TECH Signal 513
Unlocked DRAM controller registers on AMD Family 16h bypass PSP, SMM, and microcode protections
A technique called skitter-creek-bath-salts exploits DRAM controller address translation registers that cannot be locked on AMD Family 16h CPUs, redirecting physical memory accesses to unlock normally protected regions including the Platform Security Processor, System Management Mode, C6 DRAM, and CPU microcode.
The entire trust architecture of a CPU, from secure boot to PSP to SMM, assumes that physical address translation from the DRAM controller side is trustworthy and that carveouts are truly inaccessible. If an attacker can remap physical addresses at the DRAM controller level, those hardware-enforced boundaries dissolve regardless of OS-level protections or IOMMU configuration.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
AMD Family 16h datasheets document the DRAM controller translation registers and reveal they cannot be locked, allowing any physical address to be remapped to an arbitrary DRAM location.
The technique unlocks the Platform Security Processor, System Management Mode, C6 DRAM, and CPU microcode by rewriting the physical-to-DRAM address translations that gate access to those carveouts.
AMD Family 17h and later remove this documentation entirely, but the underlying address translation transforms are structurally similar across x86, ARM, and RISC-V architectures.
THE CLUSTER