Comment by fulafel
4 hours ago
This doesn't require physical DRAM access, it's all software.
With ring-0 access, this lets you poke "even things walled off and invisible to ring-0 or the CPU itself" including things that the security processor tries hard to wall off.
Which arguably is a good thing. As a owner of the system I really should have complete control over it. But currently there is software I have no control over running at even higher privilege levels.
The only modern silicon that gives me full control over what code is running is some (or most?) microcontrollers.
And this isn't just a question of FOSS principle. Especially SMM is problematic by unpredictably taking CPU cycles away from your workload. This can mess up hard realtime workloads, such as found in CNC controllers. If you are running something like LinuxCNC this something you need to measure to figure out if a given computer is suitable for that job.
Whilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary processes can own your whole system, is anyone truly an owner?