X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=SecurityPkg%2FSecurityPkg.dec;h=79d46308ad67e7ea0bfa18218bbb668f86842730;hp=d2f6a6fd1293e2a3ee76d47788489f6c4c4f3a20;hb=HEAD;hpb=d5af8fc5a975feb6c745587d0d834733ad2048fd
diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index d2f6a6fd12..0382090f4e 100644
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -5,9 +5,9 @@
# It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes)
# and libraries instances, which are used for those features.
#
-# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.
# (C) Copyright 2015 Hewlett Packard Enterprise Development LP
-# Copyright (c) 2017, Microsoft Corporation. All rights reserved.
+# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -62,20 +62,40 @@
## @libraryclass Provides support for TCG Physical Presence Interface (PPI) specification
# >= 128 Vendor Specific PPI Operation.
#
- Tcg2PpVendorLib|Include/Library/TcgPpVendorLib.h
+ Tcg2PpVendorLib|Include/Library/Tcg2PpVendorLib.h
## @libraryclass Handle TPM 2.0 physical presence request from OS.
#
Tcg2PhysicalPresenceLib|Include/Library/Tcg2PhysicalPresenceLib.h
- ## @libraryclass Provides interfaces about TCG storage generic commond.
+ ## @libraryclass Handle TPM 2.0 platform hierarchy configuration
+ #
+ TpmPlatformHierarchyLib|Include/Library/TpmPlatformHierarchyLib.h
+
+ ## @libraryclass Provides interfaces about TCG storage generic command.
#
TcgStorageCoreLib|Include/Library/TcgStorageCoreLib.h
- ## @libraryclass Provides interfaces about TCG storage Opal generic commond.
+ ## @libraryclass Provides interfaces about TCG storage Opal generic command.
#
TcgStorageOpalLib|Include/Library/TcgStorageOpalLib.h
+ ## @libraryclass Provides interfaces about firmware TPM measurement.
+ #
+ TcgEventLogRecordLib|Include/Library/TcgEventLogRecordLib.h
+
+ ## @libraryclass Provides helper functions related to creation/removal Secure Boot variables.
+ #
+ SecureBootVariableLib|Include/Library/SecureBootVariableLib.h
+
+ ## @libraryclass Provides support to enroll Secure Boot keys.
+ #
+ SecureBootVariableProvisionLib|Include/Library/SecureBootVariableProvisionLib.h
+
+ ## @libraryclass Provides support to manage variable 'PK' related protections.
+ #
+ PlatformPKProtectionLib|Include/Library/PlatformPKProtectionLib.h
+
[Guids]
## Security package token space guid.
# Include/Guid/SecurityPkgTokenSpace.h
@@ -113,6 +133,10 @@
## Include/Guid/TcgEventHob.h
gTcgEvent2EntryHobGuid = { 0xd26c221e, 0x2430, 0x4c8a, { 0x91, 0x70, 0x3f, 0xcb, 0x45, 0x0, 0x41, 0x3f }}
+ ## Hob GUID used to pass a CC_EVENT from SEC to a CC DXE Driver.
+ ## Include/Guid/CcEventHob.h
+ gCcEventEntryHobGuid = { 0x20f8fd36, 0x6d00, 0x40fb, { 0xb7, 0x04, 0xd1, 0x2c, 0x15, 0x3c, 0x62, 0xeb }}
+
## HOB GUID used to record TPM device error.
# Include/Guid/TcgEventHob.h
gTpmErrorHobGuid = { 0xef598499, 0xb25e, 0x473a, { 0xbf, 0xaf, 0xe7, 0xe5, 0x7d, 0xce, 0x82, 0xc4 }}
@@ -121,6 +145,10 @@
## Include/Guid/TcgEventHob.h
gTpm2StartupLocalityHobGuid = { 0x397b0c9, 0x22e8, 0x459e, { 0xa4, 0xff, 0x99, 0xbc, 0x65, 0x27, 0x9, 0x29 }}
+ ## HOB GUID used to record TCG 800-155 PlatformId Event
+ ## Include/Guid/TcgEventHob.h
+ gTcg800155PlatformIdEventHobGuid = { 0xe2c3bc69, 0x615c, 0x4b5b, { 0x8e, 0x5c, 0xa0, 0x33, 0xa9, 0xc2, 0x5e, 0xd6 }}
+
## HOB GUID used to pass all PEI measured FV info to DXE Driver.
# Include/Guid/MeasuredFvHob.h
gMeasuredFvHobGuid = { 0xb2360b42, 0x7173, 0x420a, { 0x86, 0x96, 0x46, 0xca, 0x6b, 0xab, 0x10, 0x60 }}
@@ -168,6 +196,27 @@
## Include/OpalPasswordExtraInfoVariable.h
gOpalExtraInfoVariableGuid = {0x44a2ad5d, 0x612c, 0x47b3, {0xb0, 0x6e, 0xc8, 0xf5, 0x0b, 0xfb, 0xf0, 0x7d}}
+ ## GUID used to exchange registered SWI value and NVS region between Tcg2Acpi and Tcg2Smm.
