Security Flaw Afflicts Intel x86 Boot ROMs

If someone has physical access to your machine, injecting a corrupted boot rom in sleep mode is just about the least of your worries...

Interesting. But it requires tampering with the hardware while the computer is sleeping. Given that, it’s not that exciting.

>"Systems that use Intel’s platform controller hub (PCH) chip have one-time programmable fuses specifically intended to enable/disable speedy resume-from-sleep restarts. Leaving the fuses intact forces the processor to do a complete reboot, including all security checks, when it resumes from S3 sleep mode. Blowing the fuses enables the quicker restart but bypasses the security checks. Guess which mode nearly every hardware OEM uses?"

Note To Future Self: Create an FPGA open source, open hardware equivalent to what a PCH does -- or find one...

The generic term for Intel's PCH in motherboard parlance is "Southbridge":

https://en.wikipedia.org/wiki/Southbridge_(computing)

>"On Intel platforms, all southbridge features and remaining I/O functions are managed by the PCH which is directly connected to the CPU via the

Direct Media Interface (DMI).[3]"

OK, so let's learn about DMI:

https://en.wikipedia.org/wiki/Direct_Media_Interface

>"In computing, Direct Media Interface (DMI) is Intel's proprietary link between the northbridge and southbridge on a computer motherboard. It was first used between the 9xx chipsets and the ICH6, released in 2004. Previous Intel chipsets had used the Hub Interface to perform the same function, and server chipsets use a similar interface called Enterprise Southbridge Interface (ESI).[1] While the "DMI" name dates back to ICH6, Intel mandates specific combinations of compatible devices, so the presence of a DMI interface does not guarantee by itself that a particular northbridge–southbridge combination is allowed.

DMI shares many characteristics with PCI Express,

using multiple lanes and differential signaling to form a point-to-point link."

PDS: That's because DMI is PCI-Express(!) -- or at least something very close to it, electrically!

Oh sure, it might have a patentable proprietary high-level protocol that goes on top of it, but you see, if you control the CPU (like if you had an FPGA "soft CPU") and if you control the inter-FPGA signalling method, then, if you're a Software Engineer, writing your own open-source protocol/driver -- is trivial at best.

Basically, all this thing is doing is acting like an Ethernet switch is, that is, it's taking packets from the CPU and routing them to the inputs of various devices, then getting the outputs of those devices, and routing those back to the CPU.

So let's say you had two FPGA's.

One acts as the CPU, the other acts as the Southbridge (aka, "Intel PCH" -- in Intel parlance)

Is this setup compatible with the pinouts from an Intel CPU, is it compatible with DMI?

NO IT ISN'T !!!

But functionally, functionally...

Functionally, THE SAME RESULT CAN BE OBTAINED (Patent-Free, Royalty-Free, Open Source, Open Hardware, etc.)...

And that result is that the CPU is able to have a two-way conversation with the perhipheral chips on the motherboard!

Functionally, it's the same!!!

Oh sure, your FPGA's might be slower, way slower than Intel's data pin connections/LVDS/DMI, etc.

But that doesn't matter (first make it work, then make it fast!) -- the functionality is exactly the same!

Related Article (although this one asks if you could attach an FPGA to an Intel CPU via DMI -- which is not the way to go, in my opinion, because it will be orders of magnitude more work, and it may encroach on software and hardware patents (if the DMI protocol is emulated exactly)):

https://electronics.stackexchange.com/questions/224560/could...

But, it's an interesting read, nonetheless...

Also related: LVDS (Low Voltage Differential Signaling):

https://en.wikipedia.org/wiki/Low-voltage_differential_signa...