From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by mx.groups.io with SMTP id smtpd.web10.924.1573077034644018509 for ; Wed, 06 Nov 2019 13:50:34 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.24, mailfrom: rangasai.v.chaganty@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Nov 2019 13:50:33 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,275,1569308400"; d="scan'208";a="233029356" Received: from fmsmsx106.amr.corp.intel.com ([10.18.124.204]) by fmsmga002.fm.intel.com with ESMTP; 06 Nov 2019 13:50:33 -0800 Received: from fmsmsx155.amr.corp.intel.com (10.18.116.71) by FMSMSX106.amr.corp.intel.com (10.18.124.204) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 6 Nov 2019 13:50:33 -0800 Received: from fmsmsx104.amr.corp.intel.com ([169.254.3.133]) by FMSMSX155.amr.corp.intel.com ([169.254.5.15]) with mapi id 14.03.0439.000; Wed, 6 Nov 2019 13:50:32 -0800 From: "Chaganty, Rangasai V" To: "Yao, Jiewen" , "devel@edk2.groups.io" CC: "Ni, Ray" , "Lou, Yun" Subject: Re: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Topic: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol Thread-Index: AQHVj+cplIqpp/OC20WgOXdKz8mg6ad+tuXQ Date: Wed, 6 Nov 2019 21:50:32 +0000 Message-ID: References: <20191031123127.10900-1-jiewen.yao@intel.com> <20191031123127.10900-3-jiewen.yao@intel.com> In-Reply-To: <20191031123127.10900-3-jiewen.yao@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZDk5NGY5OTAtYzc5ZS00ZDYyLWExZDItNmMzYmE2YWI0ZjRhIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiOW5XUTI0dHcxYmJUeVlUSUl1Mm92RTREaVJxbWVNbE1YN1l3Zm5OMVpWbXlvSUMrTWs1VTF3eGZLUEp0dUU2aSJ9 x-ctpclassification: CTP_NT x-originating-ip: [10.1.200.108] MIME-Version: 1.0 Return-Path: rangasai.v.chaganty@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Same feedback as provided in patch1/6.=20 In addition, is there a reason to add "EDKII" as prefix in the internal dat= a structure names? E.g. +typedef struct { + UINT32 Version; // 0x1 + UINT32 MeasurementPolicy; + UINT32 AuthenticationPolicy; +} EDKII_DEVICE_SECURITY_POLICY; // this can be named simply as "DEVICE_SEC= URITY_POLICY" right? Also, on the services "GetDevicePolicy" and "SetDeviceState", is it possibl= e to have any other return states than EFI_SUCCESS? Regards, Sai -----Original Message----- From: Yao, Jiewen=20 Sent: Thursday, October 31, 2019 5:31 AM To: devel@edk2.groups.io Cc: Ni, Ray ; Chaganty, Rangasai V ; Lou, Yun Subject: [PATCH V2 2/6] IntelSiliconPkg/Include: Add Platform Device Securi= ty Policy protocol REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2303 Cc: Ray Ni Cc: Rangasai V Chaganty Cc: Yun Lou Signed-off-by: Jiewen Yao --- Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic= y.h | 84 ++++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceS= ecurityPolicy.h b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDe= viceSecurityPolicy.h new file mode 100644 index 0000000000..cb5a71ad41 --- /dev/null +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurity= Policy.h @@ -0,0 +1,84 @@ +/** @file + Device Security Policy Protocol definition + + Copyright (c) 2019, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + + +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__ + +#include +#include + +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL EDKII_DEVICE_SECURIT= Y_POLICY_PROTOCOL; + +typedef struct { + UINT32 Version; // 0x1 + UINT32 MeasurementPolicy; + UINT32 AuthenticationPolicy; +} EDKII_DEVICE_SECURITY_POLICY; + +// BIT0 means if the action is needed or NOT +#define EDKII_DEVICE_MEASUREMENT_POLICY_REQUIRED BIT0 +#define EDKII_DEVICE_AUTHENTICATION_POLICY_REQUIRED BIT0 + +typedef struct { + UINT32 Version; // 0x1 + UINT32 MeasurementState; + UINT32 AuthenticationState; +} EDKII_DEVICE_SECURITY_STATE; + +// All zero means success +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS 0 +#define EDKII_DEVICE_SECURITY_STATE_ERROR BIT31 +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED (EDKI= I_DEVICE_SECURITY_STATE_ERROR + 0x0) +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL (EDKI= I_DEVICE_SECURITY_STATE_ERROR + 0x1) +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES (EDKI= I_DEVICE_SECURITY_STATE_ERROR + 0x10) +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR (EDKI= I_DEVICE_SECURITY_STATE_ERROR + 0x20) + +/** + This function returns the device security policy associated with the dev= ice. + + @param[in] This The protocol instance pointer. + @param[in] DeviceId The Identifier for the device. + @param[out] DeviceSecurityPolicy The Device Security Policy associated= with the device. + + @retval EFI_SUCCESS The device security policy is returne= d +**/ +typedef +EFI_STATUS +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) ( + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, + IN EDKII_DEVICE_IDENTIFIER *DeviceId, + OUT EDKII_DEVICE_SECURITY_POLICY **DeviceSecurityPolicy + ); + +/** + This function sets the device state based upon the authentication result= . + + @param[in] This The protocol instance pointer. + @param[in] DeviceId The Identifier for the device. + @param[in] DeviceSecurityState The Device Security state associated = with the device. + + @retval EFI_SUCCESS The device state is set +**/ +typedef +EFI_STATUS +(EFIAPI *EDKII_DEVICE_SECURITY_SET_DEVICE_STATE) ( + IN EDKII_DEVICE_SECURITY_POLICY_PROTOCOL *This, + IN EDKII_DEVICE_IDENTIFIER *DeviceId, + IN EDKII_DEVICE_SECURITY_STATE *DeviceSecurityState + ); + +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL { + UINT32 Version; // 0x1 + EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY GetDevicePolicy; + EDKII_DEVICE_SECURITY_SET_DEVICE_STATE SetDeviceState; +}; + +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid; + +#endif --=20 2.19.2.windows.1