[edk2-devel][edk2-platforms][PATCH v1 2/7] KabylakeOpenBoardPkg/AspireVn7Dash572G: Enhance the build-logic

["Benjamin Doron" <benjamin.doron00@gmail.com>]

Update the AspireVn7Dash572G DSC files with assorted enhancements since
the initial porting work. Some planned features, such as Secure Boot and
measuring the default FSP UPDs to a TPM (which does have security
relevance), are now fully working.

Enable the working advanced features in use on this board.

Cc: Sai Chaganty <rangasai.v.chaganty@intel.com>
Cc: Isaac Oram <isaac.w.oram@intel.com>
Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
Cc: Chasel Chiu <chasel.chiu@intel.com>
Signed-off-by: Benjamin Doron <benjamin.doron00@gmail.com>
---
 .../AspireVn7Dash572G/OpenBoardPkg.dsc        | 63 +++++++++++--------
 .../AspireVn7Dash572G/OpenBoardPkgPcd.dsc     | 59 ++++++++++-------
 2 files changed, 74 insertions(+), 48 deletions(-)

diff --git a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc
index f4552ee83d6b..75c537f1253f 100644
--- a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc
+++ b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc
@@ -22,15 +22,6 @@
   #
   DEFINE BIOS_SIZE_OPTION = SIZE_60
 
-  #
-  # Debug logging
-  #
-  DEFINE USE_HDMI_DEBUG_PORT  = FALSE
-  DEFINE USE_PEI_SPI_LOGGING  = FALSE
-  DEFINE USE_MEMORY_LOGGING   = FALSE
-  DEFINE RELEASE_LOGGING      = ($(USE_HDMI_DEBUG_PORT) || $(USE_PEI_SPI_LOGGING) || $(USE_MEMORY_LOGGING))
-  DEFINE TESTING              = TRUE
-
   PLATFORM_NAME                               = $(PLATFORM_PACKAGE)
   PLATFORM_GUID                               = AEEEF17C-36B6-4B68-949A-1E54CB33492F
   PLATFORM_VERSION                            = 0.1
@@ -40,9 +31,17 @@
   BUILD_TARGETS                               = DEBUG|RELEASE
   SKUID_IDENTIFIER                            = ALL
   FLASH_DEFINITION                            = $(PROJECT)/OpenBoardPkg.fdf
-
   FIX_LOAD_TOP_MEMORY_ADDRESS                 = 0x0
 
+  #
+  # Debug logging
+  #
+  DEFINE USE_HDMI_DEBUG_PORT  = FALSE
+  DEFINE USE_PEI_SPI_LOGGING  = FALSE
+  DEFINE USE_MEMORY_LOGGING   = FALSE
+  DEFINE RELEASE_LOGGING      = ($(USE_HDMI_DEBUG_PORT) || $(USE_PEI_SPI_LOGGING) || $(USE_MEMORY_LOGGING))
+  DEFINE TESTING              = FALSE
+
   #
   # Include PCD configuration for this board.
   #
@@ -143,7 +142,7 @@
   #######################################
   FspWrapperApiLib|IntelFsp2WrapperPkg/Library/BaseFspWrapperApiLib/BaseFspWrapperApiLib.inf
   FspWrapperApiTestLib|IntelFsp2WrapperPkg/Library/PeiFspWrapperApiTestLib/PeiFspWrapperApiTestLib.inf
-  # This board will set debugging library instances; FIXME: UART2 not used
+  # Board DSC will select debug library instances; NOTE: UART2 not used
   SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
 
   #######################################
@@ -198,12 +197,11 @@
   #######################################
   PlatformHookLib|MdeModulePkg/Library/BasePlatformHookLibNull/BasePlatformHookLibNull.inf
 
-# NB: MinPlatform sets a NULL DebugLib and only overrides it for DEBUG builds
-# TODO: Now that all debug logging is routed through RSC, correct the defines
 [LibraryClasses.IA32.SEC]
   #######################################
   # Edk2 Packages
   #######################################
+# NOTE: No way that RSC avoids PeiServices in SEC? Even if valid on re-entry...
   DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
 
