From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web12.5389.1573283576738492504 for ; Fri, 08 Nov 2019 23:12:57 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: jiewen.yao@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Nov 2019 23:12:56 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,283,1569308400"; d="scan'208";a="213376549" Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by fmsmga001.fm.intel.com with ESMTP; 08 Nov 2019 23:12:55 -0800 Received: from fmsmsx155.amr.corp.intel.com (10.18.116.71) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 8 Nov 2019 23:12:55 -0800 Received: from shsmsx106.ccr.corp.intel.com (10.239.4.159) by FMSMSX155.amr.corp.intel.com (10.18.116.71) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 8 Nov 2019 23:12:55 -0800 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.108]) by SHSMSX106.ccr.corp.intel.com ([169.254.10.248]) with mapi id 14.03.0439.000; Sat, 9 Nov 2019 15:12:53 +0800 From: "Yao, Jiewen" To: "Ni, Ray" , "devel@edk2.groups.io" CC: "Chaganty, Rangasai V" , "Lou, Yun" Subject: Re: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Topic: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Index: AQHVlXCr7CkT3ujZa0erDA4540fogKeA2LwggAAA1yCAAAKRcIABkqsQ Date: Sat, 9 Nov 2019 07:12:52 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F847843@shsmsx102.ccr.corp.intel.com> References: <20191107133831.22412-1-jiewen.yao@intel.com> <20191107133831.22412-3-jiewen.yao@intel.com> <734D49CCEBEEF84792F5B80ED585239D5C354F78@SHSMSX104.ccr.corp.intel.com> <74D8A39837DF1E4DA445A8C0B3885C503F844C66@shsmsx102.ccr.corp.intel.com> <734D49CCEBEEF84792F5B80ED585239D5C35502C@SHSMSX104.ccr.corp.intel.com> In-Reply-To: <734D49CCEBEEF84792F5B80ED585239D5C35502C@SHSMSX104.ccr.corp.intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYWJkNjc0MjYtZjc4Ni00MmViLTgxOWYtYzQ4ZjQ5NjI1NWFhIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNjZJWWNlbVNuNDdpSFdVcDRpbmZRUzU5QVVRekZIaFRLYlJDSmpJVE1rcWlMVVNuMWVLbmJoUDQwekFHOENXRyJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Ray I checked the UEFI spec and other protocol definition again. I believe Revision is a better name for minor update. I will update the str= ucture field from Version to Revision. Thank you Yao Jiewen > -----Original Message----- > From: Ni, Ray > Sent: Friday, November 8, 2019 3:10 PM > To: Yao, Jiewen ; devel@edk2.groups.io > Cc: Chaganty, Rangasai V ; Lou, Yun > > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device > Security Policy protocol >=20 > With that, Reviewed-by: Ray Ni >=20 > > -----Original Message----- > > From: Yao, Jiewen > > Sent: Friday, November 8, 2019 3:01 PM > > To: Ni, Ray ; devel@edk2.groups.io > > Cc: Chaganty, Rangasai V ; Lou, Yun > > > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Devic= e > Security Policy protocol > > > > Good catch. > > No special meaning. > > > > I will use _VERSION. > > > > Thank you > > Yao Jiewen > > > > > -----Original Message----- > > > From: Ni, Ray > > > Sent: Friday, November 8, 2019 3:00 PM > > > To: Yao, Jiewen ; devel@edk2.groups.io > > > Cc: Chaganty, Rangasai V ; Lou, Yun > > > > > > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Dev= ice > > > Security Policy protocol > > > > > > Jiewen, > > > The structure field is named "Version" while the macro is ended with > > > "_REVISION". > > > Is there a special reason for such inconsistency? > > > > > > Thanks, > > > Ray > > > > > > > -----Original Message----- > > > > From: Yao, Jiewen > > > > Sent: Thursday, November 7, 2019 9:38 PM > > > > To: devel@edk2.groups.io > > > > Cc: Ni, Ray ; Chaganty, Rangasai V > > > > ; Lou, Yun > > > > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Devic= e > > > > Security Policy protocol > > > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 > > > > > > > > Cc: Ray Ni > > > > Cc: Rangasai V Chaganty > > > > Cc: Yun Lou > > > > Signed-off-by: Jiewen Yao > > > > --- > > > > .../Protocol/PlatformDeviceSecurityPolicy.h | 128 ++++++++++++++= ++++ > > > > 1 file changed, 128 insertions(+) > > > > create mode 100644 > > > > > Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPoli= cy.h > > > > > > > > diff --git > > > > > a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPo= lic > > > > y.h > > > > > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPo= lic > > > > y.h > > > > new file mode 100644 > > > > index 0000000000..b151781de2 > > > > --- /dev/null > > > > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDevice= Secur > > > > +++ ityPolicy.h > > > > @@ -0,0 +1,128 @@ > > > > +/** @file > > > > + Platform Device Security Policy Protocol definition > > > > + > > > > + Copyright (c) 2019, Intel Corporation. All rights reserved.
