summaryrefslogtreecommitdiff
path: root/SecurityPkg/SecurityPkg.dec
blob: bc058731fbd8f336ddb59d1c793c7eeae34d06ca (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
## @file  SecurityPkg.dec
#  This package includes the security drivers, defintions(including PPIs/PROTOCOLs/GUIDs  
#  and library classes) and libraries instances.
#
# Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
# This program and the accompanying materials are licensed and made available under
# the terms and conditions of the BSD License which accompanies this distribution.
# The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
#
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##

[Defines]
  DEC_SPECIFICATION              = 0x00010005
  PACKAGE_NAME                   = SecurityPkg
  PACKAGE_GUID                   = 24369CAC-6AA6-4fb8-88DB-90BF061668AD
  PACKAGE_VERSION                = 0.93

[Includes]
  Include

[LibraryClasses]
  ##  @libraryclass  Provides hash interfaces from different implementations.
  # 
  HashLib|Include/Library/HashLib.h
  
  ##  @libraryclass  Provides a platform specific interface to detect physically present user.
  #
  PlatformSecureLib|Include/Library/PlatformSecureLib.h
  
  ##  @libraryclass  Provides interfaces to handle TPM 1.2 request.
  #
  TcgPhysicalPresenceLib|Include/Library/TcgPhysicalPresenceLib.h
  
  ##  @libraryclass  Provides interfaces for other modules to send TPM 2.0 command.
  #
  Tpm2CommandLib|Include/Library/Tpm2CommandLib.h
  
  ##  @libraryclass  Provides interfaces on how to access TPM 2.0 hardware device.
  #
  Tpm2DeviceLib|Include/Library/Tpm2DeviceLib.h
  
  ##  @libraryclass  Provides interfaces for other modules to send TPM 1.2 command.
  #
  Tpm12CommandLib|Include/Library/Tpm12CommandLib.h
  
  ##  @libraryclass  Provides interfaces on how to access TPM 1.2 hardware device.
  #
  Tpm12DeviceLib|Include/Library/Tpm12DeviceLib.h
  
  ##  @libraryclass  Provides TPM Interface Specification (TIS) interfaces for TPM command.
  #
  TpmCommLib|Include/Library/TpmCommLib.h
    
  ##  @libraryclass  Provides common interfaces about TPM measurement for other modules.
  #
  TpmMeasurementLib|Include/Library/TpmMeasurementLib.h
  
  ##  @libraryclass  Provides interfaces to handle TPM 2.0 request.
  #
  TrEEPhysicalPresenceLib|Include/Library/TrEEPhysicalPresenceLib.h

[Guids]
  ## Security package token space guid
  # Include/Guid/SecurityPkgTokenSpace.h
  gEfiSecurityPkgTokenSpaceGuid      = { 0xd3fb176, 0x9569, 0x4d51, { 0xa3, 0xef, 0x7d, 0x61, 0xc6, 0x4f, 0xea, 0xba }}
  
  ## Guid acted as the authenticated variable store header's signature, and to specify the variable list entries put in the EFI system table.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiAuthenticatedVariableGuid      = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }

  ## GUID used to "SecureBootEnable" variable for the Secure Boot feature enable/disable.
  #  This variable is used for allowing a physically present user to disable Secure Boot via firmware setup without the possession of PKpriv.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiSecureBootEnableDisableGuid    = { 0xf0a30bc7, 0xaf08, 0x4556, { 0x99, 0xc4, 0x0, 0x10, 0x9, 0xc9, 0x3a, 0x44 } }

  ## GUID used to "CustomMode" variable for two Secure Boot modes feature: "Custom" and "Standard".
  #  Standard Secure Boot mode is the default mode as UEFI Spec's description.
  #  Custom Secure Boot mode allows for more flexibility as specified in the following:
  #  Can enroll or delete PK without existing PK's private key.
  #  Can enroll or delete KEK without existing PK's private key.
  #  Can enroll or delete signature from DB/DBX without KEK's private key.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiCustomModeEnableGuid           = { 0xc076ec0c, 0x7028, 0x4399, { 0xa0, 0x72, 0x71, 0xee, 0x5c, 0x44, 0x8b, 0x9f } }

