From 9e5b72e986dcfee005edba5f5b30e0ddf80b363f Mon Sep 17 00:00:00 2001 From: Alexander Dale Date: Wed, 20 Feb 2019 13:26:07 -0800 Subject: [PATCH] Fix table --- ...-guard-secure-launch-and-smm-protection.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index ae8ce4ba94..f261ef363b 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -63,21 +63,23 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic ## Requirements Your environment needs the following hardware to run System Guard Secure Launch. -|For Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon requirements|Description| +|For Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon requirements|Description| |--------|-----------| |64-bit CPU|A 64-bit computer with minimum 4 cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](https://docs.microsoft.com/virtualization/hyper-v-on-windows/reference/tlfs).| |Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs are not supported.| -|Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them)| +|Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them).| |SMM communication buffers| All SMM communication buffers must be implemented in EfiRuntimeServicesData ,EfiRuntimeServicesCode , EfiACPIMemoryNVS, or EfiReservedMemoryType memory types. | |SMM Page Tables| Must NOT contain any mappings to EfiConventionalMemory (e.g. no OS/VMM owned memory).
Must NOT contain any mappings to code sections within EfiRuntimeServicesCode.
Must NOT have execute and write permissions for the same page
Must allow ONLY that TSEG pages can be marked executable and the memory map must report TSEG EfiReservedMemoryType.
BIOS SMI handler must be implemented such that SMM page tables are locked on every SMM entry. | |Modern/Connected Standby|Platforms must support Modern/Connected Standby.| -|TPM AUX Index|Platform must set up a AUX index with index, attributes, and policy that exactly corresponds to the AUX index specified in the TXT DG with a data size of exactly 104 bytes (for SHA256 AUX data). (NameAlg = SHA256)
Platforms must set up a PS (Platform Supplier) index with: PS index data DataRevocationCounters, SINITMinVersion, and PolicyControl must all be 0x00 | +|TPM AUX Index|Platform must set up a AUX index with index, attributes, and policy that exactly corresponds to the AUX index specified in the TXT DG with a data size of exactly 104 bytes (for SHA256 AUX data). (NameAlg = SHA256)
Platforms must set up a PS (Platform Supplier) index with: PS index data DataRevocationCounters, SINITMinVersion, and PolicyControl must all be 0x00 | |AUX Policy|The required AUX policy must be as follows: | -|Platform firmware|Platform firmware must carry all code required to execute an Intel® Trusted Execution Technology secure launch: | -|System firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | -## Software requirements -Your environment needs the following software to run Windows Defender Application Guard. +|Platform firmware|Platform firmware must carry all code required to execute an Intel® Trusted Execution Technology secure launch: | +|Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | -|Software|Description| +|For Qualcomm® processors with SD850 or later chipsets|Description| |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803| \ No newline at end of file +|Monitor Mode Communication|All Monitor Mode communication buffers must be implemented in either EfiRuntimeServicesData (recommended), data sections of EfiRuntimeServicesCode as described by the Memory Attributes Table, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types| +|Monitor Mode Page Tables|All Monitor Mode page tables must: | +|Modern/Connected Standby|Platforms must support Modern/Connected Standby.| +|Platform firmware|Platform firmware must carry all code required to perform a launch.| +|Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. |