With Intel Boot Guard (now almost pre-enabled on all laptops on the market), the CPU verifies the digital signature of BIOS code. The public key is burned into

With Intel Boot Guard (now almost pre-enabled on all laptops on the market), the CPU verifies the digital signature of BIOS code. The public key is burned into the chip [0] by the OEM before it leaves the factory. If signature verification fails, the CPU refuses to execute any code. Naturally, any code modification in the BIOS causes the check to fail and effectively bricking the BIOS. [0] Actually the PCH, aka southbridge, not the CPU. But it's not much of a difference for end users. See: * Intel Boot Guard, Coreboot and user freedom https://mjg59.dreamwidth.org/33981.html https://mjg59.dreamwidth.org/33981.html * Why You Don't See Coreboot Supported By Many Modern Intel Systems https://www.phoronix.com/news/Intel-Boot-Guard-Kills-Coreboot https://www.phoronix.com/news/Intel-Boot-Guard-Kills-Coreboo... * Bootguard (for a technical description) https://trmm.net/Bootguard/ https://trmm.net/Bootguard/