the tl;dr on that exploit (which is novel research) is that AMD fucked up and made the memory controller configuration registers unprivileged (at the platform level, which exists in rings below 0), so you can just reprogram them from ring 0.
this is, needless to say, a phenomenal fuckup on AMD's side, but does not need 10,000 words of AI slop to explain.
Replying to @ariadne@social.treehouse.systems
"unprivileged? ring 0?"
yes. from the *platform* perspective, ring 0 is still user-controlled code, and thus must be considered by the platform to be unprivileged code, even if it has more privilege than rings greater than 0 (e.g. ring 3 userspace).
the *platform* must consider the ring0 kernel to be adversarial.
Replying to @ariadne@social.treehouse.systems
@ariadne Why is AMD so bad at memory controllers?..
@drq @ariadne prior to 17h (Zen) cache as RAM was used and the CPU had far more control in the boot process. The PSP on the early generations with it was optional and the platform could be booted without it.
Starting from Zen, cache as RAM was deprecated with the PSP getting far more control in the boot process, including having DRAM initialisation running there.
@ariadne oh thank you, i got fairly close to that but it was just so fucking boring to read i never quite got there.
@dysfun i didn't read any of it, i just went and looked at the code instead. the kernel driver made it pretty obvious what was going on.
