1. Patchew
  2. EDK2
  3. [edk2-devel] [PATCH V3 0/6] Add Device Security driver
  4. View patch

[edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol

Yao, Jiewen posted 6 patches 6 years, 3 months ago
[edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Posted by Yao, Jiewen 6 years, 3 months ago 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303

Cc: Ray Ni <ray.ni@intel.com>
Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
Cc: Yun Lou <yun.lou@intel.com>
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
---
 .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h

diff --git a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
new file mode 100644
index 0000000000..b151781de2
--- /dev/null
+++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
@@ -0,0 +1,128 @@
+/** @file
+  Platform Device Security Policy Protocol definition
+
+  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+
+#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
+#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
+
+#include <Uefi.h>
+#include <Protocol/DeviceSecurity.h>
+
+typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
+
+//
+// Revision The revision to which the DEVICE_SECURITY_POLICY protocol interface adheres.
+//          All future revisions must be backwards compatible.
+//          If a future version is not back wards compatible it is not the same GUID.
+//
+#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION 0x00010000
+
+//
+// Revision The revision to which the DEVICE_SECURITY_POLICY structure adheres.
+//          All future revisions must be backwards compatible.
+//
+#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
+
+///
+/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
+///
+#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
+#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
+
+///
+/// The device security policy data structure
+///
+typedef struct {
+  UINT32     Version;
+  UINT32     MeasurementPolicy;
+  UINT32     AuthenticationPolicy;
+} EDKII_DEVICE_SECURITY_POLICY;
+
+//
+// Revision The revision to which the DEVICE_SECURITY_STATE structure adheres.
+//          All future revisions must be backwards compatible.
+//
+#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
+
+///
+/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE
+///
+#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
+#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
+#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED           (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
+#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL   (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
+#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES        (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
+#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR         (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
+
+///
+/// The device security state data structure
+///
+typedef struct {
+  UINT32     Version;
+  UINT32     MeasurementState;
+  UINT32     AuthenticationState;
+} EDKII_DEVICE_SECURITY_STATE;
+
+/**
+  This function returns the device security policy associated with the device.
+
+  The device security driver may call this interface to get the platform policy
+  for the specific device and determine if the measurement or authentication
+  is required.
+
+  @param[in]  This                   The protocol instance pointer.
+  @param[in]  DeviceId               The Identifier for the device.
+  @param[out] DeviceSecurityPolicy   The Device Security Policy associated with the device.
+
+  @retval EFI_SUCCESS                The device security policy is returned
+  @retval EFI_UNSUPPORTED            The function is unsupported for the specific Device.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
+  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
+  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
+  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
+  );
+
+/**
+  This function sets the device state based upon the authentication result.
+
+  The device security driver may call this interface to give the platform
+  a notify based upon the measurement or authentication result.
+  If the authentication or measurement fails, the platform may choose:
+  1) Do nothing.
+  2) Disable this device or slot temporarily and continue boot.
+  3) Reset the platform and retry again.
+  4) Disable this device or slot permanently.
+  5) Any other platform specific action.
+
+  @param[in]  This                   The protocol instance pointer.
+  @param[in]  DeviceId               The Identifier for the device.
+  @param[in]  DeviceSecurityState    The Device Security state associated with the device.
+
+  @retval EFI_SUCCESS                The device state is set.
+  @retval EFI_UNSUPPORTED            The function is unsupported for the specific Device.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
+  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
+  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
+  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
+  );
+
+struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
+  UINT32                                      Version;
+  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
+  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
+};
+
+extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
+
+#endif
-- 
2.19.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#50221): https://edk2.groups.io/g/devel/message/50221
Mute This Topic: https://groups.io/mt/46027906/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Posted by Ni, Ray 6 years, 3 months ago 
Jiewen,
The structure field is named "Version" while the macro is ended with "_REVISION".
Is there a special reason for such inconsistency?

