One DRAM register bit gives away AMD's PSP, SMM, and microcode
Christopher Domas' skitter-creek-bath-salts flips translation bits in AMD Family 16h DRAM controllers, scrambling physical address maps so unprivileged code lands inside memory carveouts the kernel can't even enumerate. Upstream fences — hypervisor EPT, SMM TSEG bounds, PSP carveouts — validate only the untranslated address, so the swizzle below slips through. That unlocks PSP firmware, SMM RAM, and microcode buffers. No CVE, no patch: the registers simply can't be locked, and newer AMD generations just omit them from the datasheets.