From: "Yao, Jiewen" <jiewen.yao@intel.com>
To: "Ni, Ray" <ray.ni@intel.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Chaganty, Rangasai V" <rangasai.v.chaganty@intel.com>,
"Lou, Yun" <yun.lou@intel.com>
Subject: Re: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Date: Sat, 9 Nov 2019 07:12:52 +0000 [thread overview]
Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F847843@shsmsx102.ccr.corp.intel.com> (raw)
In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C35502C@SHSMSX104.ccr.corp.intel.com>
Hi Ray
I checked the UEFI spec and other protocol definition again.
I believe Revision is a better name for minor update. I will update the structure field from Version to Revision.
Thank you
Yao Jiewen
> -----Original Message-----
> From: Ni, Ray <ray.ni@intel.com>
> Sent: Friday, November 8, 2019 3:10 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> <yun.lou@intel.com>
> Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
>
> With that, Reviewed-by: Ray Ni <ray.ni@intel.com>
>
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Friday, November 8, 2019 3:01 PM
> > To: Ni, Ray <ray.ni@intel.com>; devel@edk2.groups.io
> > Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> <yun.lou@intel.com>
> > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> >
> > Good catch.
> > No special meaning.
> >
> > I will use _VERSION.
> >
> > Thank you
> > Yao Jiewen
> >
> > > -----Original Message-----
> > > From: Ni, Ray <ray.ni@intel.com>
> > > Sent: Friday, November 8, 2019 3:00 PM
> > > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > > Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> > > <yun.lou@intel.com>
> > > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > > Security Policy protocol
> > >
> > > Jiewen,
> > > The structure field is named "Version" while the macro is ended with
> > > "_REVISION".
> > > Is there a special reason for such inconsistency?
> > >
> > > Thanks,
> > > Ray
> > >
> > > > -----Original Message-----
> > > > From: Yao, Jiewen <jiewen.yao@intel.com>
> > > > Sent: Thursday, November 7, 2019 9:38 PM
> > > > To: devel@edk2.groups.io
> > > > Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> > > > <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> > > > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > > > Security Policy protocol
> > > >
> > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> > > >
> > > > Cc: Ray Ni <ray.ni@intel.com>
> > > > Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> > > > Cc: Yun Lou <yun.lou@intel.com>
> > > > Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> > > > ---
> > > > .../Protocol/PlatformDeviceSecurityPolicy.h | 128 ++++++++++++++++++
> > > > 1 file changed, 128 insertions(+)
> > > > create mode 100644
> > > >
> Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> > > >
> > > > diff --git
> > > >
> a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > > y.h
> > > >
> b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > > y.h
> > > > new file mode 100644
> > > > index 0000000000..b151781de2
> > > > --- /dev/null
> > > > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> > > > +++ ityPolicy.h
> > > > @@ -0,0 +1,128 @@
> > > > +/** @file
> > > > + Platform Device Security Policy Protocol definition
> > > > +
> > > > + Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > > > + SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > +
> > > > +**/
> > > > +
> > > > +
> > > > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > > +
> > > > +#include <Uefi.h>
> > > > +#include <Protocol/DeviceSecurity.h>
> > > > +
> > > > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> > > > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> > > > interface adheres.
> > > > +// All future revisions must be backwards compatible.
> > > > +// If a future version is not back wards compatible it is not the same
> > > > GUID.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> > > > 0x00010000
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> > > > adheres.
> > > > +// All future revisions must be backwards compatible.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> > > > +
> > > > +///
> > > > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> > > > +///
> > > > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED BIT0
> > > > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED BIT0
> > > > +
> > > > +///
> > > > +/// The device security policy data structure /// typedef struct {
> > > > + UINT32 Version;
> > > > + UINT32 MeasurementPolicy;
> > > > + UINT32 AuthenticationPolicy;
> > > > +} EDKII_DEVICE_SECURITY_POLICY;
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> > > > adheres.
> > > > +// All future revisions must be backwards compatible.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> > > > +
> > > > +///
> > > > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> > > > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS 0
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR BIT31
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> > > > +#define
> > > > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> > > > +#define
> EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> > > > +
> > > > +///
> > > > +/// The device security state data structure /// typedef struct {
> > > > + UINT32 Version;
> > > > + UINT32 MeasurementState;
> > > > + UINT32 AuthenticationState;
> > > > +} EDKII_DEVICE_SECURITY_STATE;
> > > > +
> > > > +/**
> > > > + This function returns the device security policy associated with the
> device.
