Comment by MayeulC
2 hours ago
AFAIK you can't usually replace CPU microcode, as it is signed. Seizing it here, in RW memory, really begs to toy with it: add instructions, edit them. Could you teach your CPU to understand RISC-V?
This is just one random idea. But altering PSP code is also interesting, to use it for your own purposes, or extract encryption keys / make it lie to clients (breaking DRM, for instance).
>Could you teach your CPU to understand RISC-V?
The bulk of microcode is still ROM inside the CPU. Also it's mostly used for the more complex instructions, the basic load/store/add/etc. would be decoded and executed more directly.
CPUs have a limited amount of SRAM for holding patches, basically a list of addresses in the microcode ROM, and what their contents should be replaced with. Not enough to totally change the instruction set, but still exciting to potentially get write access to, as indeed the normal update mechanism requires those patches to be cryptographically signed by Intel/AMD.