeviceType)= ); > + > + if (!CompareGuid (&DeviceId->DeviceType, > &gEdkiiDeviceIdentifierTypePciGuid)) { > + return EFI_SUCCESS; > + } > + > + Status =3D gBS->HandleProtocol ( > + DeviceId->DeviceHandle, > + &gEdkiiDeviceIdentifierTypePciGuid, > + (VOID **)&PciIo > + ); > + if (EFI_ERROR(Status)) { > + DEBUG ((DEBUG_ERROR, "Locate - DeviceIdentifierTypePci - %r\n", Sta= tus)); > + return EFI_SUCCESS; > + } > + > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > PCI_VENDOR_ID_OFFSET, 1, &PciVendorId); > + ASSERT_EFI_ERROR(Status); > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_DEVICE_ID= _OFFSET, > 1, &PciDeviceId); > + ASSERT_EFI_ERROR(Status); > + DEBUG ((DEBUG_INFO, "PCI Info - %04x:%04x\n", PciVendorId, PciDeviceI= d)); > + > + Status =3D PciIo->GetLocation ( > + PciIo, > + &Segment, > + &Bus, > + &Device, > + &Function > + ); > + if (!EFI_ERROR(Status)) { > + DEBUG ((DEBUG_INFO, "PCI Loc - %04x:%02x:%02x:%02x\n", > + Segment, Bus, Device, Function)); > + } > + > + DEBUG ((DEBUG_INFO, "State - Measurement - 0x%08x, Authentication - > 0x%08x\n", > + DeviceSecurityState->MeasurementState, > + DeviceSecurityState->AuthenticationState > + )); > + > + return EFI_SUCCESS; > +} > + > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL mDeviceSecurityPolicy =3D { > + 0x1, > + GetDevicePolicy, > + SetDeviceState, > +}; > + > +/** > + Entrypoint of the device security driver. > + > + @param[in] ImageHandle ImageHandle of the loaded driver > + @param[in] SystemTable Pointer to the System Table > + > + @retval EFI_SUCCESS The Protocol is installed. > + @retval EFI_OUT_OF_RESOURCES Not enough resources available to > initialize driver. > + @retval EFI_DEVICE_ERROR A device error occurred attempting to > initialize the driver. > + > +**/ > +EFI_STATUS > +EFIAPI > +MainEntryPoint ( > + IN EFI_HANDLE ImageHandle, > + IN EFI_SYSTEM_TABLE *SystemTable > + ) > +{ > + EFI_HANDLE Handle; > + EFI_STATUS Status; > + > + Handle =3D NULL; > + Status =3D gBS->InstallProtocolInterface ( > + &Handle, > + &gEdkiiDeviceSecurityPolicyProtocolGuid, > + EFI_NATIVE_INTERFACE, > + &mDeviceSecurityPolicy > + ); > + ASSERT_EFI_ERROR(Status); > + > + return Status; > +} > diff --git > a/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.inf > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.inf > new file mode 100644 > index 0000000000..a9b77d8371 > --- /dev/null > +++ > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePolic > yDxe/SamplePlatformDevicePolicyDxe.inf > @@ -0,0 +1,40 @@ > +## @file > +# EDKII Device Security library for PCI device > +# > +# Copyright (c) 2019, Intel Corporation. All rights reserved.
> +# SPDX-License-Identifier: BSD-2-Clause-Patent > +# > +## > + > +[Defines] > + INF_VERSION =3D 0x00010005 > + BASE_NAME =3D SamplePlatformDevicePolicyDxe > + FILE_GUID =3D 7EA7AACF-7ED3-4166-8271-B211565236= 20 > + MODULE_TYPE =3D DXE_DRIVER > + VERSION_STRING =3D 1.0 > + ENTRY_POINT =3D MainEntryPoint > + > +[Sources] > + SamplePlatformDevicePolicyDxe.c > + > +[Packages] > + MdePkg/MdePkg.dec > + MdeModulePkg/MdeModulePkg.dec > + IntelSiliconPkg/IntelSiliconPkg.dec > + > +[LibraryClasses] > + UefiRuntimeServicesTableLib > + UefiBootServicesTableLib > + UefiDriverEntryPoint > + MemoryAllocationLib > + DevicePathLib > + BaseMemoryLib > + PrintLib > + DebugLib > + > +[Protocols] > + gEdkiiDeviceSecurityPolicyProtocolGuid ## PRODUCES > + gEdkiiDeviceIdentifierTypePciGuid ## COMSUMES > + > +[Depex] > + TRUE > -- > 2.19.2.windows.1 >=20 >=20 >=20