> > > > +
> > > > + The device security driver may call this interface to get the
> > > > + platform policy for the specific device and determine if the
> > > > + measurement or authentication is required.
> > > > +
> > > > + @param[in] This The protocol instance pointer.
> > > > + @param[in] DeviceId The Identifier for the device.
> > > > + @param[out] DeviceSecurityPolicy The Device Security Policy
> associated
> > > > with the device.
> > > > +
> > > > + @retval EFI_SUCCESS The device security policy is returned
> > > > + @retval EFI_UNSUPPORTED The function is unsupported for the
> > > > specific Device.
> > > > +**/
> > > > +typedef
> > > > +EFI_STATUS
> > > > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> > > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This,
> > > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId,
> > > > + OUT EDKII_DEVICE_SECURITY_POLICY *DeviceSecurityPolicy
> > > > + );
> > > > +
> > > > +/**
> > > > + This function sets the device state based upon the authentication result.
> > > > +
> > > > + The device security driver may call this interface to give the
> > > > + platform a notify based upon the measurement or authentication result.
> > > > + If the authentication or measurement fails, the platform may choose:
> > > > + 1) Do nothing.
> > > > + 2) Disable this device or slot temporarily and continue boot.
> > > > + 3) Reset the platform and retry again.
> > > > + 4) Disable this device or slot permanently.
> > > > + 5) Any other platform specific action.
> > > > +
> > > > + @param[in] This The protocol instance pointer.
> > > > + @param[in] DeviceId The Identifier for the device.
> > > > + @param[in] DeviceSecurityState The Device Security state associated
> > > > with the device.
> > > > +
> > > > + @retval EFI_SUCCESS The device state is set.
> > > > + @retval EFI_UNSUPPORTED The function is unsupported for the
> > > > specific Device.
> > > > +**/
> > > > +typedef
> > > > +EFI_STATUS
> > > > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> > > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This,
> > > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId,
> > > > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState
> > > > + );
> > > > +
> > > > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> > > > + UINT32 Version;
> > > > + EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY GetDevicePolicy;
> > > > + EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE NotifyDeviceState;
> > > > +};
> > > > +
> > > > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> > > > +
> > > > +#endif
> > > > --
> > > > 2.19.2.windows.1
next prev parent reply other threads:[~2019-11-09 7:12 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-07 13:38 [PATCH V3 0/6] Add Device Security driver Yao, Jiewen
2019-11-07 13:38 ` [PATCH V3 1/6] IntelSiliconPkg/Include: Add Intel PciSecurity definition Yao, Jiewen
2019-11-08 6:58 ` Ni, Ray
2019-11-07 13:38 ` [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Yao, Jiewen
2019-11-08 6:59 ` Ni, Ray
2019-11-08 7:01 ` Yao, Jiewen
2019-11-08 7:10 ` Ni, Ray
2019-11-09 7:12 ` Yao, Jiewen [this message]
2019-11-07 13:38 ` [PATCH V3 3/6] IntelSiliconPkg/dec: Add ProtocolGuid definition Yao, Jiewen
2019-11-08 7:01 ` Ni, Ray
2019-11-07 13:38 ` [PATCH V3 4/6] IntelSiliconPkg/IntelPciDeviceSecurityDxe: Add PciSecurity Yao, Jiewen
2019-11-11 8:19 ` Ni, Ray
2019-11-11 10:16 ` Yao, Jiewen
2019-11-11 14:40 ` Ni, Ray
2019-11-07 13:38 ` [PATCH V3 5/6] IntelSiliconPkg/SamplePlatformDevicePolicyDxe: Add sample policy Yao, Jiewen
2019-11-11 8:23 ` Ni, Ray
2019-11-07 13:38 ` [PATCH V3 6/6] IntelSiliconPkg/dsc: Add Device Security component Yao, Jiewen
2019-11-11 8:23 ` Ni, Ray
2019-11-08 4:23 ` [edk2-devel] [PATCH V3 0/6] Add Device Security driver Javeed, Ashraf
2019-11-08 5:14 ` Yao, Jiewen
2019-11-08 10:25 ` Javeed, Ashraf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=74D8A39837DF1E4DA445A8C0B3885C503F847843@shsmsx102.ccr.corp.intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox