From: Stefan Berger <stef...@linux.vnet.ibm.com>
Handle the TPM 2 physical presence interface (PPI) opcodes in
PlatformBootManagerBeforeConsole() before the TPM 2 platform hierarchy
is disabled. Since the handling of the PPI opcodes may require inter-
action with the user, initialize the keyboard before handling PPI codes.
Cc: Rebecca Cran <rebe...@bsdio.com>
Cc: Peter Grehan <gre...@freebsd.org>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Gerd Hoffmann <kra...@redhat.com>
Signed-off-by: Stefan Berger <stef...@linux.ibm.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
---
.../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
.../PlatformBootManagerLibBhyve/BdsPlatform.c | 17 ++++++++++-------
.../PlatformBootManagerLibGrub/BdsPlatform.c | 17 ++++++++++-------
3 files changed, 31 insertions(+), 22 deletions(-)
diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
index 71f63b2448..4448722e19 100644
--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
@@ -387,8 +387,19 @@ PlatformBootManagerBeforeConsole (
SaveS3BootScript ();
}
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (
+ XenDetected() ? gXenPlatformConsole : gPlatformConsole);
+
+ //
+ // Process TPM PPI request; this may require keyboard input
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -402,9 +413,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (
- XenDetected() ? gXenPlatformConsole : gPlatformConsole);
-
FrontPageTimeout = GetFrontPageTimeoutFromQemu ();
PcdStatus = PcdSet16S (PcdPlatformBootTimeOut, FrontPageTimeout);
ASSERT_RETURN_ERROR (PcdStatus);
@@ -1511,11 +1519,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Process QEMU's -kernel command line option
//
diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
index eaade4adea..513d2f00a7 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
@@ -375,8 +375,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (gPlatformConsole);
+
+ //
+ // Process TPM PPI request
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -390,8 +400,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (gPlatformConsole);
-
PlatformRegisterOptionsAndKeys ();
//
@@ -1445,11 +1453,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Perform some platform specific connect sequence
//
diff --git a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
index 7cceeea487..1c5405f620 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
@@ -338,8 +338,18 @@ PlatformBootManagerBeforeConsole (
//
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);
+ // We need to connect all trusted consoles for TCG PP. Here we treat all
+ // consoles in OVMF to be trusted consoles.
+ PlatformInitializeConsole (gPlatformConsole);
+
+ //
+ // Process TPM PPI request
+ //
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);
+
//
// Prevent further changes to LockBoxes or SMRAM.
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.
//
Handle = NULL;
Status = gBS->InstallProtocolInterface (&Handle,
@@ -353,8 +363,6 @@ PlatformBootManagerBeforeConsole (
//
EfiBootManagerDispatchDeferredImages ();
- PlatformInitializeConsole (gPlatformConsole);
-
Status = gRT->SetVariable (
EFI_TIME_OUT_VARIABLE_NAME,
&gEfiGlobalVariableGuid,
@@ -1310,11 +1318,6 @@ PlatformBootManagerAfterConsole (
//
PciAcpiInitialization ();
- //
- // Process TPM PPI request
- //
- Tcg2PhysicalPresenceLibProcessRequest (NULL);
-
//
// Process QEMU's -kernel command line option
//
--
2.31.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#80677): https://edk2.groups.io/g/devel/message/80677
Mute This Topic: https://groups.io/mt/85617943/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
