From: Evgeniy Baskov <baskov@ispras.ru>
To: Dave Hansen <dave.hansen@intel.com>
Cc: Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
Ingo Molnar <mingo@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
x86@kernel.org, linux-kernel@vger.kernel.org,
Alexey Khoroshilov <khoroshilov@ispras.ru>,
linux-hardening@vger.kernel.org
Subject: Re: [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1
Date: Thu, 04 Aug 2022 13:41:58 +0300 [thread overview]
Message-ID: <09c1c94fb9c5006199d88caa88f237a3@ispras.ru> (raw)
In-Reply-To: <973736db-2480-bbaa-d2ce-6e1b6dd2ed0c@intel.com>
On 2022-08-03 17:05, Dave Hansen wrote:
>
> That shows me that it's _possible_ to build a more strict PE loader
> that
> wouldn't load Linux. But, in practice is anyone using a more strict PE
> loader? Does anyone actually want that in practice? Or, again, is
> this
> more strict PE loader just an academic demonstration?
>
> The README starts:
>
> This branch demonstrates...
>
> That doesn't seem like something that's _important_ to deal with.
> Sounds like a proof-of-concept.
>
> Don't get me wrong, I'm all for improving thing, even if the benefits
> are far off. But, let's not fool ourselves.
We have commercial closed-source UEFI firmware implementation at ISP RAS
that follows the behavior of the secure_pe branch. That firmware is used
as a part of [1].
[1] https://www.ispras.ru/en/technologies/asperitas/
Thanks,
Evgeniy Baskov
next prev parent reply other threads:[~2022-08-04 10:42 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-01 16:38 [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1 Evgeniy Baskov
2022-08-01 16:38 ` [PATCH 1/8] x86/boot: Align vmlinuz sections on page size Evgeniy Baskov
2022-08-01 16:38 ` [PATCH 2/8] x86/build: Remove RWX sections and align on 4KB Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 3/8] x86/boot: Set cr0 to known state in trampoline Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 4/8] x86/boot: Increase boot page table size Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 5/8] x86/boot: Support 4KB pages for identity mapping Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 6/8] x86/boot: Setup memory protection for bzImage code Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 7/8] x86/boot: Map memory explicitly Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 8/8] x86/boot: Remove mapping from page fault handler Evgeniy Baskov
2022-08-01 16:48 ` [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1 Dave Hansen
2022-08-02 0:25 ` Evgeniy Baskov
2022-08-02 2:41 ` Dave Hansen
2022-08-02 23:45 ` Evgeniy Baskov
2022-08-03 14:05 ` Dave Hansen
2022-08-04 10:41 ` Evgeniy Baskov [this message]
2022-08-04 11:22 ` Greg KH
2022-08-04 14:26 ` Evgeniy Baskov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=09c1c94fb9c5006199d88caa88f237a3@ispras.ru \
--to=baskov@ispras.ru \
--cc=bp@alien8.de \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=khoroshilov@ispras.ru \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.