Thanks,
Ray

> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Thursday, November 7, 2019 9:38 PM
> To: devel@edk2.groups.io
> Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> 
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> Cc: Yun Lou <yun.lou@intel.com>
> Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> ---
>  .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
>  1 file changed, 128 insertions(+)
>  create mode 100644
> Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> 
> diff --git
> a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> y.h
> b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> y.h
> new file mode 100644
> index 0000000000..b151781de2
> --- /dev/null
> +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> +++ ityPolicy.h
> @@ -0,0 +1,128 @@
> +/** @file
> +  Platform Device Security Policy Protocol definition
> +
> +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> +  SPDX-License-Identifier: BSD-2-Clause-Patent
> +
> +**/
> +
> +
> +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> +
> +#include <Uefi.h>
> +#include <Protocol/DeviceSecurity.h>
> +
> +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> interface adheres.
> +//          All future revisions must be backwards compatible.
> +//          If a future version is not back wards compatible it is not the same
> GUID.
> +//
> +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> 0x00010000
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> adheres.
> +//          All future revisions must be backwards compatible.
> +//
> +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> +
> +///
> +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> +///
> +#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
> +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
> +
> +///
> +/// The device security policy data structure /// typedef struct {
> +  UINT32     Version;
> +  UINT32     MeasurementPolicy;
> +  UINT32     AuthenticationPolicy;
> +} EDKII_DEVICE_SECURITY_POLICY;
> +
> +//
> +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> adheres.
> +//          All future revisions must be backwards compatible.
> +//
> +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> +
> +///
> +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> +#define
> EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> +
> +///
> +/// The device security state data structure /// typedef struct {
> +  UINT32     Version;
> +  UINT32     MeasurementState;
> +  UINT32     AuthenticationState;
> +} EDKII_DEVICE_SECURITY_STATE;
> +
> +/**
> +  This function returns the device security policy associated with the device.
> +
> +  The device security driver may call this interface to get the
> + platform policy  for the specific device and determine if the
> + measurement or authentication  is required.
> +
> +  @param[in]  This                   The protocol instance pointer.
> +  @param[in]  DeviceId               The Identifier for the device.
> +  @param[out] DeviceSecurityPolicy   The Device Security Policy associated
> with the device.
> +
> +  @retval EFI_SUCCESS                The device security policy is returned
> +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> specific Device.
> +**/
> +typedef
> +EFI_STATUS
> +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> +  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
> +  );
> +
> +/**
> +  This function sets the device state based upon the authentication result.
> +
> +  The device security driver may call this interface to give the
> + platform  a notify based upon the measurement or authentication result.
> +  If the authentication or measurement fails, the platform may choose:
> +  1) Do nothing.
> +  2) Disable this device or slot temporarily and continue boot.
> +  3) Reset the platform and retry again.
> +  4) Disable this device or slot permanently.
> +  5) Any other platform specific action.
> +
> +  @param[in]  This                   The protocol instance pointer.
> +  @param[in]  DeviceId               The Identifier for the device.
> +  @param[in]  DeviceSecurityState    The Device Security state associated
> with the device.
> +
> +  @retval EFI_SUCCESS                The device state is set.
> +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> specific Device.
> +**/
> +typedef
> +EFI_STATUS
> +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> +  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
> +  );
> +
> +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> +  UINT32                                      Version;
> +  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
> +  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
> +};
> +
> +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> +
> +#endif
> --
> 2.19.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#50290): https://edk2.groups.io/g/devel/message/50290
Mute This Topic: https://groups.io/mt/46027906/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Posted by Yao, Jiewen 6 years, 3 months ago 
Good catch.
No special meaning.

I will use _VERSION.

