Re: [PATCH 0/4] Defer 3rd party images loading to after EndOfDxe

["Ni, Ruiyu" <ruiyu.ni@intel.com>]

Thanks/Ray

> -----Original Message-----
> From: Laszlo Ersek [mailto:lersek@redhat.com]
> Sent: Saturday, November 5, 2016 12:48 AM
> To: Ni, Ruiyu <ruiyu.ni@intel.com>; Gao, Liming <liming.gao@intel.com>;
> edk2-devel@lists.01.org <edk2-devel@ml01.01.org>
> Subject: Re: [edk2] [PATCH 0/4] Defer 3rd party images loading to after
> EndOfDxe
> 
> On 11/04/16 07:09, Ni, Ruiyu wrote:
> > No.
> > The open source platform patch will be sent out later.
> 
> What are the deferred / 3rd party images? Do Driver#### and SysPrep####
> qualify?

The images which are not from FV are treated as 3rd party images. And they will be
deferred to dispatch when they are dispatched before EndOfDxe event.
It's a new feature in the BS.LoadImage() path which can disallow executing
3rd party images before EndOfDxe and re-execute them after EndOfDxe.


> 
> Or, is this related to value 3 ("Defer execution when there is security
> violation") of:
> - PcdOptionRomImageVerificationPolicy,
> - PcdRemovableMediaImageVerificationPolicy,
> - PcdFixedMediaImageVerificationPolicy?

No.

> 
> Is the deferral documented somewhere in the UEFI spec, or do we have a
> Mantis ticket / ECR about it?
No.

> 
> Can we improve the commit messages please? From them, I have no idea
> how the deferral is supposed to work. (I.e., what the agents are, and how
> they interact.)
Yes. I will embed my first paragraph of reply in the commit message.

> 
> Thanks
> Laszlo
> 
> > From: Gao, Liming
> > Sent: Friday, November 4, 2016 1:14 PM
> > To: Ni, Ruiyu <ruiyu.ni@intel.com>; edk2-devel@lists.01.org
> > Subject: RE: [edk2] [PATCH 0/4] Defer 3rd party images loading to
> > after EndOfDxe
> >
> > Ray:
> >   Seemly, PlatformBdsLib library instance should call
> EfiBootManagerDispatchDeferredImages(), right? Are there patches to
> update PlatformBdsLib library instance?
> >
> > Thanks
> > Liming
> >> -----Original Message-----
> >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf
> >> Of Ruiyu Ni
> >> Sent: Friday, November 04, 2016 9:00 AM
> >> To: edk2-devel@lists.01.org<mailto:edk2-devel@lists.01.org>
> >> Subject: [edk2] [PATCH 0/4] Defer 3rd party images loading to after
> >> EndOfDxe
> >>
> >> The patches change the default image loading policy by deferring 3rd
> >> party images loading to after EndOfDxe and add a new BDS API to
> >> dispatch the deferred images.
> >>
> >> Platform needs to call the new BDS API
> >> EfiBootManagerDispatchDeferredImages after EndOfDxe to ensure that
> >> any deferred images are loaded.
> >>
> >> Ruiyu Ni (4):
> >>   MdeModulePkg/SecurityStubDxe: Defer 3rd party image before
> EndOfDxe
> >>   MdeModulePkg/UefiBootManager: Add
> >> EfiBootManagerDispatchDeferredImages
> >>   MdeModulePkg/BdsDxe: Check deferred images before booting to OS
> >>   MdeModulePkg/SecurityStubDxe: Report failure if image is load
> >> earlier
> >>
> >>  MdeModulePkg/Include/Library/UefiBootManagerLib.h  |  13 +
> >>  MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c   | 113 ++++++
> >>  .../Library/UefiBootManagerLib/InternalBm.h        |   1 +
> >>  .../UefiBootManagerLib/UefiBootManagerLib.inf      |   1 +
> >>  MdeModulePkg/Universal/BdsDxe/Bds.h                |   4 +-
> >>  MdeModulePkg/Universal/BdsDxe/BdsDxe.inf           |   2 +
> >>  MdeModulePkg/Universal/BdsDxe/BdsEntry.c           |  89 +++++
> >>  .../SecurityStubDxe/Defer3rdPartyImageLoad.c       | 413
> >> +++++++++++++++++++++
> >>  .../SecurityStubDxe/Defer3rdPartyImageLoad.h       |  95 +++++
> >>  .../Universal/SecurityStubDxe/SecurityStub.c       |  14 +-
> >>  .../Universal/SecurityStubDxe/SecurityStubDxe.inf  |  11 +-
> >>  11 files changed, 753 insertions(+), 3 deletions(-)  create mode
> >> 100644
> >> MdeModulePkg/Universal/SecurityStubDxe/Defer3rdPartyImageLoad.c
> >>  create mode 100644
> >> MdeModulePkg/Universal/SecurityStubDxe/Defer3rdPartyImageLoad.h
> >>
> >> --
> >> 2.9.0.windows.1
> >>
> >> _______________________________________________
> >> edk2-devel mailing list
> >> edk2-devel@lists.01.org<mailto:edk2-devel@lists.01.org>
> >> https://lists.01.org/mailman/listinfo/edk2-devel
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> >