summaryrefslogtreecommitdiff
path: root/SecurityPkg/SecurityPkg.dec
blob: b432c4459ecfaaa094f4876968459a47a79a5e08 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
## @file  SecurityPkg.dec
#  Provides security features that conform to TCG/UEFI industry standards
#
#  The security features include secure boot, measured boot and user identification.
#  It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes)
#  and libraries instances, which are used for those features.
#
# Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
# (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR>
# This program and the accompanying materials are licensed and made available under
# the terms and conditions of the BSD License which accompanies this distribution.
# The full text of the license may be found at
# http://opensource.org/licenses/bsd-license.php
#
# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#
##

[Defines]
  DEC_SPECIFICATION              = 0x00010005
  PACKAGE_NAME                   = SecurityPkg
  PACKAGE_UNI_FILE               = SecurityPkg.uni
  PACKAGE_GUID                   = 4EFC4F66-6219-4427-B780-FB99F470767F
  PACKAGE_VERSION                = 0.96

[Includes]
  Include

[LibraryClasses]
  ##  @libraryclass  Provides hash interfaces from different implementations.
  # 
  HashLib|Include/Library/HashLib.h
  
  ##  @libraryclass  Provides a platform specific interface to detect physically present user.
  #
  PlatformSecureLib|Include/Library/PlatformSecureLib.h
  
  ##  @libraryclass  Provides interfaces to handle TPM 1.2 request.
  #
  TcgPhysicalPresenceLib|Include/Library/TcgPhysicalPresenceLib.h
  
  ##  @libraryclass  Provides support for TCG PP >= 128 Vendor Specific PPI Operation.
  #
  TcgPpVendorLib|Include/Library/TcgPpVendorLib.h
  
  ##  @libraryclass  Provides interfaces for other modules to send TPM 2.0 command.
  #
  Tpm2CommandLib|Include/Library/Tpm2CommandLib.h
  
  ##  @libraryclass  Provides interfaces on how to access TPM 2.0 hardware device.
  #
  Tpm2DeviceLib|Include/Library/Tpm2DeviceLib.h
  
  ##  @libraryclass  Provides interfaces for other modules to send TPM 1.2 command.
  #
  Tpm12CommandLib|Include/Library/Tpm12CommandLib.h
  
  ##  @libraryclass  Provides interfaces on how to access TPM 1.2 hardware device.
  #
  Tpm12DeviceLib|Include/Library/Tpm12DeviceLib.h
  
  ##  @libraryclass  Provides TPM Interface Specification (TIS) interfaces for TPM command.
  #
  TpmCommLib|Include/Library/TpmCommLib.h
  
  ##  @libraryclass  Provides interfaces to handle TPM 2.0 request.
  #
  TrEEPhysicalPresenceLib|Include/Library/TrEEPhysicalPresenceLib.h
  
  ##  @libraryclass  Provides support for TrEE PP >= 128 Vendor Specific PPI Operation.
  #
  TrEEPpVendorLib|Include/Library/TrEEPpVendorLib.h
  
  ##  @libraryclass  Provides support for TCG Physical Presence Interface (PPI) specification 
  #   >= 128 Vendor Specific PPI Operation.
  #
  Tcg2PpVendorLib|Include/Library/TcgPpVendorLib.h
  
  ##  @libraryclass  Handle TPM 2.0 physical presence request from OS.
  #
  Tcg2PhysicalPresenceLib|Include/Library/Tcg2PhysicalPresenceLib.h

[Guids]
  ## Security package token space guid.
  # Include/Guid/SecurityPkgTokenSpace.h
  gEfiSecurityPkgTokenSpaceGuid      = { 0xd3fb176, 0x9569, 0x4d51, { 0xa3, 0xef, 0x7d, 0x61, 0xc6, 0x4f, 0xea, 0xba }}

  ## GUID used to "SecureBootEnable" variable for the Secure Boot feature enable/disable.
  #  This variable is used for allowing a physically present user to disable Secure Boot via firmware setup without the possession of PKpriv.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiSecureBootEnableDisableGuid    = { 0xf0a30bc7, 0xaf08, 0x4556, { 0x99, 0xc4, 0x0, 0x10, 0x9, 0xc9, 0x3a, 0x44 } }

