From: Dave Hansen <dave.hansen@intel.com>
To: Evgeniy Baskov <baskov@ispras.ru>, Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>,
Ingo Molnar <mingo@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
x86@kernel.org, linux-kernel@vger.kernel.org,
Alexey Khoroshilov <khoroshilov@ispras.ru>
Subject: Re: [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1
Date: Mon, 1 Aug 2022 09:48:58 -0700 [thread overview]
Message-ID: <e6e7fef1-0dff-ef72-8a17-8ecec89994ca@intel.com> (raw)
In-Reply-To: <cover.1659369873.git.baskov@ispras.ru>
On 8/1/22 09:38, Evgeniy Baskov wrote:
> This is the first half of changes aimed to increase security of early
> boot code of compressed kernel for x86_64 by enforcing memory protection
> on page table level.
Could you share a little more background here? Hardening is good, but
you _can_ have too much of a good thing.
Is this part of the boot cycle becoming a target for attackers in
trusted boot environments? Do emerging confidential computing
technologies like SEV and TDX cause increased reliance on compressed
kernel security?
In other words, why is *THIS* important versus all the other patches
floating around out there?
next prev parent reply other threads:[~2022-08-01 16:49 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-01 16:38 [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1 Evgeniy Baskov
2022-08-01 16:38 ` [PATCH 1/8] x86/boot: Align vmlinuz sections on page size Evgeniy Baskov
2022-08-01 16:38 ` [PATCH 2/8] x86/build: Remove RWX sections and align on 4KB Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 3/8] x86/boot: Set cr0 to known state in trampoline Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 4/8] x86/boot: Increase boot page table size Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 5/8] x86/boot: Support 4KB pages for identity mapping Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 6/8] x86/boot: Setup memory protection for bzImage code Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 7/8] x86/boot: Map memory explicitly Evgeniy Baskov
2022-08-01 16:39 ` [PATCH 8/8] x86/boot: Remove mapping from page fault handler Evgeniy Baskov
2022-08-01 16:48 ` Dave Hansen [this message]
2022-08-02 0:25 ` [RFC PATCH 0/8] x86_64: Harden compressed kernel, part 1 Evgeniy Baskov
2022-08-02 2:41 ` Dave Hansen
2022-08-02 23:45 ` Evgeniy Baskov
2022-08-03 14:05 ` Dave Hansen
2022-08-04 10:41 ` Evgeniy Baskov
2022-08-04 11:22 ` Greg KH
2022-08-04 14:26 ` Evgeniy Baskov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e6e7fef1-0dff-ef72-8a17-8ecec89994ca@intel.com \
--to=dave.hansen@intel.com \
--cc=baskov@ispras.ru \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=khoroshilov@ispras.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.