lkml.org 
[lkml]   [2013]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: Early microcode signing in secure boot environment - Was: x86, microcode: Use common get_ramdisk_image()
Date
> -----Original Message-----
> From: Thomas Renninger [mailto:trenn@suse.de]
> Sent: Wednesday, April 10, 2013 12:41 AM
> Hello,
>
> On Wednesday, April 10, 2013 01:34:33 PM Tang Chen wrote:
> > On 04/05/2013 07:46 AM, Yinghai Lu wrote:
> > > Use common get_ramdisk_image() to get ramdisk start phys address.
> > >
> > > We need this to get correct ramdisk adress for 64bit bzImage that
> > > initrd can be loaded above 4G by kexec-tools.disk_size;
>
> don't know whether this question came up when this feature got
> submitted (if yes a pointer would be appreciated).
>
> Is there a concept how signed microcode can get verified when applied
> early,
> like it is done via firmware loader?
>
> If not, early microcode loading is not really usable in secure boot
> environment, right?

The microcode is cryptographically authenticated by the CPU itself, so there is no security issue related to early microcode loading.

Thanks.

-Fenghua



\
 
 \ /
  Last update: 2013-04-10 23:01    [W:0.065 / U:0.652 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site