From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mx.groups.io with SMTP id smtpd.web12.1677.1573116160959069514 for ; Thu, 07 Nov 2019 00:42:41 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.136, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Nov 2019 00:42:40 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,277,1569308400"; d="scan'208";a="200977173" Received: from fmsmsx107.amr.corp.intel.com ([10.18.124.205]) by fmsmga008.fm.intel.com with ESMTP; 07 Nov 2019 00:42:40 -0800 Received: from fmsmsx156.amr.corp.intel.com (10.18.116.74) by fmsmsx107.amr.corp.intel.com (10.18.124.205) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 7 Nov 2019 00:42:40 -0800 Received: from shsmsx105.ccr.corp.intel.com (10.239.4.158) by fmsmsx156.amr.corp.intel.com (10.18.116.74) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 7 Nov 2019 00:42:40 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX105.ccr.corp.intel.com ([169.254.11.225]) with mapi id 14.03.0439.000; Thu, 7 Nov 2019 16:42:37 +0800 From: "Yao, Jiewen" To: "Ni, Ray" , "devel@edk2.groups.io" CC: "Chaganty, Rangasai V" , "Lou, Yun" Subject: Re: [edk2-devel] [PATCH V2 5/6] IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. Thread-Topic: [edk2-devel] [PATCH V2 5/6] IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. Thread-Index: AQHVj+cuxVAn3iBsJUixpWl/0rocEKd/S/qwgAAWZtA= Date: Thu, 7 Nov 2019 08:42:36 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F8425A2@shsmsx102.ccr.corp.intel.com> References: <20191031123127.10900-1-jiewen.yao@intel.com> <20191031123127.10900-6-jiewen.yao@intel.com> <734D49CCEBEEF84792F5B80ED585239D5C352E97@SHSMSX104.ccr.corp.intel.com> In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C352E97@SHSMSX104.ccr.corp.intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZGNlYzEyOTgtZTFlYS00N2M2LTkxMGYtMTE1Mjg1YjM3ZmFkIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiZDRNXC9VTVFhTFE3YTVQMDNlUVZrdWt0cFwvbkhsaEtyYkhubCszMVpJVkROSklZVVwvVzNcLzZTeGFpYjNBbVZoTEsifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Good feedback. Comment below: > -----Original Message----- > From: Ni, Ray > Sent: Thursday, November 7, 2019 2:56 PM > To: devel@edk2.groups.io; Yao, Jiewen > Cc: Chaganty, Rangasai V ; Lou, Yun > > Subject: RE: [edk2-devel] [PATCH V2 5/6] > IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. >=20 > 1. I am sorry but I just realized GetDevicePolicy() returns a pointer of= policy to > caller, > instead of copying the policy data to caller's buffer. It's a bit st= range to me. > Can you > please change the prototype so that caller needs to pass in a policy= structure > and > GetDevicePolicy() fills the structure buffer using CopyMem from > mDeviceSecurityPolicyNone? > "*DeviceSecurityPolicy =3D &mDeviceSecurityPolicyNone;" > "DeviceSecurityPolicy =3D &mDeviceSecurityPolicyMeasurement;" [Jiewen] Agree. Will update in V3. >=20 > 2. I thought SetDeviceState() in your sample will reset the > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED > to 0. Why didn't the sample do that? [Jiewen] I rename the function to NotifyDeviceState() in V3. I think that is clear. Also the state parameter is IN. The caller should not change it. >=20 > 3. I just realized you didn't define the version macro for > EDKII_DEVICE_SECURITY_POLICY_PROTOCOL.Version. > I suggest you define a macro for the version instead of let producer= /consumer > use hard-code number (0x1). > And I am not sure if you will use the same version macro for the > protocol.version, securitypolicy.version and > securitystate.version. I assume you will. No matter yes or no, can y= ou please > state that through comments > in the policy protocol header file clearly? [Jiewen] Agree. Will update in V3. >=20 >=20 >=20 > > -----Original Message----- > > From: devel@edk2.groups.io On Behalf Of Yao, > > Jiewen > > Sent: Thursday, October 31, 2019 8:31 PM > > To: devel@edk2.groups.io > > Cc: Ni, Ray ; Chaganty, Rangasai V > > ; Lou, Yun > > Subject: [edk2-devel] [PATCH V2 