Thank you
Yao Jiewen

> -----Original Message-----
> From: Ni, Ray <ray.ni@intel.com>
> Sent: Friday, November 8, 2019 3:00 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> <yun.lou@intel.com>
> Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> 
> Jiewen,
> The structure field is named "Version" while the macro is ended with
> "_REVISION".
> Is there a special reason for such inconsistency?
> 
> Thanks,
> Ray
> 
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Thursday, November 7, 2019 9:38 PM
> > To: devel@edk2.groups.io
> > Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> > <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > Security Policy protocol
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> >
> > Cc: Ray Ni <ray.ni@intel.com>
> > Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> > Cc: Yun Lou <yun.lou@intel.com>
> > Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> > ---
> >  .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
> >  1 file changed, 128 insertions(+)
> >  create mode 100644
> > Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> >
> > diff --git
> > a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > y.h
> > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > y.h
> > new file mode 100644
> > index 0000000000..b151781de2
> > --- /dev/null
> > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> > +++ ityPolicy.h
> > @@ -0,0 +1,128 @@
> > +/** @file
> > +  Platform Device Security Policy Protocol definition
> > +
> > +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > +  SPDX-License-Identifier: BSD-2-Clause-Patent
> > +
> > +**/
> > +
> > +
> > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > +
> > +#include <Uefi.h>
> > +#include <Protocol/DeviceSecurity.h>
> > +
> > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> > interface adheres.
> > +//          All future revisions must be backwards compatible.
> > +//          If a future version is not back wards compatible it is not the same
> > GUID.
> > +//
> > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> > 0x00010000
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> > adheres.
> > +//          All future revisions must be backwards compatible.
> > +//
> > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> > +
> > +///
> > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> > +///
> > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
> > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
> > +
> > +///
> > +/// The device security policy data structure /// typedef struct {
> > +  UINT32     Version;
> > +  UINT32     MeasurementPolicy;
> > +  UINT32     AuthenticationPolicy;
> > +} EDKII_DEVICE_SECURITY_POLICY;
> > +
> > +//
> > +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> > adheres.
> > +//          All future revisions must be backwards compatible.
> > +//
> > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> > +
> > +///
> > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> > +#define
> > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> > +
> > +///
> > +/// The device security state data structure /// typedef struct {
> > +  UINT32     Version;
> > +  UINT32     MeasurementState;
> > +  UINT32     AuthenticationState;
> > +} EDKII_DEVICE_SECURITY_STATE;
> > +
> > +/**
> > +  This function returns the device security policy associated with the device.
> > +
> > +  The device security driver may call this interface to get the
> > + platform policy  for the specific device and determine if the
> > + measurement or authentication  is required.
> > +
> > +  @param[in]  This                   The protocol instance pointer.
> > +  @param[in]  DeviceId               The Identifier for the device.
> > +  @param[out] DeviceSecurityPolicy   The Device Security Policy associated
> > with the device.
> > +
> > +  @retval EFI_SUCCESS                The device security policy is returned
> > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > specific Device.
> > +**/
> > +typedef
> > +EFI_STATUS
> > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > +  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
> > +  );
> > +
> > +/**
> > +  This function sets the device state based upon the authentication result.
> > +
> > +  The device security driver may call this interface to give the
> > + platform  a notify based upon the measurement or authentication result.
> > +  If the authentication or measurement fails, the platform may choose:
> > +  1) Do nothing.
> > +  2) Disable this device or slot temporarily and continue boot.
> > +  3) Reset the platform and retry again.
> > +  4) Disable this device or slot permanently.
> > +  5) Any other platform specific action.
> > +
> > +  @param[in]  This                   The protocol instance pointer.
> > +  @param[in]  DeviceId               The Identifier for the device.
> > +  @param[in]  DeviceSecurityState    The Device Security state associated
> > with the device.
> > +
> > +  @retval EFI_SUCCESS                The device state is set.
> > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > specific Device.
> > +**/
> > +typedef
> > +EFI_STATUS
> > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > +  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
> > +  );
> > +
> > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> > +  UINT32                                      Version;
> > +  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
> > +  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
> > +};
> > +
> > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> > +
> > +#endif
> > --
> > 2.19.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#50292): https://edk2.groups.io/g/devel/message/50292
Mute This Topic: https://groups.io/mt/46027906/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Posted by Ni, Ray 6 years, 3 months ago 
With that, Reviewed-by: Ray Ni <ray.ni@intel.com>