 !if $(USE_HDMI_DEBUG_PORT) == TRUE
@@ -231,7 +229,8 @@
   # Edk2 Packages
   #######################################
 # SPI logging requires local patch: InitializeMemoryServices() before ProcessLibraryConstructorList()
-# In-memory logging may require too many services for early core debug output
+# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug
+# - While RSC calls Initialize after dependencies and constructors are satisfied
 !if $(RELEASE_LOGGING) == TRUE
   DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
 !endif
@@ -257,7 +256,7 @@
   FspWrapperPlatformLib|$(PLATFORM_PACKAGE)/FspWrapper/Library/PeiFspWrapperPlatformLib/PeiFspWrapperPlatformLib.inf
   MultiBoardInitSupportLib|$(PLATFORM_PACKAGE)/PlatformInit/Library/MultiBoardInitSupportLib/PeiMultiBoardInitSupportLib.inf
   TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/PeiTestPointLib.inf
-!if ($(TARGET) == DEBUG || $(TESTING) == TRUE)
+!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE)
   TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/PeiTestPointCheckLib.inf
 !endif
   SetCacheMtrrLib|$(PLATFORM_PACKAGE)/Library/SetCacheMtrrLib/SetCacheMtrrLibNull.inf
@@ -287,7 +286,8 @@
   #######################################
   # Edk2 Packages
   #######################################
-# In-memory logging may require too many services for early core debug output
+# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug
+# - While RSC calls Initialize after dependencies and constructors are satisfied
 !if ($(USE_MEMORY_LOGGING) == TRUE || $(USE_HDMI_DEBUG_PORT) == TRUE)
   DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
 !endif
@@ -315,7 +315,7 @@
   MultiBoardInitSupportLib|$(PLATFORM_PACKAGE)/PlatformInit/Library/MultiBoardInitSupportLib/DxeMultiBoardInitSupportLib.inf
   TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/DxeTestPointLib.inf
 
-!if ($(TARGET) == DEBUG || $(TESTING) == TRUE)
+!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE)
   TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/DxeTestPointCheckLib.inf
 !endif
   #######################################
@@ -346,7 +346,8 @@
   #######################################
   # Edk2 Packages
   #######################################
-# In-memory logging may require too many services for early core debug output
+# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug
+# - While RSC calls Initialize after dependencies and constructors are satisfied
 !if ($(USE_MEMORY_LOGGING) == TRUE || $(USE_HDMI_DEBUG_PORT) == TRUE)
   DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf
 !endif
@@ -370,7 +371,7 @@
   BoardAcpiEnableLib|$(PLATFORM_PACKAGE)/Acpi/Library/MultiBoardAcpiSupportLib/SmmMultiBoardAcpiSupportLib.inf
   MultiBoardAcpiSupportLib|$(PLATFORM_PACKAGE)/Acpi/Library/MultiBoardAcpiSupportLib/SmmMultiBoardAcpiSupportLib.inf
   TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/SmmTestPointLib.inf
-!if ($(TARGET) == DEBUG || $(TESTING) == TRUE)
+!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE)
   TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/SmmTestPointCheckLib.inf
 !endif
 
@@ -408,12 +409,12 @@
   MdeModulePkg/Universal/StatusCodeHandler/Pei/StatusCodeHandlerPei.inf {
     <LibraryClasses>
       DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
+      # Reverse-ranked priority list
+!if $(USE_MEMORY_LOGGING) == TRUE
+      SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/PeiSerialPortLibMem.inf
+!endif
 !if $(USE_PEI_SPI_LOGGING) == TRUE
       SerialPortLib|$(PLATFORM_BOARD_PACKAGE)/Library/PeiSerialPortLibSpiFlash/PeiSerialPortLibSpiFlash.inf
-!else
-!if $(USE_MEMORY_LOGGING) == TRUE
-      SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/PeiSerialPortLibMem.inf
-!endif
 !endif
 !if $(USE_HDMI_DEBUG_PORT) == TRUE
       SerialPortLib|$(PLATFORM_BOARD_PACKAGE)/Library/I2cHdmiDebugSerialPortLib/PeiI2cHdmiDebugSerialPortLib.inf
@@ -431,10 +432,14 @@
   IntelFsp2WrapperPkg/FspmWrapperPeim/FspmWrapperPeim.inf {
     <LibraryClasses>
       SiliconPolicyInitLib|$(PLATFORM_SI_PACKAGE)/Library/PeiSiliconPolicyInitLibDependency/PeiPreMemSiliconPolicyInitLibDependency.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
   }
   IntelFsp2WrapperPkg/FspsWrapperPeim/FspsWrapperPeim.inf {
     <LibraryClasses>
       SiliconPolicyInitLib|$(PLATFORM_SI_PACKAGE)/Library/PeiSiliconPolicyInitLibDependency/PeiPostMemSiliconPolicyInitLibDependency.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
   }
 !else
   #
@@ -444,6 +449,8 @@
   IntelFsp2WrapperPkg/FspmWrapperPeim/FspmWrapperPeim.inf {
     <LibraryClasses>
       SiliconPolicyInitLib|MinPlatformPkg/PlatformInit/Library/SiliconPolicyInitLibNull/SiliconPolicyInitLibNull.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
   }
   #
   # In FSP Dispatch mode the policy will be installed after FSP-S dispatched (only PrePolicy silicon-init executed).
@@ -452,6 +459,8 @@
   IntelFsp2WrapperPkg/FspsWrapperPeim/FspsWrapperPeim.inf {
     <LibraryClasses>
       SiliconPolicyInitLib|MinPlatformPkg/PlatformInit/Library/SiliconPolicyInitLibNull/SiliconPolicyInitLibNull.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf
+      NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf
   }
 !endif
 
