| 1 | // /** @file
|
|---|
| 2 | // Provides security features that conform to TCG/UEFI industry standards
|
|---|
| 3 | //
|
|---|
| 4 | // The security features include secure boot, measured boot and user identification.
|
|---|
| 5 | // It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes)
|
|---|
| 6 | // and libraries instances, which are used for those features.
|
|---|
| 7 | //
|
|---|
| 8 | // Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
|
|---|
| 9 | //
|
|---|
| 10 | // This program and the accompanying materials are licensed and made available under
|
|---|
| 11 | // the terms and conditions of the BSD License which accompanies this distribution.
|
|---|
| 12 | // The full text of the license may be found at
|
|---|
| 13 | // http://opensource.org/licenses/bsd-license.php
|
|---|
| 14 | //
|
|---|
| 15 | // THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
|---|
| 16 | // WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
|---|
| 17 | //
|
|---|
| 18 | // **/
|
|---|
| 19 |
|
|---|
| 20 |
|
|---|
| 21 | #string STR_PACKAGE_ABSTRACT #language en-US "Provides security features that conform to TCG/UEFI industry standards"
|
|---|
| 22 |
|
|---|
| 23 | #string STR_PACKAGE_DESCRIPTION #language en-US "The security features include secure boot, measured boot and user identification. It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes) and libraries instances, which are used for those features."
|
|---|
| 24 |
|
|---|
| 25 |
|
|---|
| 26 |
|
|---|
| 27 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdOptionRomImageVerificationPolicy_PROMPT #language en-US "Set policy for the image from OptionRom."
|
|---|
| 28 |
|
|---|
| 29 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdOptionRomImageVerificationPolicy_HELP #language en-US "Image verification policy for OptionRom. Only following values are valid:<BR><BR>\n"
|
|---|
| 30 | "NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>\n"
|
|---|
| 31 | "0x00000000 Always trust the image.<BR>\n"
|
|---|
| 32 | "0x00000001 Never trust the image.<BR>\n"
|
|---|
| 33 | "0x00000002 Allow execution when there is security violation.<BR>\n"
|
|---|
| 34 | "0x00000003 Defer execution when there is security violation.<BR>\n"
|
|---|
| 35 | "0x00000004 Deny execution when there is security violation.<BR>\n"
|
|---|
| 36 | "0x00000005 Query user when there is security violation.<BR>"
|
|---|
| 37 |
|
|---|
| 38 | #string STR_gEfiSecurityPkgTokenSpaceGuid_ERR_80000001 #language en-US "Invalid value provided."
|
|---|
| 39 |
|
|---|
| 40 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdRemovableMediaImageVerificationPolicy_PROMPT #language en-US "Set policy for the image from removable media."
|
|---|
| 41 |
|
|---|
| 42 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdRemovableMediaImageVerificationPolicy_HELP #language en-US "Image verification policy for removable media which includes CD-ROM, Floppy, USB and network. Only following values are valid:<BR><BR>\n"
|
|---|
| 43 | "NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>\n"
|
|---|
| 44 | "0x00000000 Always trust the image.<BR>\n"
|
|---|
| 45 | "0x00000001 Never trust the image.<BR>\n"
|
|---|
| 46 | "0x00000002 Allow execution when there is security violation.<BR>\n"
|
|---|
| 47 | "0x00000003 Defer execution when there is security violation.<BR>\n"
|
|---|
| 48 | "0x00000004 Deny execution when there is security violation.<BR>\n"
|
|---|
| 49 | "0x00000005 Query user when there is security violation.<BR>"
|
|---|
| 50 |
|
|---|
| 51 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFixedMediaImageVerificationPolicy_PROMPT #language en-US "Set policy for the image from fixed media."
|
|---|
| 52 |
|
|---|
| 53 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFixedMediaImageVerificationPolicy_HELP #language en-US "Image verification policy for fixed media which includes hard disk. Only following values are valid:<BR><BR>\n"
|
|---|
| 54 | "NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>\n"
|
|---|
| 55 | "0x00000000 Always trust the image.<BR>\n"
|
|---|
| 56 | "0x00000001 Never trust the image.<BR>\n"
|
|---|
| 57 | "0x00000002 Allow execution when there is security violation.<BR>\n"
|
|---|
| 58 | "0x00000003 Defer execution when there is security violation.<BR>\n"
|
|---|
| 59 | "0x00000004 Deny execution when there is security violation.<BR>\n"
|
|---|
| 60 | "0x00000005 Query user when there is security violation.<BR>"
|
|---|
| 61 |
|
|---|
| 62 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdDeferImageLoadPolicy_PROMPT #language en-US "Set policy whether trust image before user identification."
