From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mx.groups.io with SMTP id smtpd.web12.1292.1573112764243947973 for ; Wed, 06 Nov 2019 23:46:04 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.20, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Nov 2019 23:46:03 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,277,1569308400"; d="scan'208";a="402656677" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by fmsmga005.fm.intel.com with ESMTP; 06 Nov 2019 23:46:03 -0800 Received: from fmsmsx609.amr.corp.intel.com (10.18.126.89) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 6 Nov 2019 23:46:00 -0800 Received: from fmsmsx609.amr.corp.intel.com (10.18.126.89) by fmsmsx609.amr.corp.intel.com (10.18.126.89) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Wed, 6 Nov 2019 23:46:00 -0800 Received: from shsmsx101.ccr.corp.intel.com (10.239.4.153) by fmsmsx609.amr.corp.intel.com (10.18.126.89) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1713.5 via Frontend Transport; Wed, 6 Nov 2019 23:46:00 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX101.ccr.corp.intel.com ([169.254.1.213]) with mapi id 14.03.0439.000; Thu, 7 Nov 2019 15:45:58 +0800 From: "Yao, Jiewen" To: "Ni, Ray" , "devel@edk2.groups.io" CC: "Chaganty, Rangasai V" , "Lou, Yun" Subject: Re: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Topic: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Index: AQHVj+cslIqpp/OC20WgOXdKz8mg6ad/LWxwgAAvyuA= Date: Thu, 7 Nov 2019 07:45:58 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F842397@shsmsx102.ccr.corp.intel.com> References: <20191031123127.10900-1-jiewen.yao@intel.com> <20191031123127.10900-3-jiewen.yao@intel.com> <734D49CCEBEEF84792F5B80ED585239D5C352D95@SHSMSX104.ccr.corp.intel.com> In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C352D95@SHSMSX104.ccr.corp.intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMmVkNzkxOWUtM2FhYS00MGU4LWFkZGEtMzIzMTlmYmYxYjkxIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiTExGdlwvdjNuSnBVUHdqK3NxUDd1aERBOG5DZDFCQVwvNU8yenVOVkRtdHdJRHh1cWh4U25HQmFaSVpxdzBQdkVOIn0= x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Sure. 1. add comments to each field of structures like EDKII_DEVICE_SECURITY_POLI= CY and EDKII_DEVICE_SECURITY_STATE. 2. add comments to all the macros defined in this patch to explain the mean= ing and more important how they are going to impact the logic. I don't believe a PCI/USB BUS driver developer need understand this protoco= l. The PCI/USB only need to understand MdeModulePkg/DEVICE_SECURITY_PROTOCOL. The IntelSiliconPkg/DEVICE_SECURITY_POLICY_PROTOCOL is for the internal imp= lementation of a device security driver. It should be unknown by device dri= ver writer. Thank you Yao Jiewen > -----Original Message----- > From: Ni, Ray > Sent: Thursday, November 7, 2019 12:55 PM > To: Yao, Jiewen ; devel@edk2.groups.io > Cc: Chaganty, Rangasai V ; Lou, Yun > > Subject: RE: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device > Security Policy protocol >=20 > Jiewen, > I am fine with the 1/6 patch that doesn't contain enough comments to desc= ribe > the meaning > of each field in each structure because I can reach out to the referenced= spec to > understand them. >=20 > This 2/6 patch introduces a new protocol but contains very few comments > (almost none) for each > structure each field and I cannot reach out to any spec to understand the= m. >=20 > So can you please add comments to each field of structures like > EDKII_DEVICE_SECURITY_POLICY and > EDKII_DEVICE_SECURITY_STATE? > Also can you please add comments to all the macros defined in this patch = to > explain the meaning and > more important how they are going to impact the logic. >=20 > In general, can you please add enough comments so that a PCI/USB BUS driv= er > developer can understand > the whole flow how this protocol supports the device security? >=20 > Thanks, > Ray >=20 > > -----Original Message----- > > From: Yao, Jiewen > > Sent: Thursday, October 31, 2019 8:31 PM > > To: devel@edk2.groups.io > > Cc: Ni, Ray ; Chaganty, Rangasai V > > ; Lou, Yun > > Subject: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device > > Security Policy protocol > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 > > > > Cc: Ray Ni > > Cc: Rangasai V Chaganty > > Cc: Yun Lou > > Signed-off-by: Jiewen Yao > > --- > > > > Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPo= licy.h > > | 84 ++++++++++++++++++++ > > 1 file changed, 84 insertions(+) > > > > diff --git > > a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurity= Polic > > y.h > > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurity= Polic > > y.h > > new file mode 100644 > > index 0000000000..cb5a71ad41 > > --- /dev/null > > +++ > > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurity= Polic > > y.h > > @@ -0,0 +1,84 @@ > > +/** @file > > + Device Security Policy Protocol definition > > + > > + Copyright (c) 2019, Intel Corporation. All rights reserved.
> > + SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > + > > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ > > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ > > + > > +#include > > +#include > > + > > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL > > EDKII_DEVICE_SECURITY_POLICY_PROTOCOL; > > + > > +typedef struct { > > + UINT32 Version; // 0x1 > > + UINT32 MeasurementPolicy; > > + UINT32 AuthenticationPolicy; > > +} EDKII_DEVICE_SECURITY_POLICY; > > + > > +// BIT0 means if the action is needed or NOT > > +#define EDKII_DEVICE_MEASUREMENT_POLICY_REQUIRED BIT0 > > +#define EDKII_DEVICE_AUTHENTICATION_POLICY_REQUIRED BIT0 > > + > > +typedef struct { > > + UINT32 Version; // 0x1 > > + UINT32 MeasurementState; > > + UINT32 AuthenticationState; > > +} EDKII_DEVICE_SECURITY_STATE; > > + > > +// All zero means success > > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS 0 > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR B= IT31 > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0) > > +#define > > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1) > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10) > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20) > > + > > +/** > > + This function returns the device security policy associated with the= device. > > + > > + @param[in] This The protocol instance pointer. > > + @param[in] DeviceId The Identifier for the device. > > + @param[out] DeviceSecurityPolicy The Device Security Policy associ= ated > > with the device. > > + > > + @retval EFI_SUCCESS The device security policy is ret= urned > > +**/ > > +typedef > > +EFI_STATUS > > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) ( > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > + OUT EDKII_DEVICE_SECURITY_POLICY **DeviceSecurityPolicy > > + ); > > + > > +/** > > + This function sets the device state based upon the authentication re= sult. > > + > > + @param[in] This The protocol instance pointer. > > + @param[in] DeviceId The Identifier for the device. > > + @param[in] DeviceSecurityState The Device Security state associa= ted > > with the device. > > + > > + @retval EFI_SUCCESS The device state is set > > +**/ > > +typedef > > +EFI_STATUS > > +(EFIAPI *EDKII_DEVICE_SECURITY_SET_DEVICE_STATE) ( > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState > > + ); > > + > > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL { > > + UINT32 Version; // 0x1 > > + EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY GetDevicePolicy; > > + EDKII_DEVICE_SECURITY_SET_DEVICE_STATE SetDeviceState; > > +}; > > + > > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid; > > + > > +#endif > > -- > > 2.19.2.windows.1