Messages in this thread | | | From | "Yu, Fenghua" <> | Subject | RE: Early microcode signing in secure boot environment - Was: x86, microcode: Use common get_ramdisk_image() | Date | Wed, 10 Apr 2013 17:47:25 +0000 |
| |
> -----Original Message----- > From: Thomas Renninger [mailto:trenn@suse.de] > Sent: Wednesday, April 10, 2013 12:41 AM > Hello, > > On Wednesday, April 10, 2013 01:34:33 PM Tang Chen wrote: > > On 04/05/2013 07:46 AM, Yinghai Lu wrote: > > > Use common get_ramdisk_image() to get ramdisk start phys address. > > > > > > We need this to get correct ramdisk adress for 64bit bzImage that > > > initrd can be loaded above 4G by kexec-tools.disk_size; > > don't know whether this question came up when this feature got > submitted (if yes a pointer would be appreciated). > > Is there a concept how signed microcode can get verified when applied > early, > like it is done via firmware loader? > > If not, early microcode loading is not really usable in secure boot > environment, right?
The microcode is cryptographically authenticated by the CPU itself, so there is no security issue related to early microcode loading.
Thanks.
-Fenghua
| |