The choice of BIST over scan/ATPG makes this attack theoretically possible on Ivy Bridge. If Intel had used scan/ATPG then this attack could not have worked even in theory. Unfortunately, I don't have the insight to understand why scan/ATPG could introduce a backdoor.
Disclaimer: I don't think that this attack is even theoretically feasible given just a few real world constraints. I am just nitpicking
Disclaimer: I don't think that this attack is even theoretically feasible given just a few real world constraints. I am just nitpicking