> -----Original Message-----
> From: Yao, Jiewen <jiewen.yao@intel.com>
> Sent: Friday, November 8, 2019 3:01 PM
> To: Ni, Ray <ray.ni@intel.com>; devel@edk2.groups.io
> Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
> 
> Good catch.
> No special meaning.
> 
> I will use _VERSION.
> 
> Thank you
> Yao Jiewen
> 
> > -----Original Message-----
> > From: Ni, Ray <ray.ni@intel.com>
> > Sent: Friday, November 8, 2019 3:00 PM
> > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> > <yun.lou@intel.com>
> > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > Security Policy protocol
> >
> > Jiewen,
> > The structure field is named "Version" while the macro is ended with
> > "_REVISION".
> > Is there a special reason for such inconsistency?
> >
> > Thanks,
> > Ray
> >
> > > -----Original Message-----
> > > From: Yao, Jiewen <jiewen.yao@intel.com>
> > > Sent: Thursday, November 7, 2019 9:38 PM
> > > To: devel@edk2.groups.io
> > > Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> > > <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> > > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > > Security Policy protocol
> > >
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> > >
> > > Cc: Ray Ni <ray.ni@intel.com>
> > > Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> > > Cc: Yun Lou <yun.lou@intel.com>
> > > Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> > > ---
> > >  .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
> > >  1 file changed, 128 insertions(+)
> > >  create mode 100644
> > > Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> > >
> > > diff --git
> > > a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > y.h
> > > b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > y.h
> > > new file mode 100644
> > > index 0000000000..b151781de2
> > > --- /dev/null
> > > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> > > +++ ityPolicy.h
> > > @@ -0,0 +1,128 @@
> > > +/** @file
> > > +  Platform Device Security Policy Protocol definition
> > > +
> > > +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > > +  SPDX-License-Identifier: BSD-2-Clause-Patent
> > > +
> > > +**/
> > > +
> > > +
> > > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > +
> > > +#include <Uefi.h>
> > > +#include <Protocol/DeviceSecurity.h>
> > > +
> > > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> > > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> > > +
> > > +//
> > > +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> > > interface adheres.
> > > +//          All future revisions must be backwards compatible.
> > > +//          If a future version is not back wards compatible it is not the same
> > > GUID.
> > > +//
> > > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> > > 0x00010000
> > > +
> > > +//
> > > +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> > > adheres.
> > > +//          All future revisions must be backwards compatible.
> > > +//
> > > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> > > +
> > > +///
> > > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> > > +///
> > > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
> > > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
> > > +
> > > +///
> > > +/// The device security policy data structure /// typedef struct {
> > > +  UINT32     Version;
> > > +  UINT32     MeasurementPolicy;
> > > +  UINT32     AuthenticationPolicy;
> > > +} EDKII_DEVICE_SECURITY_POLICY;
> > > +
> > > +//
> > > +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> > > adheres.
> > > +//          All future revisions must be backwards compatible.
> > > +//
> > > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> > > +
> > > +///
> > > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> > > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
> > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
> > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> > > +#define
> > > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> > > +
> > > +///
> > > +/// The device security state data structure /// typedef struct {
> > > +  UINT32     Version;
> > > +  UINT32     MeasurementState;
> > > +  UINT32     AuthenticationState;
> > > +} EDKII_DEVICE_SECURITY_STATE;
> > > +
> > > +/**
> > > +  This function returns the device security policy associated with the device.
> > > +
> > > +  The device security driver may call this interface to get the
> > > + platform policy  for the specific device and determine if the
> > > + measurement or authentication  is required.
> > > +
> > > +  @param[in]  This                   The protocol instance pointer.
> > > +  @param[in]  DeviceId               The Identifier for the device.
> > > +  @param[out] DeviceSecurityPolicy   The Device Security Policy associated
> > > with the device.
> > > +
> > > +  @retval EFI_SUCCESS                The device security policy is returned
> > > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > > specific Device.
> > > +**/
> > > +typedef
> > > +EFI_STATUS
> > > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> > > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > > +  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
> > > +  );
> > > +
> > > +/**
> > > +  This function sets the device state based upon the authentication result.
> > > +
> > > +  The device security driver may call this interface to give the
> > > + platform  a notify based upon the measurement or authentication result.
> > > +  If the authentication or measurement fails, the platform may choose:
> > > +  1) Do nothing.
> > > +  2) Disable this device or slot temporarily and continue boot.
> > > +  3) Reset the platform and retry again.
> > > +  4) Disable this device or slot permanently.
> > > +  5) Any other platform specific action.
> > > +
> > > +  @param[in]  This                   The protocol instance pointer.
> > > +  @param[in]  DeviceId               The Identifier for the device.
> > > +  @param[in]  DeviceSecurityState    The Device Security state associated
> > > with the device.
> > > +
> > > +  @retval EFI_SUCCESS                The device state is set.
> > > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > > specific Device.
> > > +**/
> > > +typedef
> > > +EFI_STATUS
> > > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> > > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > > +  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
> > > +  );
> > > +
> > > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> > > +  UINT32                                      Version;
> > > +  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
> > > +  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
> > > +};
> > > +
> > > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> > > +
> > > +#endif
> > > --
> > > 2.19.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#50293): https://edk2.groups.io/g/devel/message/50293
Mute This Topic: https://groups.io/mt/46027906/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device Security Policy protocol
Posted by Yao, Jiewen 6 years, 3 months ago 
Hi Ray
I checked the UEFI spec and other protocol definition again.
I believe Revision is a better name for minor update. I will update the structure field from Version to Revision.