> > > > + SPDX-License-Identifier: BSD-2-Clause-Patent > > > > + > > > > +**/ > > > > + > > > > + > > > > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ > > > > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ > > > > + > > > > +#include > > > > +#include > > > > + > > > > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL > > > > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL; > > > > + > > > > +// > > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY proto= col > > > > interface adheres. > > > > +// All future revisions must be backwards compatible. > > > > +// If a future version is not back wards compatible it is= not the same > > > > GUID. > > > > +// > > > > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION > > > > 0x00010000 > > > > + > > > > +// > > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY struc= ture > > > > adheres. > > > > +// All future revisions must be backwards compatible. > > > > +// > > > > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000 > > > > + > > > > +/// > > > > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLI= CY > > > > +/// > > > > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED BIT0 > > > > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED BIT0 > > > > + > > > > +/// > > > > +/// The device security policy data structure /// typedef struct { > > > > + UINT32 Version; > > > > + UINT32 MeasurementPolicy; > > > > + UINT32 AuthenticationPolicy; > > > > +} EDKII_DEVICE_SECURITY_POLICY; > > > > + > > > > +// > > > > +// Revision The revision to which the DEVICE_SECURITY_STATE struct= ure > > > > adheres. > > > > +// All future revisions must be backwards compatible. > > > > +// > > > > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000 > > > > + > > > > +/// > > > > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE= /// > > > > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS = 0 > > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR = BIT31 > > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED > > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0) > > > > +#define > > > > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL > > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1) > > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES > > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10) > > > > +#define > EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR > > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20) > > > > + > > > > +/// > > > > +/// The device security state data structure /// typedef struct { > > > > + UINT32 Version; > > > > + UINT32 MeasurementState; > > > > + UINT32 AuthenticationState; > > > > +} EDKII_DEVICE_SECURITY_STATE; > > > > + > > > > +/** > > > > + This function returns the device security policy associated with= the > device. > > > > + > > > > + The device security driver may call this interface to get the > > > > + platform policy for the specific device and determine if the > > > > + measurement or authentication is required. > > > > + > > > > + @param[in] This The protocol instance pointer= . > > > > + @param[in] DeviceId The Identifier for the device= . > > > > + @param[out] DeviceSecurityPolicy The Device Security Policy > associated > > > > with the device. > > > > + > > > > + @retval EFI_SUCCESS The device security policy is= returned > > > > + @retval EFI_UNSUPPORTED The function is unsupported f= or the > > > > specific Device. > > > > +**/ > > > > +typedef > > > > +EFI_STATUS > > > > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) ( > > > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > > > + OUT EDKII_DEVICE_SECURITY_POLICY *DeviceSecurityPolicy > > > > + ); > > > > + > > > > +/** > > > > + This function sets the device state based upon the authenticatio= n result. > > > > + > > > > + The device security driver may call this interface to give the > > > > + platform a notify based upon the measurement or authentication r= esult. > > > > + If the authentication or measurement fails, the platform may cho= ose: > > > > + 1) Do nothing. > > > > + 2) Disable this device or slot temporarily and continue boot. > > > > + 3) Reset the platform and retry again. > > > > + 4) Disable this device or slot permanently. > > > > + 5) Any other platform specific action. > > > > + > > > > + @param[in] This The protocol instance pointer= . > > > > + @param[in] DeviceId The Identifier for the device= . > > > > + @param[in] DeviceSecurityState The Device Security state ass= ociated > > > > with the device. > > > > + > > > > + @retval EFI_SUCCESS The device state is set. > > > > + @retval EFI_UNSUPPORTED The function is unsupported f= or the > > > > specific Device. > > > > +**/ > > > > +typedef > > > > +EFI_STATUS > > > > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) ( > > > > + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, > > > > + IN EDKII_DEVICE_IDENTIFIER *DeviceId, > > > > + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState > > > > + ); > > > > + > > > > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL { > > > > + UINT32 Version; > > > > + EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY GetDevicePolicy; > > > > + EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE NotifyDeviceState; > > > > +}; > > > > + > > > > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid; > > > > + > > > > +#endif > > > > -- > > > > 2.19.2.windows.1