@@ -555,6 +564,7 @@
   MdeModulePkg/Universal/StatusCodeHandler/RuntimeDxe/StatusCodeHandlerRuntimeDxe.inf {
     <LibraryClasses>
       DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
+      # Reverse-ranked priority list
 !if $(USE_MEMORY_LOGGING) == TRUE
       SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/DxeSerialPortLibMem.inf
 !endif
@@ -563,12 +573,12 @@
 !endif
     <PcdsFixedAtBuild>
       gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|($(USE_MEMORY_LOGGING) || $(USE_HDMI_DEBUG_PORT))
-      gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|512
+      gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1024
   }
-  # TODO: Still requires a little more thought
   MdeModulePkg/Universal/StatusCodeHandler/Smm/StatusCodeHandlerSmm.inf {
     <LibraryClasses>
       DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
+      # Reverse-ranked priority list
 !if $(USE_MEMORY_LOGGING) == TRUE
       SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/SmmSerialPortLibMem.inf
 !endif
@@ -577,8 +587,9 @@
 !endif
     <PcdsFixedAtBuild>
       gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|($(USE_MEMORY_LOGGING) || $(USE_HDMI_DEBUG_PORT))
-      gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|512
+      gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1024
   }
+# TODO: Add NvmExpressDxe if supporting Newgate and RayleighSLS
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
   MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciHostBridgeDxe.inf
diff --git a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc
index 490c3ee6bf76..3991c6f17c44 100644
--- a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc
+++ b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc
@@ -13,9 +13,10 @@
 #
 ################################################################################
 
-# TODO: Harden and tune platform by PCDs
-# TODO: Consider removing PCDs declared by build report to be unused (but confirm first)
-# - Also, consider more "fixed" and more "dynamic"/"patchable"
+# TODO:
+# - Harden and tune platform by PCDs
+# - Consider removing PCDs declared by build report to be unused (but confirm first)
+#   - Also, consider more "fixed" and more "dynamic"/"patchable"
 
 [PcdsFixedAtBuild.common]
   ######################################
@@ -118,13 +119,14 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdPs2MouseExtendedVerification|FALSE  # TODO/TEST
   gEfiMdeModulePkgTokenSpaceGuid.PcdHiiOsRuntimeSupport|FALSE
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmEnableBspElection|FALSE
+  # TODO: Hook-up memory, SMM and SMI handler profiling
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmProfileEnable|FALSE
 
 # TODO: Prune this list to relevant features only
 !if gMinPlatformPkgTokenSpaceGuid.PcdBootStage >= 6
-  # FIXME: SMM path also PatchAndLoadAcpiTable()
-  gAcpiDebugFeaturePkgTokenSpaceGuid.PcdAcpiDebugFeatureEnable            |FALSE
-  # PcdIpmiFeatureEnable will not be enabled (no BMC)
+  gAcpiDebugFeaturePkgTokenSpaceGuid.PcdAcpiDebugFeatureEnable            |TRUE
+  gAcpiDebugFeaturePkgTokenSpaceGuid.PcdUseSmmVersion                     |FALSE
+# NOTE: PcdIpmiFeatureEnable will not be enabled (no BMC)
   # TODO: Can be build-time (user) choice
   gNetworkFeaturePkgTokenSpaceGuid.PcdNetworkFeatureEnable                |FALSE
   gS3FeaturePkgTokenSpaceGuid.PcdS3FeatureEnable                          |TRUE
@@ -132,12 +134,9 @@
   gSmbiosFeaturePkgTokenSpaceGuid.PcdSmbiosFeatureEnable                  |TRUE
   # Requires actual hook-up
   gUsb3DebugFeaturePkgTokenSpaceGuid.PcdUsb3DebugFeatureEnable            |FALSE
-  # FIXME: (Similar) DXE module is duplicate?
-  gUserAuthFeaturePkgTokenSpaceGuid.PcdUserAuthenticationFeatureEnable    |FALSE
-  # FIXME: Must BootLogoEnableLogo() to turn platform logo into boot logo
-  # - BGRT must be BMP, but this duplicates FSP logo. Can GetSectionFromAnyFv()?
-  gLogoFeaturePkgTokenSpaceGuid.PcdLogoFeatureEnable                      |FALSE
-  gLogoFeaturePkgTokenSpaceGuid.PcdJpgEnable                              |FALSE
+  # FIXME: Version2 not working - doesn't challenge for password
+  gUserAuthFeaturePkgTokenSpaceGuid.PcdUserAuthenticationFeatureEnable    |TRUE
+  gLogoFeaturePkgTokenSpaceGuid.PcdLogoFeatureEnable                      |TRUE
 !endif
 