Thank you
Yao Jiewen

> -----Original Message-----
> From: Ni, Ray <ray.ni@intel.com>
> Sent: Friday, November 8, 2019 3:10 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> <yun.lou@intel.com>
> Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> 
> With that, Reviewed-by: Ray Ni <ray.ni@intel.com>
> 
> > -----Original Message-----
> > From: Yao, Jiewen <jiewen.yao@intel.com>
> > Sent: Friday, November 8, 2019 3:01 PM
> > To: Ni, Ray <ray.ni@intel.com>; devel@edk2.groups.io
> > Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> <yun.lou@intel.com>
> > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> Security Policy protocol
> >
> > Good catch.
> > No special meaning.
> >
> > I will use _VERSION.
> >
> > Thank you
> > Yao Jiewen
> >
> > > -----Original Message-----
> > > From: Ni, Ray <ray.ni@intel.com>
> > > Sent: Friday, November 8, 2019 3:00 PM
> > > To: Yao, Jiewen <jiewen.yao@intel.com>; devel@edk2.groups.io
> > > Cc: Chaganty, Rangasai V <rangasai.v.chaganty@intel.com>; Lou, Yun
> > > <yun.lou@intel.com>
> > > Subject: RE: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > > Security Policy protocol
> > >
> > > Jiewen,
> > > The structure field is named "Version" while the macro is ended with
> > > "_REVISION".
> > > Is there a special reason for such inconsistency?
> > >
> > > Thanks,
> > > Ray
> > >
> > > > -----Original Message-----
> > > > From: Yao, Jiewen <jiewen.yao@intel.com>
> > > > Sent: Thursday, November 7, 2019 9:38 PM
> > > > To: devel@edk2.groups.io
> > > > Cc: Ni, Ray <ray.ni@intel.com>; Chaganty, Rangasai V
> > > > <rangasai.v.chaganty@intel.com>; Lou, Yun <yun.lou@intel.com>
> > > > Subject: [PATCH V3 2/6] IntelSiliconPkg/Include: Add Platform Device
> > > > Security Policy protocol
> > > >
> > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2303
> > > >
> > > > Cc: Ray Ni <ray.ni@intel.com>
> > > > Cc: Rangasai V Chaganty <rangasai.v.chaganty@intel.com>
> > > > Cc: Yun Lou <yun.lou@intel.com>
> > > > Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
> > > > ---
> > > >  .../Protocol/PlatformDeviceSecurityPolicy.h   | 128 ++++++++++++++++++
> > > >  1 file changed, 128 insertions(+)
> > > >  create mode 100644
> > > >
> Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolicy.h
> > > >
> > > > diff --git
> > > >
> a/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > > y.h
> > > >
> b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecurityPolic
> > > > y.h
> > > > new file mode 100644
> > > > index 0000000000..b151781de2
> > > > --- /dev/null
> > > > +++ b/Silicon/Intel/IntelSiliconPkg/Include/Protocol/PlatformDeviceSecur
> > > > +++ ityPolicy.h
> > > > @@ -0,0 +1,128 @@
> > > > +/** @file
> > > > +  Platform Device Security Policy Protocol definition
> > > > +
> > > > +  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
> > > > +  SPDX-License-Identifier: BSD-2-Clause-Patent
> > > > +
> > > > +**/
> > > > +
> > > > +
> > > > +#ifndef __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > > +#define __EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_H__
> > > > +
> > > > +#include <Uefi.h>
> > > > +#include <Protocol/DeviceSecurity.h>
> > > > +
> > > > +typedef struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL
> > > > +EDKII_DEVICE_SECURITY_POLICY_PROTOCOL;
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY protocol
> > > > interface adheres.
> > > > +//          All future revisions must be backwards compatible.
> > > > +//          If a future version is not back wards compatible it is not the same
> > > > GUID.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_POLICY_PROTOCOL_REVISION
> > > > 0x00010000
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_POLICY structure
> > > > adheres.
> > > > +//          All future revisions must be backwards compatible.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_POLICY_REVISION 0x00010000
> > > > +
> > > > +///
> > > > +/// The macro for the policy defined in EDKII_DEVICE_SECURITY_POLICY
> > > > +///
> > > > +#define EDKII_DEVICE_MEASUREMENT_REQUIRED                 BIT0
> > > > +#define EDKII_DEVICE_AUTHENTICATION_REQUIRED              BIT0
> > > > +
> > > > +///
> > > > +/// The device security policy data structure /// typedef struct {
> > > > +  UINT32     Version;
> > > > +  UINT32     MeasurementPolicy;
> > > > +  UINT32     AuthenticationPolicy;
> > > > +} EDKII_DEVICE_SECURITY_POLICY;
> > > > +
> > > > +//