  ## GUID used to "CustomMode" variable for two Secure Boot modes feature: "Custom" and "Standard".
  #  Standard Secure Boot mode is the default mode as UEFI Spec's description.
  #  Custom Secure Boot mode allows for more flexibility as specified in the following:
  #  Can enroll or delete PK without existing PK's private key.
  #  Can enroll or delete KEK without existing PK's private key.
  #  Can enroll or delete signature from DB/DBX without KEK's private key.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiCustomModeEnableGuid           = { 0xc076ec0c, 0x7028, 0x4399, { 0xa0, 0x72, 0x71, 0xee, 0x5c, 0x44, 0x8b, 0x9f } }

  ## GUID used to "VendorKeysNv" variable to record the out of band secure boot keys modification.
  #  This variable is a read-only NV variable that indicates whether someone other than the platform vendor has used a 
  #  mechanism not defined by the UEFI Specification to transition the system to setup mode or to update secure boot keys.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiVendorKeysNvGuid               = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } }

  ## GUID used to "certdb"/"certdbv" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEfiCertDbGuid                     = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } }

  ## GUID used to "SecureBootMode" variable to save platform secure boot mode
  #  Include/Guid/AuthenticatedVariableFormat.h
  gEdkiiSecureBootModeGuid           = { 0xc573b77, 0xeb93, 0x4d3d, { 0xaf, 0xfc, 0x5f, 0xeb, 0xca, 0xfb, 0x65, 0xb0 } }

  ## Hob GUID used to pass a TCG_PCR_EVENT from a TPM PEIM to a TPM DXE Driver.
  #  Include/Guid/TcgEventHob.h
  gTcgEventEntryHobGuid              = { 0x2b9ffb52, 0x1b13, 0x416f, { 0xa8, 0x7b, 0xbc, 0x93, 0xd, 0xef, 0x92, 0xa8 }}

  ## Hob GUID used to pass a TCG_PCR_EVENT_2 from a TPM2 PEIM to a TPM2 DXE Driver.
  ## Include/Guid/TcgEventHob.h
  gTcgEvent2EntryHobGuid             = { 0xd26c221e, 0x2430, 0x4c8a, { 0x91, 0x70, 0x3f, 0xcb, 0x45, 0x0, 0x41, 0x3f }}

  ## HOB GUID used to record TPM device error.
  #  Include/Guid/TcgEventHob.h
  gTpmErrorHobGuid                   = { 0xef598499, 0xb25e, 0x473a, { 0xbf, 0xaf, 0xe7, 0xe5, 0x7d, 0xce, 0x82, 0xc4 }}

  ## HOB GUID used to pass all PEI measured FV info to DXE Driver.
  #  Include/Guid/MeasuredFvHob.h
  gMeasuredFvHobGuid                 = { 0xb2360b42, 0x7173, 0x420a, { 0x86, 0x96, 0x46, 0xca, 0x6b, 0xab, 0x10, 0x60 }}

  ## GUID used to "PhysicalPresence" variable and "PhysicalPresenceFlags" variable for TPM request and response.
  #  Include/Guid/PhysicalPresenceData.h
  gEfiPhysicalPresenceGuid           = { 0xf6499b1, 0xe9ad, 0x493d, { 0xb9, 0xc2, 0x2f, 0x90, 0x81, 0x5c, 0x6c, 0xbc }}
  
  ## GUID used to "Tcg2PhysicalPresence" variable and "Tcg2PhysicalPresenceFlags" variable for TPM2 request and response.
  #  Include/Guid/Tcg2PhysicalPresenceData.h
  gEfiTcg2PhysicalPresenceGuid = { 0xaeb9c5c1, 0x94f1, 0x4d02, { 0xbf, 0xd9, 0x46, 0x2, 0xdb, 0x2d, 0x3c, 0x54 }}

  ## GUID used for form browser, password credential and provider identifier.
  # Include/Guid/PwdCredentialProviderHii.h
  gPwdCredentialProviderGuid         = { 0x78b9ec8b, 0xc000, 0x46c5, { 0xac, 0x93, 0x24, 0xa0, 0xc1, 0xbb, 0x0, 0xce }}

  ## GUID used for form browser, USB credential and provider identifier.
  #  Include/Guid/UsbCredentialProviderHii.h
  gUsbCredentialProviderGuid         = { 0xd0849ed1, 0xa88c, 0x4ba6, { 0xb1, 0xd6, 0xab, 0x50, 0xe2, 0x80, 0xb7, 0xa9 }}

