On Mon, Nov 4, 2024 at 10:41 AM Gerd Hoffmann <kra...@redhat.com> wrote:
>
> On Mon, Nov 04, 2024 at 10:14:47AM +0100, Stefano Garzarella wrote:
> > Hi Gerd,
> >
> > On Fri, Nov 1, 2024 at 10:31 AM Gerd Hoffmann <kra...@redhat.com> wrote:
> > >
> > > Hi,
> > >
> > > > By analyzing the calls to the dispatcher (`gDS->Dispatch ()`) I found
> > > > that when we only have COM1, EfiBootManagerConnectDevicePath() at some
> > > > point invokes `gDS->Dispatch ()` after VirtioRng has started. This call
> > > > will then get DxeNetLib loaded.
> > >
> > > Ok, so it is probably a good idea to explicitly request a dispatch after
> > > activating virtio-rng, so we do not depend on this happening by pure
> > > luck for other reasons:
> > >
> > > --- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
> > > +++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
> > > @@ -670,6 +670,7 @@ ConnectVirtioPciRng (
> > > if (EFI_ERROR (Status)) {
> > > goto Error;
> > > }
> > > + gDS->Dispatch ();
> > > }
> > >
> > > return EFI_SUCCESS;
> > >
> > > [ untested patch, and we probably should do something similar for ArmVirt,
> > > /me goes continue walking through my email backlog now ]
> > >
> >
> > Yep, that should work.
Should we include this fix also in ConnectVirtioPciRng() in
OvmfPkg/Library/PlatformBootManagerLibBhyve/BdsPlatform.c ?
> >
> > Last week I went a little deeper into the problem and basically
> > starting with commit 4c4ceb2ceb ("NetworkPkg: SECURITY PATCH
> > CVE-2023-45237") the network stack is no longer initialized during
> > DXE, but in BDS (see
> > https://issues.redhat.com/browse/RHEL-58631?focusedId=25981655&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-25981655).
> >
> > Is this intentional? Could there be other problems besides this one we just
> > had?
>
> A lot of the more important stuff for network booting happens in the
> BDS phase anyway, i.e. OVMF checking the qemu boot order, connecting
> the devices configured as bootable devices (including the NICs),
> creating (if needed) and sorting the BootNNNN entries.
>
> So I don't expect any bad side effects from initializing the core
> network modules in the (early) BDS phase.
I see, thanks!
Stefano
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#120710): https://edk2.groups.io/g/devel/message/120710
Mute This Topic: https://groups.io/mt/109008158/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
