The latest kernel patches are a second revision to patches sent out last year around the Trenchboot launch support for enhancing the integrity and security of the boot process. This kernel work goes along with Trenchboot support happening for GRUB .
The kernel patches involve dealing with boot time measurements of everything to be run and everything that configures the kernel to run while storing those measurements within the trusted platform module (TPM). Trenchboot also relies upon Intel's TXT/GETSEC and AMD SKINIT instructions for establishing the initial hardware-based measurements.
The changes with this latest series of kernel patches vary quite a bit and include preventing kernel address space layout randomization (KASLR) from being used during a Secure Launch, forcing IOMMU not to use pass-through mode during the Secure Launch, security audit changes, and a wide range of other changes.
Those interested in Trenchboot can find the latest patches via the mailing list . Those wanting to learn more about this boot integrity/security effort can see the documentation at Trenchboot.org .