Boot Guard 简介

As defined by Wikipedia: “Intel Boot Guard is a processor feature that prevents the computer from running firmware images not released by the system manufacturer. When turned on, the processors verifies a signature contained in the firmware image before executing it, using the hash of the public half of the signing key, which is fused into the system’s Platform Controller Hub (PCH) by the system manufacturer (not by Intel). Intel Boot Guard is an optional processor feature, meaning that it does not need to be activated during the system manufacturing. As a result, Intel Boot Guard, when activated, makes it impossible for end users to install replacement firmware such as Coreboot.” 来自： https://firmwaresecurity.com/2015/08/12/intel-boot-guard/

这是一个安全相关的功能，能够阻止第三方 Firmware运行在你的主板上。具体是做法是使用私钥对于客户自己的 Firmware 签名，然后在主板的生产过程中将公钥的 hash 写入 PCH，写入之后就无法修改（Fused） 。 之后每次上电的时候，PCH 会首先校验 Firmware 的签名，如果不符合就不会加载。

老狼在《什么是Boot Guard？电脑启动中的信任链条解析》文章中对此做了更详细的介绍，有兴趣的朋友可以在下面看到：

https://zhuanlan.zhihu.com/p/116740555?from_voters_page=true