|
|---|
| 63 |
|
|---|
| 64 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdDeferImageLoadPolicy_HELP #language en-US "Defer Image Load policy settings. The policy is bitwise. If a bit is set, the image from corresponding device will be trusted when loading. Or the image will be deferred. The deferred image will be checked after user is identified.<BR><BR>\n"
|
|---|
| 65 | "BIT0 - Image from unknown device. <BR>\n"
|
|---|
| 66 | "BIT1 - Image from firmware volume.<BR>\n"
|
|---|
| 67 | "BIT2 - Image from OptionRom.<BR>\n"
|
|---|
| 68 | "BIT3 - Image from removable media which includes CD-ROM, Floppy, USB and network.<BR>\n"
|
|---|
| 69 | "BIT4 - Image from fixed media device which includes hard disk.<BR>"
|
|---|
| 70 |
|
|---|
| 71 | #string STR_gEfiSecurityPkgTokenSpaceGuid_ERR_80000002 #language en-US "Reserved bits must be set to zero."
|
|---|
| 72 |
|
|---|
| 73 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFixedUsbCredentialProviderTokenFileName_PROMPT #language en-US "File name to save credential."
|
|---|
| 74 |
|
|---|
| 75 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFixedUsbCredentialProviderTokenFileName_HELP #language en-US "Null-terminated Unicode string of the file name that is the default name to save USB credential. The specified file should be saved at the root directory of USB storage disk."
|
|---|
| 76 |
|
|---|
| 77 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdMaxAppendVariableSize_PROMPT #language en-US "Max variable size for append operation."
|
|---|
| 78 |
|
|---|
| 79 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdMaxAppendVariableSize_HELP #language en-US "The size of Append variable buffer. This buffer is reserved for runtime use, OS can append data into one existing variable. Note: This PCD is not been used."
|
|---|
| 80 |
|
|---|
| 81 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmPlatformClass_PROMPT #language en-US "Select platform type."
|
|---|
| 82 |
|
|---|
| 83 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmPlatformClass_HELP #language en-US "Specifies the type of TCG platform that contains TPM chip.<BR><BR>\n"
|
|---|
| 84 | "If 0, TCG platform type is PC client.<BR>\n"
|
|---|
| 85 | "If 1, TCG platform type is PC server.<BR>"
|
|---|
| 86 |
|
|---|
| 87 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmPhysicalPresence_PROMPT #language en-US "Physical presence of the platform operator."
|
|---|
| 88 |
|
|---|
| 89 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmPhysicalPresence_HELP #language en-US "Indicates the presence or absence of the platform operator during firmware booting. If platform operator is not physical presnece during boot. TPM will be locked and the TPM commands that required operator physical presence can not run.<BR><BR>\n"
|
|---|
| 90 | "TRUE - The platform operator is physically present.<BR>\n"
|
|---|
| 91 | "FALSE - The platform operator is not physically present.<BR>"
|
|---|
| 92 |
|
|---|
| 93 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceLifetimeLock_PROMPT #language en-US "Lock TPM physical presence asserting method."
|
|---|
| 94 |
|
|---|
| 95 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceLifetimeLock_HELP #language en-US "Indicates whether TPM physical presence is locked during platform initialization. Once it is locked, it can not be unlocked for TPM life time.<BR><BR>\n"
|
|---|
| 96 | "TRUE - Lock TPM physical presence asserting method.<BR>\n"
|
|---|
| 97 | "FALSE - Not lock TPM physical presence asserting method.<BR>"
|
|---|
| 98 |
|
|---|
| 99 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceCmdEnable_PROMPT #language en-US "Enable software method of asserting physical presence."
|
|---|
| 100 |
|
|---|
| 101 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceCmdEnable_HELP #language en-US "Indicates whether the platform supports the software method of asserting physical presence.<BR><BR>\n"
|
|---|
| 102 | "TRUE - Supports the software method of asserting physical presence.<BR>\n"
|
|---|
| 103 | "FALSE - Does not support the software method of asserting physical presence.<BR>"
|
|---|
| 104 |
|
|---|
| 105 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceHwEnable_PROMPT #language en-US "Enable hardware method of asserting physical presence."
|
|---|
| 106 |
|
|---|
| 107 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdPhysicalPresenceHwEnable_HELP #language en-US "Indicates whether the platform supports the hardware method of asserting physical presence.<BR><BR>\n"
|
|---|
| 108 | "TRUE - Supports the hardware method of asserting physical presence.<BR>\n"
|
|---|
| 109 | "FALSE - Does not support the hardware method of asserting physical presence.<BR>"
|
|---|
| 110 |
|
|---|
| 111 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFirmwareDebuggerInitialized_PROMPT #language en-US "Firmware debugger status."
