linux-hardening - Re: [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c55c2c3b440c05a392230c380dceae79@ispras.ru>
Date:   Thu, 04 Aug 2022 17:26:33 +0300
From:   Evgeniy Baskov <baskov@...ras.ru>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Dave Hansen <dave.hansen@...el.com>,
        Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>, x86@...nel.org,
        linux-kernel@...r.kernel.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        linux-hardening@...r.kernel.org
Subject: Re: [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1

On 2022-08-04 14:22, Greg KH wrote:
...
> Are there any plans on getting those changes merged back upstream to 
> the
> main UEFI codebase so that others can test this type of functionality
> out?
> 
> thanks,
> 
> greg k-h

The initial prototype of the changes were published as a part of the
tianocore/edk2-staging[1], and a more up-to-date open source version
was published as a part of the acidanthera/audk. This version is 
currently
being integrated with the EDK II build system, and its malfunctioning
is currently the main technical issue for integrating changes
into the main branch.

It is hard to estimate when the merge with the edk2 mainline happens,
but we are committed to doing this. The amount of changes needed
is quite large, and simply getting approval from all the maintainers
will take time even if they are all willing to get this in.
On the good side, several parties, Microsoft in particular,
were interested in upstreaming this code, so we have moderate
optimism for the future.

In case you are interested in the details, there is also academic
material available, describing the issues and the changes made,
which can help to shed some light on the implementation[3][4].

[1] 
https://github.com/tianocore/edk2-staging/tree/2021-gsoc-secure-loader
[2] https://github.com/acidanthera/audk/tree/secure_pe
[3] https://arxiv.org/pdf/2012.05471.pdf
[4] https://github.com/mhaeuser/ISPRASOpen-SecurePE

Thanks,
Evgeniy Baskov