  ## GUID used to "VendorKeysNv" variable to record the out of band secure boot keys modification.
  #  This variable is a read-only NV varaible that indicates whether someone other than the platform vendor has used a 
  #  mechanism not defined by the UEFI Specification to transition the system to setup mode or to update secure boot keys.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiVendorKeysNvGuid               = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } }

  ## GUID used to "certdb" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiCertDbGuid                     = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } }
  
  ## Hob GUID used to pass a TCG_PCR_EVENT from a TPM PEIM to a TPM DXE Driver.
  #  Include/Guid/TcgEventHob.h
  gTcgEventEntryHobGuid              = { 0x2b9ffb52, 0x1b13, 0x416f, { 0xa8, 0x7b, 0xbc, 0x93, 0xd, 0xef, 0x92, 0xa8 }}

  ## HOB GUID used to pass all PEI measured FV info to DXE Driver.
  #  Include/Guid/MeasuredFvHob.h
  gMeasuredFvHobGuid                 = { 0xb2360b42, 0x7173, 0x420a, { 0x86, 0x96, 0x46, 0xca, 0x6b, 0xab, 0x10, 0x60 }}

  ## GUID used to "PhysicalPresence" variable and "PhysicalPresenceFlags" variable for TPM request and response.
  #  Include/Guid/PhysicalPresenceData.h
  gEfiPhysicalPresenceGuid           = { 0xf6499b1, 0xe9ad, 0x493d, { 0xb9, 0xc2, 0x2f, 0x90, 0x81, 0x5c, 0x6c, 0xbc }}
  
  ## GUID used for form browser, password credential and provider identifier.
  # Include/Guid/PwdCredentialProviderHii.h
  gPwdCredentialProviderGuid         = { 0x78b9ec8b, 0xc000, 0x46c5, { 0xac, 0x93, 0x24, 0xa0, 0xc1, 0xbb, 0x0, 0xce }}

  ## GUID used for form browser, USB credential and provider identifier.
  #  Include/Guid/UsbCredentialProviderHii.h
  gUsbCredentialProviderGuid         = { 0xd0849ed1, 0xa88c, 0x4ba6, { 0xb1, 0xd6, 0xab, 0x50, 0xe2, 0x80, 0xb7, 0xa9 }}

  ## GUID used for FormSet guid and user profile variable.
  # Include/Guid/UserIdentifyManagerHii.h
  gUserIdentifyManagerGuid           = { 0x3ccd3dd8, 0x8d45, 0x4fed, { 0x96, 0x2d, 0x2b, 0x38, 0xcd, 0x82, 0xb3, 0xc4 }}

  ## GUID used for FormSet.
  #  Include/Guid/UserProfileManagerHii.h
  gUserProfileManagerGuid            = { 0xc35f272c, 0x97c2, 0x465a, { 0xa2, 0x16, 0x69, 0x6b, 0x66, 0x8a, 0x8c, 0xfe }}

  ## GUID used for FormSet.
  #  Include/Guid/TcgConfigHii.h
  gTcgConfigFormSetGuid              = { 0xb0f901e4, 0xc424, 0x45de, { 0x90, 0x81, 0x95, 0xe2, 0xb, 0xde, 0x6f, 0xb5 }}
  
  ## GUID used for FormSet.
  #  Include/Guid/SecureBootConfigHii.h
  gSecureBootConfigFormSetGuid       = { 0x5daf50a5, 0xea81, 0x4de2, {0x8f, 0x9b, 0xca, 0xbd, 0xa9, 0xcf, 0x5c, 0x14}}

  ## GUID used to "TrEEPhysicalPresence" variable and "TrEEPhysicalPresenceFlags" variable for TPM2 request and response.
  #  Include/Guid/TrEEPhysicalPresenceData.h
  gEfiTrEEPhysicalPresenceGuid = { 0xf24643c2, 0xc622, 0x494e, { 0x8a, 0xd, 0x46, 0x32, 0x57, 0x9c, 0x2d, 0x5b }}

  ## GUID value used for PcdTpmInstanceGuid to indicate TPM is disabled.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceNoneGuid      = { 0x00000000, 0x0000, 0x0000, { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } }
  
  ## GUID value used for PcdTpmInstanceGuid to indicate TPM 1.2 device is selected to support.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceTpm12Guid     = { 0x8b01e5b6, 0x4f19, 0x46e8, { 0xab, 0x93, 0x1c, 0x53, 0x67, 0x1b, 0x90, 0xcc } }
  