5/6] > > IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy. > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 > > > > This driver provides the platform sample policy to measure a NVMe card= . > > > > Cc: Ray Ni > > Cc: Rangasai V Chaganty > > Cc: Yun Lou > > Signed-off-by: Jiewen Yao > > --- > > > > Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePoli > > cyDxe/SamplePlatformDevicePolicyDxe.c | 189 ++++++++++++++++++++ > > > > Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDevic= ePoli > > cyDxe/SamplePlatformDevicePolicyDxe.inf | 40 +++++ > > 2 files changed, 229 insertions(+) > > > > diff --git > > a/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDev= iceP > > olicyDxe/SamplePlatformDevicePolicyDxe.c > > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDev= iceP > > olicyDxe/SamplePlatformDevicePolicyDxe.c > > new file mode 100644 > > index 0000000000..1f01b961a8 > > --- /dev/null > > +++ b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatfor= mD > > +++ evicePolicyDxe/SamplePlatformDevicePolicyDxe.c > > @@ -0,0 +1,189 @@ > > +/** @file > > + EDKII Device Security library for PCI device > > + > > +Copyright (c) 2019, Intel Corporation. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent > > + > > +**/ > > + > > +#include > > +#include > > +#include > > +#include > > +#include > > +#include > > +#include > > +#include > > +#include > > +#include > > + > > +EDKII_DEVICE_SECURITY_POLICY mDeviceSecurityPolicyNone =3D = { > > + 0x1, > > + 0, > > + 0, > > +}; > > +EDKII_DEVICE_SECURITY_POLICY mDeviceSecurityPolicyMeasureme= nt > > =3D { > > + 0x1, > > + EDKII_DEVICE_MEASUREMENT_POLICY_REQUIRED, > > + 0, > > +}; > > + > > +/** > > + This function returns the device security policy associated with th= e device. > > + > > + @param[in] This The protocol instance pointer. > > + @param[in] DeviceId The Identifier for the device. > > + @param[out] DeviceSecurityPolicy The Device Security Policy assoc= iated > > with the device. > > + > > + @retval EFI_SUCCESS The device security policy is re= turned > > +**/ > > +EFI_STATUS > > +EFIAPI > > +GetDevicePolicy ( > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > + OUT EDKII_DEVICE_SECURITY_POLICY **DeviceSecurityPolicy > > + ) > > +{ > > + EFI_STATUS Status; > > + EFI_PCI_IO_PROTOCOL *PciIo; > > + UINT16 PciVendorId; > > + UINT16 PciDeviceId; > > + > > + *DeviceSecurityPolicy =3D &mDeviceSecurityPolicyNone; > > + > > + DEBUG ((DEBUG_INFO, "GetDevicePolicy - 0x%g\n", > > + &DeviceId->DeviceType)); > > + > > + if (!CompareGuid (&DeviceId->DeviceType, > > &gEdkiiDeviceIdentifierTypePciGuid)) { > > + return EFI_SUCCESS; > > + } > > + > > + Status =3D gBS->HandleProtocol ( > > + DeviceId->DeviceHandle, > > + &gEdkiiDeviceIdentifierTypePciGuid, > > + (VOID **)&PciIo > > + ); > > + if (EFI_ERROR(Status)) { > > + DEBUG ((DEBUG_ERROR, "Locate - DeviceIdentifierTypePci - %r\n", > > Status)); > > + return EFI_SUCCESS; > > + } > > + > > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > > + PCI_VENDOR_ID_OFFSET, 1, &PciVendorId); ASSERT_EFI_ERROR(Status); > > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > > + PCI_DEVICE_ID_OFFSET, 1, &PciDeviceId); ASSERT_EFI_ERROR(Status); > > + DEBUG ((DEBUG_INFO, "PCI Info - %04x:%04x\n", PciVendorId, > > + PciDeviceId)); > > + > > + if ((PciVendorId =3D=3D 0x8086) && (PciDeviceId =3D=3D 0x0B60)) { > > + *DeviceSecurityPolicy =3D &mDeviceSecurityPolicyMeasurement; > > + } > > + > > + return EFI_SUCCESS; > > +} > > + > > +/** > > + This function sets the device state based upon the authentication r= esult. > > + > > + @param[in] This The protocol instance pointer. > > + @param[in] DeviceId The Identifier for the device. > > + @param[in] DeviceSecurityState The Device Security state associ= ated > > with the device. > > + > > + @retval EFI_SUCCESS The device state is set > > +**/ > > +EFI_STATUS > > +EFIAPI > > +SetDeviceState ( > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState > > + ) > > +{ > > + EFI_STATUS Status; > > + EFI_PCI_IO_PROTOCOL *PciIo; > > + UINT16 PciVendorId; > > + UINT16 PciDeviceId; > > + UINTN