   ######################################
@@ -209,7 +208,7 @@
   # Board Configuration
   ######################################
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdMultiBoardSupport|FALSE
-  gKabylakeOpenBoardPkgTokenSpaceGuid.PcdTbtEnable|FALSE  # TODO: Enable if supporting Newgate
+  gKabylakeOpenBoardPkgTokenSpaceGuid.PcdTbtEnable|FALSE  # TODO: Enable if supporting Newgate and RayleighSLS
 
 [PcdsFixedAtBuild.common]
   ######################################
@@ -245,16 +244,29 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdBrowserSubtitleTextColor|0x0
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard|TRUE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFastPS2Detection|TRUE  # TODO/TEST
+!if FALSE  # FIXME: Causes DxeTestPointCheck ASSERT
+  # Guard DXE phase in non-stop mode, preferred over UAF detection (mutually exclusive)
+  # NOTE: SMM phase requires disabling PcdCpuSmmRestrictedMemoryAccess, so only enable to test
+  # TODO/TEST: Also test with guarded pool-head and with UAF detection feature
+  gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask|0x43
+#!else
+  # Guard DXE phase preferred over UAF detection (mutually exclusive)
+  # TODO: Consider performance impact on release builds
+  gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask|0x03
+!endif
+  # Protects loader, BS and RT code and data. TODO: Should not protect code and also ACPI memory?
+  gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPageType|0x7E
+  gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType|0x7E
   gEfiMdeModulePkgTokenSpaceGuid.PcdHwErrStorageSize|0x00000800
   gEfiMdeModulePkgTokenSpaceGuid.PcdLoadModuleAtFixAddressEnable|$(TOP_MEMORY_ADDRESS)
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x400
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8000
-!if $(TESTING) == TRUE
-  # Test with non-stop mode, so not disabling for loader.
-  gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x43
+!if $(RELEASE_LOGGING) == TRUE
+  # Using non-stop mode, so not disabling for loader. NOTE/TEST: Reconsider use with SMM, which causes SMM profiling to be enabled
+  gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x41
 !else
-  # FIXME: Can be broken for CSM. At this time, be permissive for loader.
-  gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x83
+  # FIXME: At this time, be permissive for loader
+  gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x81
 !endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdReclaimVariableSpaceAtEndOfDxe|TRUE
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE
@@ -269,10 +281,10 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdSerialUseHardwareFlowControl|FALSE
 !endif
 
-  # UPDs are updated at runtime, don't bother measuring
+  # Measure default UPDs, code to update UPDs is measured as well
   # BUGBUG: FSP-S measurement returns DEVICE_ERROR from PtpCrbTpmCommand() - Step 0.
   # - Similarly, Tcg2Dxe.c:Tpm2GetCapabilityManufactureID() - first command - fails?
-  gIntelFsp2WrapperTokenSpaceGuid.PcdFspMeasurementConfig|0x00000006
+  gIntelFsp2WrapperTokenSpaceGuid.PcdFspMeasurementConfig|0x80000006
 
   gPcAtChipsetPkgTokenSpaceGuid.PcdAcpiIoBarEnableMask|0x80
   gPcAtChipsetPkgTokenSpaceGuid.PcdAcpiIoPciBarRegisterOffset|0x40
@@ -435,6 +447,9 @@
   # @ValidRange 0x80000001 | 0 - 4
   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|3
 
+  # Hypothetically, remove all but the trusted console input, but there's no callback
+  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
+
 [PcdsFixedAtBuild.IA32]
   ######################################
   # Edk2 Configuration
@@ -522,7 +537,7 @@
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdLowPowerS0Idle|1
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdPciExpNative|1
 
-  # Thunderbolt Configuration (FIXME: Remove if not supporting Newgate)
+  # Thunderbolt Configuration (FIXME: Remove if not supporting Newgate and RayleighSLS)
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcDcSwitch|0x0
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcpiGpeSignature|0
   gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcpiGpeSignaturePorting|0
@@ -567,5 +582,5 @@
 !endif
 !if gMinPlatformPkgTokenSpaceGuid.PcdTpm2Enable == TRUE
   gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x0|"1.3"|NV,BS
-  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableRev|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x8|3|NV,BS
+  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableRev|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x8|4|NV,BS
 !endif
-- 
2.37.2