[PATCH v2 2/4] OvmfPkg: Handle TPM 2 physical presence opcodes much earlier


Stefan Berger
 

From: Stefan Berger <stefanb@linux.vnet.ibm.com>

Handle the TPM 2 physical presence interface (PPI) opcodes in
PlatformBootManagerBeforeConsole() before the TPM 2 platform hierarchy
is disabled. Since the handling of the PPI opcodes may require inter-
action with the user, initialize the keyboard before handling PPI codes.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
.../PlatformBootManagerLib/BdsPlatform.c | 19 +++++++++++--------
.../PlatformBootManagerLibBhyve/BdsPlatform.c | 17 ++++++++++-------
.../PlatformBootManagerLibGrub/BdsPlatform.c | 17 ++++++++++-------
3 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg=
/Library/PlatformBootManagerLib/BdsPlatform.c
index 71f63b2448..4448722e19 100644
--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
@@ -387,8 +387,19 @@ PlatformBootManagerBeforeConsole (
SaveS3BootScript ();=0D
}=0D
=0D
+ // We need to connect all trusted consoles for TCG PP. Here we treat all=
=0D
+ // consoles in OVMF to be trusted consoles.=0D
+ PlatformInitializeConsole (=0D
+ XenDetected() ? gXenPlatformConsole : gPlatformConsole);=0D
+=0D
+ //=0D
+ // Process TPM PPI request; this may require keyboard input=0D
+ //=0D
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
+=0D
//=0D
// Prevent further changes to LockBoxes or SMRAM.=0D
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.=
=0D
//=0D
Handle =3D NULL;=0D
Status =3D gBS->InstallProtocolInterface (&Handle,=0D
@@ -402,9 +413,6 @@ PlatformBootManagerBeforeConsole (
//=0D
EfiBootManagerDispatchDeferredImages ();=0D
=0D
- PlatformInitializeConsole (=0D
- XenDetected() ? gXenPlatformConsole : gPlatformConsole);=0D
-=0D
FrontPageTimeout =3D GetFrontPageTimeoutFromQemu ();=0D
PcdStatus =3D PcdSet16S (PcdPlatformBootTimeOut, FrontPageTimeout);=0D
ASSERT_RETURN_ERROR (PcdStatus);=0D
@@ -1511,11 +1519,6 @@ PlatformBootManagerAfterConsole (
//=0D
PciAcpiInitialization ();=0D
=0D
- //=0D
- // Process TPM PPI request=0D
- //=0D
- Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
-=0D
//=0D
// Process QEMU's -kernel command line option=0D
//=0D
diff --git a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c b/Ov=
mfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
index eaade4adea..513d2f00a7 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c
@@ -375,8 +375,18 @@ PlatformBootManagerBeforeConsole (
//=0D
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);=0D
=0D
+ // We need to connect all trusted consoles for TCG PP. Here we treat all=
=0D
+ // consoles in OVMF to be trusted consoles.=0D
+ PlatformInitializeConsole (gPlatformConsole);=0D
+=0D
+ //=0D
+ // Process TPM PPI request=0D
+ //=0D
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
+=0D
//=0D
// Prevent further changes to LockBoxes or SMRAM.=0D
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.=
=0D
//=0D
Handle =3D NULL;=0D
Status =3D gBS->InstallProtocolInterface (&Handle,=0D
@@ -390,8 +400,6 @@ PlatformBootManagerBeforeConsole (
//=0D
EfiBootManagerDispatchDeferredImages ();=0D
=0D
- PlatformInitializeConsole (gPlatformConsole);=0D
-=0D
PlatformRegisterOptionsAndKeys ();=0D
=0D
//=0D
@@ -1445,11 +1453,6 @@ PlatformBootManagerAfterConsole (
//=0D
PciAcpiInitialization ();=0D
=0D
- //=0D
- // Process TPM PPI request=0D
- //=0D
- Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
-=0D
//=0D
// Perform some platform specific connect sequence=0D
//=0D
diff --git a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c b/Ovm=
fPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
index 7cceeea487..1c5405f620 100644
--- a/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
@@ -338,8 +338,18 @@ PlatformBootManagerBeforeConsole (
//=0D
EfiEventGroupSignal (&gEfiEndOfDxeEventGroupGuid);=0D
=0D
+ // We need to connect all trusted consoles for TCG PP. Here we treat all=
=0D
+ // consoles in OVMF to be trusted consoles.=0D
+ PlatformInitializeConsole (gPlatformConsole);=0D
+=0D
+ //=0D
+ // Process TPM PPI request=0D
+ //=0D
+ Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
+=0D
//=0D
// Prevent further changes to LockBoxes or SMRAM.=0D
+ // Any TPM 2 Physical Presence Interface opcode must be handled before.=
=0D
//=0D
Handle =3D NULL;=0D
Status =3D gBS->InstallProtocolInterface (&Handle,=0D
@@ -353,8 +363,6 @@ PlatformBootManagerBeforeConsole (
//=0D
EfiBootManagerDispatchDeferredImages ();=0D
=0D
- PlatformInitializeConsole (gPlatformConsole);=0D
-=0D
Status =3D gRT->SetVariable (=0D
EFI_TIME_OUT_VARIABLE_NAME,=0D
&gEfiGlobalVariableGuid,=0D
@@ -1310,11 +1318,6 @@ PlatformBootManagerAfterConsole (
//=0D
PciAcpiInitialization ();=0D
=0D
- //=0D
- // Process TPM PPI request=0D
- //=0D
- Tcg2PhysicalPresenceLibProcessRequest (NULL);=0D
-=0D
//=0D
// Process QEMU's -kernel command line option=0D
//=0D
--=20
2.31.1

Join devel@edk2.groups.io to automatically receive all group messages.