|
|---|
| 112 |
|
|---|
| 113 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdFirmwareDebuggerInitialized_HELP #language en-US "This PCD indicates if debugger exists. <BR><BR>\n"
|
|---|
| 114 | "TRUE - Firmware debugger exists.<BR>\n"
|
|---|
| 115 | "FALSE - Firmware debugger doesn't exist.<BR>"
|
|---|
| 116 |
|
|---|
| 117 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2InitializationPolicy_PROMPT #language en-US "TPM 2.0 device initialization policy.<BR>"
|
|---|
| 118 |
|
|---|
| 119 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2InitializationPolicy_HELP #language en-US "This PCD indicates the initialization policy for TPM 2.0.<BR><BR>\n"
|
|---|
| 120 | "If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>\n"
|
|---|
| 121 | "If 1, initialization needed.<BR>"
|
|---|
| 122 |
|
|---|
| 123 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmInitializationPolicy_PROMPT #language en-US "TPM 1.2 device initialization policy."
|
|---|
| 124 |
|
|---|
| 125 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmInitializationPolicy_HELP #language en-US "This PCD indicates the initialization policy for TPM 1.2.<BR><BR>\n"
|
|---|
| 126 | "If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>\n"
|
|---|
| 127 | "If 1, initialization needed.<BR>"
|
|---|
| 128 |
|
|---|
| 129 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2SelfTestPolicy_PROMPT #language en-US "TPM 2.0 device selftest."
|
|---|
| 130 |
|
|---|
| 131 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2SelfTestPolicy_HELP #language en-US "This PCD indicates the TPM 2.0 SelfTest policy.<BR><BR>\n"
|
|---|
| 132 | "if 0, no SelfTest needed - most likely used for fTPM, because it might already be tested.<BR>\n"
|
|---|
| 133 | "if 1, SelfTest needed.<BR>"
|
|---|
| 134 |
|
|---|
| 135 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2ScrtmPolicy_PROMPT #language en-US "SCRTM policy setting for TPM 2.0 device."
|
|---|
| 136 |
|
|---|
| 137 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2ScrtmPolicy_HELP #language en-US "This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 2.0.<BR><BR>\n"
|
|---|
| 138 | "if 0, no SCRTM measurement needed - In this case, it is already done.<BR>\n"
|
|---|
| 139 | "if 1, SCRTM measurement done by BIOS.<BR>"
|
|---|
| 140 |
|
|---|
| 141 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmScrtmPolicy_PROMPT #language en-US "SCRTM policy setting for TPM 1.2 device"
|
|---|
| 142 |
|
|---|
| 143 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmScrtmPolicy_HELP #language en-US "This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 1.2.<BR><BR>\n"
|
|---|
| 144 | "if 0, no SCRTM measurement needed - In this case, it is already done.<BR>\n"
|
|---|
| 145 | "if 1, SCRTM measurement done by BIOS.<BR>"
|
|---|
| 146 |
|
|---|
| 147 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmInstanceGuid_PROMPT #language en-US "TPM device type identifier"
|
|---|
| 148 |
|
|---|
| 149 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmInstanceGuid_HELP #language en-US "Guid name to identify TPM instance.<BR><BR>\n"
|
|---|
| 150 | "TPM_DEVICE_INTERFACE_NONE means disable.<BR>\n"
|
|---|
| 151 | "TPM_DEVICE_INTERFACE_TPM12 means TPM 1.2 DTPM.<BR>\n"
|
|---|
| 152 | "TPM_DEVICE_INTERFACE_DTPM2 means TPM 2.0 DTPM.<BR>"
|
|---|
| 153 |
|
|---|
| 154 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2HashMask_PROMPT #language en-US "Hash mask for TPM 2.0"
|
|---|
| 155 |
|
|---|
| 156 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpm2HashMask_HELP #language en-US "This PCD indicates Hash mask for TPM 2.0.<BR><BR>\n"
|
|---|
| 157 | "If this bit is set, that means this algorithm is needed to extend to PCR.<BR>\n"
|
|---|
| 158 | "If this bit is clear, that means this algorithm is NOT needed to extend to PCR.<BR>\n"
|
|---|
| 159 | "BIT0 - SHA1.<BR>\n"
|
|---|
| 160 | "BIT1 - SHA256.<BR>\n"
|
|---|
| 161 | "BIT2 - SHA384.<BR>\n"
|
|---|
| 162 | "BIT3 - SHA512.<BR>"
|
|---|
| 163 |
|
|---|
| 164 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmAutoDetection_PROMPT #language en-US "TPM type detection."
|
|---|
| 165 |
|
|---|
| 166 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmAutoDetection_HELP #language en-US "This PCD indicates if BIOS auto detect TPM1.2 or dTPM2.0.<BR><BR>\n"
|
|---|
| 167 | "FALSE - No auto detection.<BR>\n"
|
|---|
| 168 | "TRUE - Auto detection.<BR>"
|
|---|
| 169 |
|
|---|
| 170 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmBaseAddress_PROMPT #language en-US "TPM device address."
|
|---|
| 171 |
|
|---|
| 172 | #string STR_gEfiSecurityPkgTokenSpaceGuid_PcdTpmBaseAddress_HELP #language en-US "This PCD indicates TPM base address.<BR><BR>"
|
|---|
| 173 |
|
|---|
