Re: [PATCH v2 0/7] MdeModulePkg: add support for dispatching foreign arch PE/COFF images

["Yao, Jiewen" <jiewen.yao@intel.com>]

Ok. Cool!


> -----Original Message-----
> From: Ard Biesheuvel [mailto:ard.biesheuvel@linaro.org]
> Sent: Wednesday, September 19, 2018 9:55 PM
> To: Yao, Jiewen <jiewen.yao@intel.com>
> Cc: Ni, Ruiyu <ruiyu.ni@intel.com>; Zimmer, Vincent
> <vincent.zimmer@intel.com>; Dong, Eric <eric.dong@intel.com>;
> edk2-devel@lists.01.org; Andrew Fish <afish@apple.com>; Gao, Liming
> <liming.gao@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Richardson, Brian <brian.richardson@intel.com>; Carsey, Jaben
> <jaben.carsey@intel.com>; Zeng, Star <star.zeng@intel.com>
> Subject: Re: [edk2] [PATCH v2 0/7] MdeModulePkg: add support for
> dispatching foreign arch PE/COFF images
> 
> On 19 September 2018 at 02:29, Yao, Jiewen <jiewen.yao@intel.com>
> wrote:
> > Thank you Ard. Good to know.
> >
> > Did you also try some security test, such as input a bad image to see if the
> code can return failure gracefully?
> >
> > Or enable secure boot to see if the image verification process still works
> well ?
> >
> > One more, did you enable tpm to see if tpm measurement still works well ?
> >
> > Also did defer image solution still takes effect with this change?
> >
> > Sorry to ask many questions, I want to make sure the current security
> design still work with this new capability.
> >
> 
> Hello Jiewen,
> 
> As far as I can tell, all the security checks are done *before*
> CoreLoadPeImage() is called, and the code flow has not changed at all
> before that point.