  ## GUID value used for PcdTpmInstanceGuid to indicate discrete TPM 2.0 device is selected to support.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceTpm20DtpmGuid = { 0x286bf25a, 0xc2c3, 0x408c, { 0xb3, 0xb4, 0x25, 0xe6, 0x75, 0x8b, 0x73, 0x17 } }
  
  ## GUID used to select supported TPM instance from UI.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceSelectedGuid          = { 0x7f4158d3, 0x74d, 0x456d, { 0x8c, 0xb2, 0x1, 0xf9, 0xc8, 0xf7, 0x9d, 0xaa } }

  ## GUID used for FormSet and config variable.
  #  Include/Guid/TrEEConfigHii.h
  gTrEEConfigFormSetGuid              = {0xc54b425f, 0xaa79, 0x48b4, { 0x98, 0x1f, 0x99, 0x8b, 0x3c, 0x4b, 0x64, 0x1c }}

[Ppis]
  ## Include/Ppi/LockPhysicalPresence.h
  gPeiLockPhysicalPresencePpiGuid    = { 0xef9aefe5, 0x2bd3, 0x4031, { 0xaf, 0x7d, 0x5e, 0xfe, 0x5a, 0xbb, 0x9a, 0xd } }

  ## Include/Ppi/TpmInitialized.h
  gPeiTpmInitializedPpiGuid      = { 0xe9db0d58, 0xd48d, 0x47f6, { 0x9c, 0x6e, 0x6f, 0x40, 0xe8, 0x6c, 0x7b, 0x41 }}

  ## Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h
  gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid = { 0x6e056ff9, 0xc695, 0x4364, { 0x9e, 0x2c, 0x61, 0x26, 0xf5, 0xce, 0xea, 0xae } }

[PcdsFixedAtBuild]
  ## Pcd for OptionRom.
  #  Image verification policy settings:
  #  ALWAYS_EXECUTE                         0x00000000
  #  NEVER_EXECUTE                          0x00000001
  #  ALLOW_EXECUTE_ON_SECURITY_VIOLATION    0x00000002
  #  DEFER_EXECUTE_ON_SECURITY_VIOLATION    0x00000003
  #  DENY_EXECUTE_ON_SECURITY_VIOLATION     0x00000004
  #  QUERY_USER_ON_SECURITY_VIOLATION       0x00000005 
  #  NOTE: Do NOT use QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION since
  #  it violates the UEFI specification and has been removed.
  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04|UINT32|0x00000001
  
  ## Pcd for removable media.
  #  Removable media include CD-ROM, Floppy, USB and network.
  #  Image verification policy settings:
  #  ALWAYS_EXECUTE                         0x00000000
  #  NEVER_EXECUTE                          0x00000001
  #  ALLOW_EXECUTE_ON_SECURITY_VIOLATION    0x00000002
  #  DEFER_EXECUTE_ON_SECURITY_VIOLATION    0x00000003
  #  DENY_EXECUTE_ON_SECURITY_VIOLATION     0x00000004
  #  QUERY_USER_ON_SECURITY_VIOLATION       0x00000005
  #  NOTE: Do NOT use QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION since
  #  it violates the UEFI specification and has been removed.
  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04|UINT32|0x00000002
  
  ## Pcd for fixed media.
  #  Fixed media include hard disk.
  #  Image verification policy settings:
  #  ALWAYS_EXECUTE                         0x00000000
  #  NEVER_EXECUTE                          0x00000001
  #  ALLOW_EXECUTE_ON_SECURITY_VIOLATION    0x00000002
  #  DEFER_EXECUTE_ON_SECURITY_VIOLATION    0x00000003
  #  DENY_EXECUTE_ON_SECURITY_VIOLATION     0x00000004
  #  QUERY_USER_ON_SECURITY_VIOLATION       0x00000005  
  #  NOTE: Do NOT use QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION since
  #  it violates the UEFI specification and has been removed.
  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04|UINT32|0x00000003
  
  ## Defer Image Load policy settings.
  #  The policy is bitwise. 
  #  If bit is set, the image from corresponding device will be trust when loading.
  #
  # IMAGE_UNKNOWN                         0x00000001
  # IMAGE_FROM_FV                         0x00000002
  # IMAGE_FROM_OPTION_ROM                 0x00000004
  # IMAGE_FROM_REMOVABLE_MEDIA            0x00000008
  # IMAGE_FROM_FIXED_MEDIA                0x00000010
  gEfiSecurityPkgTokenSpaceGuid.PcdDeferImageLoadPolicy|0x0000001F|UINT32|0x0000004
  