> > > > +// Revision The revision to which the DEVICE_SECURITY_STATE structure
> > > > adheres.
> > > > +//          All future revisions must be backwards compatible.
> > > > +//
> > > > +#define EDKII_DEVICE_SECURITY_STATE_REVISION 0x00010000
> > > > +
> > > > +///
> > > > +/// The macro for the state defined in EDKII_DEVICE_SECURITY_STATE ///
> > > > +#define EDKII_DEVICE_SECURITY_STATE_SUCCESS                          0
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR                            BIT31
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_UNSUPPORTED
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x0)
> > > > +#define
> > > > EDKII_DEVICE_SECURITY_STATE_ERROR_UEFI_GET_POLICY_PROTOCOL
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x1)
> > > > +#define EDKII_DEVICE_SECURITY_STATE_ERROR_PCI_NO_CAPABILITIES
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x10)
> > > > +#define
> EDKII_DEVICE_SECURITY_STATE_ERROR_TCG_EXTEND_TPM_PCR
> > > > (EDKII_DEVICE_SECURITY_STATE_ERROR + 0x20)
> > > > +
> > > > +///
> > > > +/// The device security state data structure /// typedef struct {
> > > > +  UINT32     Version;
> > > > +  UINT32     MeasurementState;
> > > > +  UINT32     AuthenticationState;
> > > > +} EDKII_DEVICE_SECURITY_STATE;
> > > > +
> > > > +/**
> > > > +  This function returns the device security policy associated with the
> device.
> > > > +
> > > > +  The device security driver may call this interface to get the
> > > > + platform policy  for the specific device and determine if the
> > > > + measurement or authentication  is required.
> > > > +
> > > > +  @param[in]  This                   The protocol instance pointer.
> > > > +  @param[in]  DeviceId               The Identifier for the device.
> > > > +  @param[out] DeviceSecurityPolicy   The Device Security Policy
> associated
> > > > with the device.
> > > > +
> > > > +  @retval EFI_SUCCESS                The device security policy is returned
> > > > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > > > specific Device.
> > > > +**/
> > > > +typedef
> > > > +EFI_STATUS
> > > > +(EFIAPI *EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY) (
> > > > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > > > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > > > +  OUT EDKII_DEVICE_SECURITY_POLICY           *DeviceSecurityPolicy
> > > > +  );
> > > > +
> > > > +/**
> > > > +  This function sets the device state based upon the authentication result.
> > > > +
> > > > +  The device security driver may call this interface to give the
> > > > + platform  a notify based upon the measurement or authentication result.
> > > > +  If the authentication or measurement fails, the platform may choose:
> > > > +  1) Do nothing.
> > > > +  2) Disable this device or slot temporarily and continue boot.
> > > > +  3) Reset the platform and retry again.
> > > > +  4) Disable this device or slot permanently.
> > > > +  5) Any other platform specific action.
> > > > +
> > > > +  @param[in]  This                   The protocol instance pointer.
> > > > +  @param[in]  DeviceId               The Identifier for the device.
> > > > +  @param[in]  DeviceSecurityState    The Device Security state associated
> > > > with the device.
> > > > +
> > > > +  @retval EFI_SUCCESS                The device state is set.
> > > > +  @retval EFI_UNSUPPORTED            The function is unsupported for the
> > > > specific Device.
> > > > +**/
> > > > +typedef
> > > > +EFI_STATUS
> > > > +(EFIAPI *EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE) (
> > > > +  IN  EDKII_DEVICE_SECURITY_POLICY_PROTOCOL  *This,
> > > > +  IN  EDKII_DEVICE_IDENTIFIER                *DeviceId,
> > > > +  IN  EDKII_DEVICE_SECURITY_STATE            *DeviceSecurityState
> > > > +  );
> > > > +
> > > > +struct _EDKII_DEVICE_SECURITY_POLICY_PROTOCOL {
> > > > +  UINT32                                      Version;
> > > > +  EDKII_DEVICE_SECURITY_GET_DEVICE_POLICY     GetDevicePolicy;
> > > > +  EDKII_DEVICE_SECURITY_NOTIFY_DEVICE_STATE   NotifyDeviceState;
> > > > +};
> > > > +
> > > > +extern EFI_GUID gEdkiiDeviceSecurityPolicyProtocolGuid;
> > > > +
> > > > +#endif
> > > > --
> > > > 2.19.2.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#50317): https://edk2.groups.io/g/devel/message/50317
Mute This Topic: https://groups.io/mt/46027906/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.