RetroLizard wrote on 2025-12-27, 21:58:
Would an ISA bridge device indicate anything on modern X570 boards? I used "lspci" on Linux and ISA Bridge was among the listed devices.
AFAIK that ISA bridge (00:14.3) device existed since ATI 600-series (later became AMD since 700-series). Bolton FCH is the last to be independent (on the chipset) and with 2 LDRQ# signals.
Since Ryzen, that part is now integrated into CPU, but only 1 LDRQ# is exposed. Some ASUS boards seem to use a stripped-down SuperIO that doesn't use the LDRQ# so that signal can be used. For other boards, one would have to look for means to somehow isolate that signal from SuperIO, which can be very tricky.
The core issue, however, is that the CPU/chipset seems to claim most of the I/O ranges including 4E/4F so changes to registers according to the RPR/PPR of the chipset/CPU have very little effect and not too useful for sound cards. AMD 700 series southbridge's Register Reference document once had some mentions about how to make certain I/O ranges (including those from sound cards) to trigger SMI, but that particular document has since been pulled from the AMD website for some reasons. I do have a copy of it, however.
On the other hand, I did think about the possibility to leverage SinkClose vulnerability to install SBEMU/VSBHDA into Ring -2 (in which the functionality might be less restricted), but sadly I've since patched the BIOS of my X570 board past that point so that's not going to be too helpful for me for now... Don't know if that vulnerability can be utilized purely from FreeDOS, though.