  ## GUID used for FormSet guid and user profile variable.
  # Include/Guid/UserIdentifyManagerHii.h
  gUserIdentifyManagerGuid           = { 0x3ccd3dd8, 0x8d45, 0x4fed, { 0x96, 0x2d, 0x2b, 0x38, 0xcd, 0x82, 0xb3, 0xc4 }}

  ## GUID used for FormSet.
  #  Include/Guid/UserProfileManagerHii.h
  gUserProfileManagerGuid            = { 0xc35f272c, 0x97c2, 0x465a, { 0xa2, 0x16, 0x69, 0x6b, 0x66, 0x8a, 0x8c, 0xfe }}

  ## GUID used for FormSet.
  #  Include/Guid/TcgConfigHii.h
  gTcgConfigFormSetGuid              = { 0xb0f901e4, 0xc424, 0x45de, { 0x90, 0x81, 0x95, 0xe2, 0xb, 0xde, 0x6f, 0xb5 }}
  
  ## GUID used for FormSet and config variable.
  #  Include/Guid/Tcg2ConfigHii.h
  gTcg2ConfigFormSetGuid    = {0x6339d487, 0x26ba, 0x424b, { 0x9a, 0x5d, 0x68, 0x7e, 0x25, 0xd7, 0x40, 0xbc }}
  
  ## GUID used for FormSet.
  #  Include/Guid/SecureBootConfigHii.h
  gSecureBootConfigFormSetGuid       = { 0x5daf50a5, 0xea81, 0x4de2, {0x8f, 0x9b, 0xca, 0xbd, 0xa9, 0xcf, 0x5c, 0x14}}

  ## GUID used to "TrEEPhysicalPresence" variable and "TrEEPhysicalPresenceFlags" variable for TPM2 request and response.
  #  Include/Guid/TrEEPhysicalPresenceData.h
  gEfiTrEEPhysicalPresenceGuid = { 0xf24643c2, 0xc622, 0x494e, { 0x8a, 0xd, 0x46, 0x32, 0x57, 0x9c, 0x2d, 0x5b }}

  ## GUID value used for PcdTpmInstanceGuid to indicate TPM is disabled.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceNoneGuid      = { 0x00000000, 0x0000, 0x0000, { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } }
  
  ## GUID value used for PcdTpmInstanceGuid to indicate TPM 1.2 device is selected to support.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceTpm12Guid     = { 0x8b01e5b6, 0x4f19, 0x46e8, { 0xab, 0x93, 0x1c, 0x53, 0x67, 0x1b, 0x90, 0xcc } }
  
  ## GUID value used for PcdTpmInstanceGuid to indicate discrete TPM 2.0 device is selected to support.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceInstanceTpm20DtpmGuid = { 0x286bf25a, 0xc2c3, 0x408c, { 0xb3, 0xb4, 0x25, 0xe6, 0x75, 0x8b, 0x73, 0x17 } }
  
  ## GUID used to select supported TPM instance from UI.
  #  Include/Guid/TpmInstance.h
  gEfiTpmDeviceSelectedGuid          = { 0x7f4158d3, 0x74d, 0x456d, { 0x8c, 0xb2, 0x1, 0xf9, 0xc8, 0xf7, 0x9d, 0xaa } }

  ## GUID used for FormSet and config variable.
  #  Include/Guid/TrEEConfigHii.h
  gTrEEConfigFormSetGuid              = {0xc54b425f, 0xaa79, 0x48b4, { 0x98, 0x1f, 0x99, 0x8b, 0x3c, 0x4b, 0x64, 0x1c }}

[Ppis]
  ## The PPI GUID for that TPM physical presence should be locked.
  # Include/Ppi/LockPhysicalPresence.h
  gPeiLockPhysicalPresencePpiGuid    = { 0xef9aefe5, 0x2bd3, 0x4031, { 0xaf, 0x7d, 0x5e, 0xfe, 0x5a, 0xbb, 0x9a, 0xd } }

  ## The PPI GUID for that TPM is initialized.
  # Include/Ppi/TpmInitialized.h
  gPeiTpmInitializedPpiGuid      = { 0xe9db0d58, 0xd48d, 0x47f6, { 0x9c, 0x6e, 0x6f, 0x40, 0xe8, 0x6c, 0x7b, 0x41 }}