+ ## Include/Guid/TpmNvsMm.h
+ gTpmNvsMmGuid = { 0xc96c76eb, 0xbc78, 0x429c, { 0x9f, 0x4b, 0xda, 0x51, 0x78, 0xc2, 0x84, 0x57 }}
+
+ ## GUID used to enforce loading order between Tcg2Acpi and Tcg2Smm
+ gTcg2MmSwSmiRegisteredGuid = { 0x9d4548b9, 0xa48d, 0x4db4, { 0x9a, 0x68, 0x32, 0xc5, 0x13, 0x9e, 0x20, 0x18 } }
+
+ ## GUID used to specify section with default PK content
+ gDefaultPKFileGuid = { 0x85254ea7, 0x4759, 0x4fc4, { 0x82, 0xd4, 0x5e, 0xed, 0x5f, 0xb0, 0xa4, 0xa0 } }
+
+ ## GUID used to specify section with default KEK content
+ gDefaultKEKFileGuid = { 0x6f64916e, 0x9f7a, 0x4c35, { 0xb9, 0x52, 0xcd, 0x04, 0x1e, 0xfb, 0x05, 0xa3 } }
+
+ ## GUID used to specify section with default db content
+ gDefaultdbFileGuid = { 0xc491d352, 0x7623, 0x4843, { 0xac, 0xcc, 0x27, 0x91, 0xa7, 0x57, 0x44, 0x21 } }
+
+ ## GUID used to specify section with default dbx content
+ gDefaultdbxFileGuid = { 0x5740766a, 0x718e, 0x4dc0, { 0x99, 0x35, 0xc3, 0x6f, 0x7d, 0x3f, 0x88, 0x4f } }
+
+ ## GUID used to specify section with default dbt content
+ gDefaultdbtFileGuid = { 0x36c513ee, 0xa338, 0x4976, { 0xa0, 0xfb, 0x6d, 0xdb, 0xa3, 0xda, 0xfe, 0x87 } }
[Ppis]
## The PPI GUID for that TPM physical presence should be locked.
@@ -187,10 +236,13 @@
## Include/Ppi/FirmwareVolumeInfoPrehashedFV.h
gEdkiiPeiFirmwareVolumeInfoPrehashedFvPpiGuid = { 0x3ce1e631, 0x7008, 0x477c, { 0xad, 0xa7, 0x5d, 0xcf, 0xc7, 0xc1, 0x49, 0x4b } }
-
+
## Include/Ppi/FirmwareVolumeInfoStoredHashFv.h
gEdkiiPeiFirmwareVolumeInfoStoredHashFvPpiGuid = {0x7f5e4e31, 0x81b1, 0x47e5, { 0x9e, 0x21, 0x1e, 0x4b, 0x5b, 0xc2, 0xf6, 0x1d } }
+ ## Include/Ppi/Tcg.h
+ gEdkiiTcgPpiGuid = {0x57a13b87, 0x133d, 0x4bf3, { 0xbf, 0xf1, 0x1b, 0xca, 0xc7, 0x17, 0x6c, 0xf1 } }
+
#
# [Error.gEfiSecurityPkgTokenSpaceGuid]
# 0x80000001 | Invalid value provided.
@@ -260,12 +312,20 @@
# @ValidList 0x80000003 | 0x010D0000
gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeSubClassTpmDevice|0x010D0000|UINT32|0x00000007
+ ## Defines the IO port used to trigger a software System Management Interrupt (SMI).
+ # Used as the SMI Command IO port by security functionality that triggers a software SMI such
+ # as Physical Presence Interface (PPI).
+ # @Prompt SMI Command IO port.
+ gEfiSecurityPkgTokenSpaceGuid.PcdSmiCommandIoPort|0xB2|UINT16|0x00000009
+
## Progress Code for FV verification result.
# (EFI_SOFTWARE_PEI_MODULE | EFI_SUBCLASS_SPECIFIC | XXX)
# @Prompt Status Code for FV verification result
gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationPass|0x0303100A|UINT32|0x00010030
gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationFail|0x0303100B|UINT32|0x00010031
+ gEfiSecurityPkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm|{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}|VOID*|0x00010032
+
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Image verification policy for OptionRom. Only following values are valid:
# NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.
@@ -287,6 +347,12 @@
# @Prompt Physical presence of the platform operator.
gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001
+ ## Indicates whether the TPM2 platform hierarchy will be disabled by using
+ # a random password or by disabling the hierarchy
+ # TRUE - A random password will be used
+ # FALSE - The hierarchy will be disabled
+ gEfiSecurityPkgTokenSpaceGuid.PcdRandomizePlatformHierarchy|TRUE|BOOLEAN|0x00010024
