Spaghettifying DRAM: How One Bit in the Memory Controller Unlocks the PSP, SMM, C6 and Microcode

Every hardware security boundary on a modern x86 platform — SMRAM, the AMD PSP's private DRAM, the C6 save area, the live microcode patch — is enforced somewhere above the memory controller. Christopher Domas' skitter-creek-bath-salts flips a single bit in the AMD Family 16h DCT, rewires the physical-address-to-DRAM-coordinate transform underneath all of it, and recovers the resulting scramble…