  ## The PPI GUID for that TPM initialization is done. TPM initialization may be success or fail.
  # Include/Ppi/TpmInitialized.h
  gPeiTpmInitializationDonePpiGuid = { 0xa030d115, 0x54dd, 0x447b, { 0x90, 0x64, 0xf2, 0x6, 0x88, 0x3d, 0x7c, 0xcc }}

  ## Include/Ppi/FirmwareVolumeInfoMeasurementExcluded.h
  gEfiPeiFirmwareVolumeInfoMeasurementExcludedPpiGuid = { 0x6e056ff9, 0xc695, 0x4364, { 0x9e, 0x2c, 0x61, 0x26, 0xf5, 0xce, 0xea, 0xae } }

#
# [Error.gEfiSecurityPkgTokenSpaceGuid]
#   0x80000001 | Invalid value provided.
#   0x80000002 | Reserved bits must be set to zero.
#   0x80000003 | Incorrect progress or error code provided.
#

[PcdsFixedAtBuild, PcdsPatchableInModule]
  ## Image verification policy for OptionRom. Only following values are valid:<BR><BR>
  #  NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
  #  0x00000000      Always trust the image.<BR>
  #  0x00000001      Never trust the image.<BR>
  #  0x00000002      Allow execution when there is security violation.<BR>
  #  0x00000003      Defer execution when there is security violation.<BR>
  #  0x00000004      Deny execution when there is security violation.<BR>
  #  0x00000005      Query user when there is security violation.<BR>
  # @Prompt Set policy for the image from OptionRom.
  # @ValidRange 0x80000001 | 0x00000000 - 0x00000005
  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04|UINT32|0x00000001

  ## Image verification policy for removable media which includes CD-ROM, Floppy, USB and network.
  #  Only following values are valid:<BR><BR>
  #  NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
  #  0x00000000      Always trust the image.<BR>
  #  0x00000001      Never trust the image.<BR>
  #  0x00000002      Allow execution when there is security violation.<BR>
  #  0x00000003      Defer execution when there is security violation.<BR>
  #  0x00000004      Deny execution when there is security violation.<BR>
  #  0x00000005      Query user when there is security violation.<BR>
  # @Prompt Set policy for the image from removable media.
  # @ValidRange 0x80000001 | 0x00000000 - 0x00000005
  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04|UINT32|0x00000002

  ## Image verification policy for fixed media which includes hard disk.
  #  Only following values are valid:<BR><BR>
  #  NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
  #  0x00000000      Always trust the image.<BR>
  #  0x00000001      Never trust the image.<BR>
  #  0x00000002      Allow execution when there is security violation.<BR>
  #  0x00000003      Defer execution when there is security violation.<BR>
  #  0x00000004      Deny execution when there is security violation.<BR>
  #  0x00000005      Query user when there is security violation.<BR>
  # @Prompt Set policy for the image from fixed media.
  # @ValidRange 0x80000001 | 0x00000000 - 0x00000005 
  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04|UINT32|0x00000003

  ## Defer Image Load policy settings. The policy is bitwise. 
  #  If a bit is set, the image from corresponding device will be trusted when loading. Or  
  #  the image will be deferred. The deferred image will be checked after user is identified.<BR><BR>
  #    BIT0       - Image from unknown device. <BR>
  #    BIT1       - Image from firmware volume.<BR>
  #    BIT2       - Image from OptionRom.<BR>
  #    BIT3       - Image from removable media which includes CD-ROM, Floppy, USB and network.<BR>
  #    BIT4       - Image from fixed media device which includes hard disk.<BR>
  # @Prompt Set policy whether trust image before user identification.
  # @ValidRange 0x80000002 | 0x00000000 - 0x0000001F 
  gEfiSecurityPkgTokenSpaceGuid.PcdDeferImageLoadPolicy|0x0000001F|UINT32|0x0000004

  ## Null-terminated Unicode string of the file name that is the default name to save USB credential.
  #  The specified file should be saved at the root directory of USB storage disk.
  # @Prompt File name to save credential.
  gEfiSecurityPkgTokenSpaceGuid.PcdFixedUsbCredentialProviderTokenFileName|L"Token.bin"|VOID*|0x00000005