Segment; > > + UINTN Bus; > > + UINTN Device; > > + UINTN Function; > > + > > + DEBUG ((DEBUG_INFO, "SetDeviceState - 0x%g\n", > > + &DeviceId->DeviceType)); > > + > > + if (!CompareGuid (&DeviceId->DeviceType, > > &gEdkiiDeviceIdentifierTypePciGuid)) { > > + return EFI_SUCCESS; > > + } > > + > > + Status =3D gBS->HandleProtocol ( > > + DeviceId->DeviceHandle, > > + &gEdkiiDeviceIdentifierTypePciGuid, > > + (VOID **)&PciIo > > + ); > > + if (EFI_ERROR(Status)) { > > + DEBUG ((DEBUG_ERROR, "Locate - DeviceIdentifierTypePci - %r\n", > > Status)); > > + return EFI_SUCCESS; > > + } > > + > > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > > + PCI_VENDOR_ID_OFFSET, 1, &PciVendorId); ASSERT_EFI_ERROR(Status); > > + Status =3D PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, > > + PCI_DEVICE_ID_OFFSET, 1, &PciDeviceId); ASSERT_EFI_ERROR(Status); > > + DEBUG ((DEBUG_INFO, "PCI Info - %04x:%04x\n", PciVendorId, > > + PciDeviceId)); > > + > > + Status =3D PciIo->GetLocation ( > > + PciIo, > > + &Segment, > > + &Bus, > > + &Device, > > + &Function > > + ); > > + if (!EFI_ERROR(Status)) { > > + DEBUG ((DEBUG_INFO, "PCI Loc - %04x:%02x:%02x:%02x\n", > > + Segment, Bus, Device, Function)); } > > + > > + DEBUG ((DEBUG_INFO, "State - Measurement - 0x%08x, Authentication - > > 0x%08x\n", > > + DeviceSecurityState->MeasurementState, > > + DeviceSecurityState->AuthenticationState > > + )); > > + > > + return EFI_SUCCESS; > > +} > > + > > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL mDeviceSecurityPolicy =3D { > > + 0x1, > > + GetDevicePolicy, > > + SetDeviceState, > > +}; > > + > > +/** > > + Entrypoint of the device security driver. > > + > > + @param[in] ImageHandle ImageHandle of the loaded driver @param[i= n] > > + SystemTable Pointer to the System Table > > + > > + @retval EFI_SUCCESS The Protocol is installed. > > + @retval EFI_OUT_OF_RESOURCES Not enough resources available to > > initialize driver. > > + @retval EFI_DEVICE_ERROR A device error occurred attempting t= o > > initialize the driver. > > + > > +**/ > > +EFI_STATUS > > +EFIAPI > > +MainEntryPoint ( > > + IN EFI_HANDLE ImageHandle, > > + IN EFI_SYSTEM_TABLE *SystemTable > > + ) > > +{ > > + EFI_HANDLE Handle; > > + EFI_STATUS Status; > > + > > + Handle =3D NULL; > > + Status =3D gBS->InstallProtocolInterface ( > > + &Handle, > > + &gEdkiiDeviceSecurityPolicyProtocolGuid, > > + EFI_NATIVE_INTERFACE, > > + &mDeviceSecurityPolicy > > + ); > > + ASSERT_EFI_ERROR(Status); > > + > > + return Status; > > +} > > diff --git > > a/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDev= iceP > > olicyDxe/SamplePlatformDevicePolicyDxe.inf > > b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatformDev= iceP > > olicyDxe/SamplePlatformDevicePolicyDxe.inf > > new file mode 100644 > > index 0000000000..a9b77d8371 > > --- /dev/null > > +++ b/Silicon/Intel/IntelSiliconPkg/Feature/PcieSecurity/SamplePlatfor= mD > > +++ evicePolicyDxe/SamplePlatformDevicePolicyDxe.inf > > @@ -0,0 +1,40 @@ > > +## @file > > +# EDKII Device Security library for PCI device # # Copyright (c) 201= 9, > > +Intel Corporation. All rights reserved.
# SPDX-License-Identifier= : > > +BSD-2-Clause-Patent # ## > > + > > +[Defines] > > + INF_VERSION =3D 0x00010005 > > + BASE_NAME =3D SamplePlatformDevicePolicyDxe > > + FILE_GUID =3D 7EA7AACF-7ED3-4166-8271-B2115652= 3620 > > + MODULE_TYPE =3D DXE_DRIVER > > + VERSION_STRING =3D 1.0 > > + ENTRY_POINT =3D MainEntryPoint > > + > > +[Sources] > > + SamplePlatformDevicePolicyDxe.c > > + > > +[Packages] > > + MdePkg/MdePkg.dec > > + MdeModulePkg/MdeModulePkg.dec > > + IntelSiliconPkg/IntelSiliconPkg.dec > > + > > +[LibraryClasses] > > + UefiRuntimeServicesTableLib > > + UefiBootServicesTableLib > > + UefiDriverEntryPoint > > + MemoryAllocationLib > > + DevicePathLib > > + BaseMemoryLib > > + PrintLib > > + DebugLib > > + > > +[Protocols] > > + gEdkiiDeviceSecurityPolicyProtocolGuid ## PRODUCES > > + gEdkiiDeviceIdentifierTypePciGuid ## COMSUMES > > + > > +[Depex] > > + TRUE > > -- > > 2.19.2.windows.1 > > > > > >=20