+
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
## Indicates whether TPM physical presence is locked during platform initialization.
# Once it is locked, it can not be unlocked for TPM life time.
@@ -352,6 +418,7 @@
gEfiSecurityPkgTokenSpaceGuid.PcdTpmScrtmPolicy|1|UINT8|0x0001000E
## Guid name to identify TPM instance.
+ # NOTE: This Pcd must be FixedAtBuild if Standalone MM is used
# TPM_DEVICE_INTERFACE_NONE means disable.
# TPM_DEVICE_INTERFACE_TPM12 means TPM 1.2 DTPM.
# TPM_DEVICE_INTERFACE_DTPM2 means TPM 2.0 DTPM.
@@ -369,9 +436,9 @@
# @Prompt TPM device address.
gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0xFED40000|UINT64|0x00010012
- ## This PCR means the OEM configurated number of PCR banks.
+ ## This PCR means the OEM configured number of PCR banks.
# 0 means dynamic get from supported HASH algorithm
- # @Prompt OEM configurated number of PCR banks.
+ # @Prompt OEM configured number of PCR banks.
gEfiSecurityPkgTokenSpaceGuid.PcdTcg2NumberOfPCRBanks|0x0|UINT32|0x00010015
## Provides one or more SHA 256 Hashes of the RSA 2048 public keys used to verify Recovery and Capsule Update images
@@ -417,7 +484,18 @@
## This PCD defines initial setting of TCG2 Persistent Firmware Management Flags
# PCD can be configured for different settings in different scenarios
- # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT
+ # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage Management Flags
+ # BIT0 - Reserved
+ # BIT1 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR
+ # BIT2 - Reserved
+ # BIT3 - TCG2_LIB_PP_FLAG_RESET_TRACK
+ # BIT4 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON
+ # BIT5 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF
+ # BIT6 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS
+ # BIT7 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS
+ # BIT16 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID
+ # BIT17 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID
+ # BIT18 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID
# @Prompt Initial setting of TCG2 Persistent Firmware Management Flags
gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT32|0x0001001B
@@ -469,7 +547,7 @@
gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap|0xFFFFFFFF|UINT32|0x00010016
## This PCD indicates current active TPM interface type.
- # Accodingt to TCG PTP spec 1.3, there are 3 types defined in TPM2_PTP_INTERFACE_TYPE.
+ # According to TCG PTP spec 1.3, there are 3 types defined in TPM2_PTP_INTERFACE_TYPE.
# 0x00 - FIFO interface as defined in TIS 1.3 is active.
# 0x01 - FIFO interface as defined in PTP for TPM 2.0 is active.
# 0x02 - CRB interface is active.
@@ -478,15 +556,36 @@
# @Prompt current active TPM interface type.
gEfiSecurityPkgTokenSpaceGuid.PcdActiveTpmInterfaceType|0xFF|UINT8|0x0001001E
- ## This PCD records IdleByass status supported by current active TPM interface.
- # Accodingt to TCG PTP spec 1.3, TPM with CRB interface can skip idle state and
- # diretcly move to CmdReady state.
+ ## This PCD records IdleBypass status supported by current active TPM interface.
+ # According to TCG PTP spec 1.3, TPM with CRB interface can skip idle state and
+ # directly move to CmdReady state.
# 0x00 - Do not support IdleByPass.
# 0x01 - Support IdleByPass.
# 0xFF - IdleByPass State is not synced with TPM hardware.
#
- # @Prompt IdleByass status supported by current active TPM interface.
+ # @Prompt IdleBypass status supported by current active TPM interface.
gEfiSecurityPkgTokenSpaceGuid.PcdCRBIdleByPass|0xFF|UINT8|0x0001001F
+ ## This PCD records LAML field in TPM2 ACPI table.
+ # @Prompt Tpm2AcpiTableLaml LAML field in TPM2 ACPI table.
+ gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableLaml|0|UINT32|0x00010022
+
+ ## This PCD records LASA field in TPM2 ACPI table.
+ # @Prompt Tpm2AcpiTableLasa LASA field in TPM2 ACPI table.
+ gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableLasa|0|UINT64|0x00010023
+
+ ## This PCD records LAML field in CC EVENTLOG ACPI table.
+ gEfiSecurityPkgTokenSpaceGuid.PcdCcEventlogAcpiTableLaml|0|UINT32|0x00010025
+
+ ## This PCD records LASA field in CC EVENTLOG ACPI table.
+ gEfiSecurityPkgTokenSpaceGuid.PcdCcEventlogAcpiTableLasa|0|UINT64|0x00010026
+
+[PcdsFeatureFlag]
+ ## Indicates if the platform requires PK to be self-signed when setting the PK in setup mode.
+ # TRUE - Require PK to be self-signed.
+ # FALSE - Do not require PK to be self-signed.
+ # @Prompt Require PK to be self-signed
+ gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|FALSE|BOOLEAN|0x00010027
+
[UserExtensions.TianoCore."ExtraFiles"]
SecurityPkgExtra.uni