  ## The token file name used to save credential in USB credential provider driver.
  #  The specified file should be saved at the root directory of USB storage disk.
  gEfiSecurityPkgTokenSpaceGuid.PcdFixedUsbCredentialProviderTokenFileName|L"Token.bin"|VOID*|0x00000005

  ## The size of Append variable buffer. This buffer is reserved for runtime use, OS can append data into one existing variable.
  gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize|0x2000|UINT32|0x30000005  

  ## This PCD specifies the type of TCG platform that contains TPM chip. 
  #  This PCD is only avaiable when PcdTpmPhysicalPresence is TRUE.
  #  If 0, TCG platform type is PC client.
  #  If 1, TCG platform type is server.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmPlatformClass|0|UINT8|0x00000006

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD indicates the presence or absence of the platform operator.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD indicates whether to set TPM physicalPresenceLifetimeLock bit.
  #  Once this bit is set, it can not be cleared (It is locked for TPM life time).
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceLifetimeLock|FALSE|BOOLEAN|0x00010003
  
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD is used to specify the default value for physicalPresenceCMDEnable bit when setting physicalPresenceLifetimeLock bit.
  #  If PcdPhysicalPresenceCmdEnable is set to TRUE, physicalPresenceCMDEnable bit will be set, else this bit will be cleared.
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceCmdEnable|TRUE|BOOLEAN|0x00010004
  
[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD is used to specify the default value for physicalPresenceHWEnable bit when setting physicalPresenceLifetimeLock bit.
  #  If PcdPhysicalPresenceHwEnable is set to TRUE, physicalPresenceHWEnable bit will be set, else this bit will be cleared.
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceHwEnable|TRUE|BOOLEAN|0x00010005

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD indicates if debugger exists.
  gEfiSecurityPkgTokenSpaceGuid.PcdFirmwareDebuggerInitialized|FALSE|BOOLEAN|0x00010009

  ## This PCD indicates the TPM2 initialization policy.
  #  0: No initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.
  #  1: Initialization needed.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2InitializationPolicy|1|UINT8|0x0001000A

  ## This PCD indicates the TPM initialization policy.
  #  0: No initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.
  #  1: Initialization needed.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInitializationPolicy|1|UINT8|0x0001000B

  ## This PCD indicates the TPM2 SelfTest policy.
  #  0: No SelfTest needed - most likely used for fTPM, because it might already be tested.
  #  1: SelfTest needed.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2SelfTestPolicy|1|UINT8|0x0001000C

  ## This PCD indicates the TPM2 SCRTM policy.
  #    0: No SCRTM needed - In this case, it is already done.
  #    1: SCRTM done by BIOS.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2ScrtmPolicy|1|UINT8|0x0001000D

  ## This PCD indicates the TPM SCRTM policy.
  #    0: No SCRTM needed - In this case, it is already done.
  #    1: SCRTM done by BIOS.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmScrtmPolicy|1|UINT8|0x0001000E

  ## Guid name to identify TPM instance
  #  TPM_DEVICE_INTERFACE_NONE means disable
  #  TPM_DEVICE_INTERFACE_TPM12 means TPM1.2 DTPM
  #  TPM_DEVICE_INTERFACE_DTPM2 means TPM2 DTPM
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid |{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }|VOID*|0x0001000F

  ## This PCD indicates the TPM2 Hash mask.
  #    BIT0: SHA1
  #    BIT1: SHA256
  #    BIT2: SHA384
  #    BIT3: SHA512
  #  If this bit is set, that means this algorithm is needed to extend to PCR.
  #  If this bit is clear, that means this algorithm is NOT needed to extend to PCR.
  #  0xFFFFFFFF means extend all.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0xFFFFFFFF|UINT32|0x00010010

  ## This PCD indicates if BIOS auto detect TPM1.2 or dTPM2.0.
  #  0: No auto detection.
  #  1: Auto detection.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmAutoDetection|TRUE|BOOLEAN|0x00010011

  ## This PCD indicates TPM base address.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0xFED40000|UINT64|0x00010012