  ## The size of Append variable buffer. This buffer is reserved for runtime use, OS can append data into one existing variable.
  #  Note: This PCD is not been used.
  # @Prompt Max variable size for append operation.
  gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize|0x2000|UINT32|0x30000005  

  ## Specifies the type of TCG platform that contains TPM chip.<BR><BR>
  #  If 0, TCG platform type is PC client.<BR>
  #  If 1, TCG platform type is PC server.<BR>
  # @Prompt Select platform type.
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmPlatformClass|0|UINT8|0x00000006
  
  ## Progress Code for TPM device subclass definitions.<BR><BR>
  #  EFI_PERIPHERAL_TPM  = (EFI_PERIPHERAL | 0x000D0000) = 0x010D0000<BR>
  # @Prompt Status Code for TPM device definitions
  # @ValidList  0x80000003 | 0x010D0000
  gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeSubClassTpmDevice|0x010D0000|UINT32|0x00000007

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## Indicates the presence or absence of the platform operator during firmware booting.
  #  If platform operator is not physical presence during boot. TPM will be locked and the TPM commands 
  #  that required operator physical presence can not run.<BR><BR>
  #   TRUE  - The platform operator is physically present.<BR>
  #   FALSE - The platform operator is not physically present.<BR>
  # @Prompt Physical presence of the platform operator.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## Indicates whether TPM physical presence is locked during platform initialization.  
  #  Once it is locked, it can not be unlocked for TPM life time.<BR><BR>
  #   TRUE  - Lock TPM physical presence asserting method.<BR>
  #   FALSE - Not lock TPM physical presence asserting method.<BR>
  # @Prompt Lock TPM physical presence asserting method.
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceLifetimeLock|FALSE|BOOLEAN|0x00010003

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## Indicates whether the platform supports the software method of asserting physical presence.<BR><BR>
  #   TRUE  - Supports the software method of asserting physical presence.<BR>
  #   FALSE - Does not support the software method of asserting physical presence.<BR>
  # @Prompt Enable software method of asserting physical presence.
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceCmdEnable|TRUE|BOOLEAN|0x00010004

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## Indicates whether the platform supports the hardware method of asserting physical presence.<BR><BR>
  #   TRUE  - Supports the hardware method of asserting physical presence.<BR>
  #   FALSE - Does not support the hardware method of asserting physical presence.<BR>
  # @Prompt Enable hardware method of asserting physical presence.
  gEfiSecurityPkgTokenSpaceGuid.PcdPhysicalPresenceHwEnable|TRUE|BOOLEAN|0x00010005

[PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
  ## This PCD indicates if debugger exists. <BR><BR>
  #   TRUE  - Firmware debugger exists.<BR>
  #   FALSE - Firmware debugger doesn't exist.<BR>
  # @Prompt Firmware debugger status.
  gEfiSecurityPkgTokenSpaceGuid.PcdFirmwareDebuggerInitialized|FALSE|BOOLEAN|0x00010009

  ## This PCD indicates the initialization policy for TPM 2.0.<BR><BR>
  #  If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>
  #  If 1, initialization needed.<BR>
  # @Prompt TPM 2.0 device initialization policy.<BR>
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2InitializationPolicy|1|UINT8|0x0001000A

  ## This PCD indicates the initialization policy for TPM 1.2.<BR><BR>
  #  If 0, no initialization needed - most likely used for chipset SRTM solution, in which TPM is already initialized.<BR>
  #  If 1, initialization needed.<BR>
  # @Prompt TPM 1.2 device initialization policy.
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInitializationPolicy|1|UINT8|0x0001000B

  ## This PCD indicates the TPM 2.0 SelfTest policy.<BR><BR>
  #  if 0, no SelfTest needed - most likely used for fTPM, because it might already be tested.<BR>
  #  if 1, SelfTest needed.<BR>
  # @Prompt TPM 2.0 device selftest.
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2SelfTestPolicy|1|UINT8|0x0001000C

  ## This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 2.0.<BR><BR>
  #  if 0, no SCRTM measurement needed - In this case, it is already done.<BR>
  #  if 1, SCRTM measurement done by BIOS.<BR>
  # @Prompt SCRTM policy setting for TPM 2.0 device.
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2ScrtmPolicy|1|UINT8|0x0001000D

