linux-kernel - Re: [PATCH V4 0/2] Add support for arm64 to carry ima measurement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <11036cd6-2977-5f78-7fe7-1085ba31f005@linux.microsoft.com>
Date:   Mon, 21 Oct 2019 10:38:44 -0700
From:   prsriva <prsriva@...ux.microsoft.com>
To:     Pavel Tatashin <pasha.tatashin@...een.com>,
        James Morse <james.morse@....com>
Cc:     Mark Rutland <mark.rutland@....com>, jean-philippe@...aro.org,
        arnd@...db.de, Masahiro Yamada <yamada.masahiro@...ionext.com>,
        sboyd@...nel.org, Catalin Marinas <catalin.marinas@....com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        kexec mailing list <kexec@...ts.infradead.org>,
        LKML <linux-kernel@...r.kernel.org>, zohar@...ux.ibm.com,
        takahiro.akashi@...aro.org, duwe@....de, bauerman@...ux.ibm.com,
        allison@...utok.net, linux-integrity@...r.kernel.org,
        Thomas Gleixner <tglx@...utronix.de>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH V4 0/2] Add support for arm64 to carry ima measurement


On 10/15/19 11:47 AM, Pavel Tatashin wrote:
>> I think the UEFI persistent-memory-reservations thing is a better fit for this [0][1].
> 
> Hi James,
> 
> Thank you for your thought. As I understand you propose the to use the
> existing method as such:
> 1. Use the existing kexec ABI to pass reservation from kernel to
> kernel using EFI the same as is done for GICv3 tables.
> 2. Allow this memory to be reservable only during first Linux boot via
> EFI memory reserve
> 3. Allow to have this memory pre-reserved by firmware or to be
> embedded into device tree.
> 
> A question I have is how to tell that a reserved region is reserved
> for IMA use. With GICv3 it is done by reading the registers, finding
> the interrupt tables memory, and check that the memory ranges are
> indeed pre-reserved.
> 
> Is there a way to name memory with the current ABI that you think is acceptable?
> 
> Thank you,
> Pasha
> 
Friendly ping.

Thanks,
Prakhar Srivastava