  ## This PCD indicates Static Core Root of Trust for Measurement (SCRTM) policy using TPM 1.2.<BR><BR>
  #  if 0, no SCRTM measurement needed - In this case, it is already done.<BR>
  #  if 1, SCRTM measurement done by BIOS.<BR>
  # @Prompt SCRTM policy setting for TPM 1.2 device
  # @ValidRange 0x80000001 | 0x00 - 0x1 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmScrtmPolicy|1|UINT8|0x0001000E

  ## Guid name to identify TPM instance.<BR><BR>
  #  TPM_DEVICE_INTERFACE_NONE means disable.<BR>
  #  TPM_DEVICE_INTERFACE_TPM12 means TPM 1.2 DTPM.<BR>
  #  TPM_DEVICE_INTERFACE_DTPM2 means TPM 2.0 DTPM.<BR>
  #  Other GUID value means other TPM 2.0 device.<BR>
  # @Prompt TPM device type identifier
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmInstanceGuid |{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }|VOID*|0x0001000F

  ## This PCD indicates if BIOS auto detect TPM1.2 or dTPM2.0.<BR><BR>
  #  FALSE - No auto detection.<BR>
  #  TRUE  - Auto detection.<BR>
  # @Prompt TPM type detection.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmAutoDetection|TRUE|BOOLEAN|0x00010011

  ## This PCD indicates TPM base address.<BR><BR>
  # @Prompt TPM device address.
  gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0xFED40000|UINT64|0x00010012

  ## This PCR means the OEM configurated number of PCR banks.
  #  0 means dynamic get from supported HASH algorithm
  # @Prompt OEM configurated number of PCR banks.
  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2NumberOfPCRBanks|0x0|UINT32|0x00010015
  
  ## Provides one or more SHA 256 Hashes of the RSA 2048 public keys used to verify Recovery and Capsule Update images
  #
  # @Prompt One or more SHA 256 Hashes of RSA 2048 bit public keys used to verify Recovery and Capsule Update images
  #
  gEfiSecurityPkgTokenSpaceGuid.PcdRsa2048Sha256PublicKeyBuffer|{0x91, 0x29, 0xc4, 0xbd, 0xea, 0x6d, 0xda, 0xb3, 0xaa, 0x6f, 0x50, 0x16, 0xfc, 0xdb, 0x4b, 0x7e, 0x3c, 0xd6, 0xdc, 0xa4, 0x7a, 0x0e, 0xdd, 0xe6, 0x15, 0x8c, 0x73, 0x96, 0xa2, 0xd4, 0xa6, 0x4d}|VOID*|0x00010013

  ## This PCD defines minimum length(in bytes) of the system preboot TCG event log area(LAML).
  #  For PC Client Implementation spec up to and including 1.2 the minimum log size is 64KB.
  # @Prompt Minimum length(in bytes) of the system preboot TCG event log area(LAML).
  gEfiSecurityPkgTokenSpaceGuid.PcdTcgLogAreaMinLen|0x10000|UINT32|0x00010017

  ## This PCD defines length(in bytes) of the TCG2 Final event log area.
  # @Prompt Length(in bytes) of the TCG2 Final event log area.
  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2FinalLogAreaLen|0x8000|UINT32|0x00010018

[PcdsDynamic, PcdsDynamicEx]

  ## This PCD indicates Hash mask for TPM 2.0.<BR><BR>
  #  If this bit is set, that means this algorithm is needed to extend to PCR.<BR>
  #  If this bit is clear, that means this algorithm is NOT needed to extend to PCR.<BR>
  #    BIT0  -  SHA1.<BR>
  #    BIT1  -  SHA256.<BR>
  #    BIT2  -  SHA384.<BR>
  #    BIT3  -  SHA512.<BR>
  # @Prompt Hash mask for TPM 2.0
  # @ValidRange 0x80000001 | 0x00000000 - 0x0000000F 
  gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0x0000000F|UINT32|0x00010010

  ## This PCD indicated final BIOS supported Hash mask.
  #    Bios may choose to register a subset of PcdTpm2HashMask.
  #    So this PCD is final value of how many hash algo is extended to PCR.
  # @Prompt Hash Algorithm bitmap.
  gEfiSecurityPkgTokenSpaceGuid.PcdTcg2HashAlgorithmBitmap|0xFFFFFFFF|UINT32|0x00010016
  
[UserExtensions.TianoCore."ExtraFiles"]
  SecurityPkgExtra.uni