Your TEE Is Only as Strong as Its Interconnect: Breaking SEV-SNP using AMD's Infinity Fabric

Your TEE Is Only as Strong as Its Interconnect: Breaking SEV-SNP using AMD's Infinity Fabric

Speakers: Chris (Security Researcher, Independent); Benedict Schlueter (PhD Researcher, ETH Zürich)

Conference: OffensiveCon

YouTube: https://www.youtube.com/watch?v=60_tbA4K0I8

Overview

In this highly technical talk from OffensiveCon, Chris and Benedict Schlueter unveiled two novel attacks, "Fabric" and "Breakfast," that fundamentally undermine the security guarantees of AMD's Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP). Their research demonstrates how vulnerabilities within the AMD Infinity Fabric, the critical interconnect component of Zen-based System-on-Chips (SoCs), can be exploited to bypass SEV-SNP's memory encryption and integrity protections. The presentation meticulously details how an untrusted hypervisor can manipulate low-level platform routing to gain unauthorized access to confidential guest data and even pave the way for arbitrary code execution on the Platform Security Processor (PSP), the root of trust for AMD platforms.

The talk highlights a crucial but often overlooked attack surface in modern confidential computing environments: the intricate hardware interconnects that facilitate communication between CPU cores, memory, and various on-chip components. By exposing how the Platform Security Processor (PSP), despite its privileged status, can be tricked into becoming a "confused deputy" due to rerouted memory accesses, Chris and Benedict challenge the robustness of AMD's SEV-SNP threat model. Their findings are not merely academic; they present concrete methods for corrupting guest state, enabling debug APIs, and potentially achieving full control over the platform's most secure components, impacting AMD Zen 4 and Zen 5 architectures.

This research is significant for anyone involved in confidential computing, cloud security, or hardware security. It underscores the immense complexity of securing an entire SoC and emphasizes that the security of a Trusted Execution Environment (TEE) is intrinsically linked to the integrity of its underlying hardware fabric. The attacks demonstrate that even the most privileged components can be compromised if the communication channels they rely upon are not rigorously protected, opening avenues for persistent rootkits, hardware debugging, or even bricking the CPU.

Background

▶ Watch: Introduction to talk: Breaking SEV-SNP using Infinity Fabric (0:00)

To understand the intricacies of the "Fabric" and "Breakfast" attacks, it's essential to first grasp the underlying architecture and security model of AMD's Zen-based platforms and their Trusted Execution Environment (TEE), SEV-SNP. The traditional x86 privilege model features user space (Ring 3) and kernel space (Ring 0), with even more privileged negative rings for System Management Mode (SMM). However, below these, AMD platforms incorporate several higher-privileged components: microcode, the IO Die (IOD), and at the deepest level, the Platform Security Processor (PSP), which serves as the root of trust for the entire platform. The PSP is critical for platform initialization and the operation of confidential computing features like SEV-SNP.

AMD's modern Zen CPUs (Zen 2, Zen 3, Zen 4, Zen 5) utilize a multi-die architecture where CPU cores reside on separate dies, interconnected by a central IO Die. This IO Die hosts the Infinity Fabric, a sophisticated interconnect responsible for routing all communication between CPU cores, DRAM, and peripheral devices. The Infinity Fabric is highly reconfigurable, with its routing tables typically configured by the CPU BIOS during platform initialization.

Confidential computing aims to protect data in use by isolating workloads within hardware-backed TEEs, even from a privileged hypervisor. AMD SEV-SNP achieves this primarily through two mechanisms:

1. Memory Encryption: Guest data is transparently encrypted when written to DRAM and decrypted when read by the guest. This is managed by trusted microcode, which tags memory pages for specific guests using an unused bit in the physical address.
2. Integrity Protection: Prevents an untrusted hypervisor from tampering with guest memory. This relies on a Reverse Map Table (RMP), a large in-memory array with an entry for every physical page. The RMP stores information about which guest and in what state is allowed to access a page, with trusted microcode enforcing these rules during page translation.

The threat model for AMD SEV-SNP is stringent: only AMD-supplied hardware (CPU, PSP) and firmware (PSP firmware, microcode) are considered trusted. Crucially, the CPU BIOS and the hypervisor are explicitly designated as untrusted. The attacks presented here aim to exploit this discrepancy, demonstrating how an untrusted BIOS or hypervisor can subvert the trusted hardware through manipulation of the Infinity Fabric.

Key Findings

▶ Watch: AMD privilege model: PSP as the root of trust (3:40)

The research uncovered two distinct, yet related, vulnerabilities: "Fabric" and "Breakfast," both categorized as interconnect corruption attacks. These attacks fundamentally challenge the integrity of AMD's SEV-SNP by demonstrating that the Infinity Fabric, the core communication backbone, can be maliciously reconfigured, turning the Platform Security Processor (PSP)—the platform's root of trust—into a confused deputy.

The primary finding of the Fabric attack is that the CPU BIOS, an untrusted component in the SEV-SNP threat model, is responsible for configuring the critical routing tables of the Infinity Fabric. By patching the BIOS to prevent the PSP from locking these registers, the researchers could dynamically reconfigure MMIO routing rules from the operating system. This allowed them to "blackhole" critical writes from the PSP to DRAM, specifically targeting the Reverse Map Table (RMP) initialization and the Guest Context Page. By corrupting these structures, the attackers could effectively disable SEV-SNP's integrity protections and re-enable the debug API, granting arbitrary read/write access to confidential guest memory. This demonstrated that the PSP's memory accesses, contrary to expectations, are subject to the same routing rules configured by untrusted software.

The Breakfast attack delves deeper into the System Management Network (SMN), AMD's undocumented control plane, and other on-SOC components. The key finding here is the ability to relocate these on-SOC components in the memory map. By leveraging the PSP as a confused deputy through its page move API, attackers could redirect PSP reads and writes intended for DRAM to these relocated on-SOC components. This allowed for privilege escalation to gain effective "security level zero" access to the SMN, the highest privilege level on the platform. While achieving full PSP code execution proved challenging due to the SMN's undocumented nature and crash-prone behavior, AMD confirmed the theoretical possibility. This attack highlights a severe design flaw where privileged PSP operations can be hijacked by manipulating the underlying interconnect, even when the PSP itself is functioning correctly.

Both attacks underscore that the security of a TEE is not solely dependent on the CPU core and PSP, but critically relies on the integrity of the entire SoC's interconnect and its configuration process. The research exposes a new class of "interconnect corruption attacks" that exploit the complex interactions between different hardware components and their shared communication fabric, proving that a TEE is indeed only as strong as its interconnect. These vulnerabilities affect AMD Zen 4 and Zen 5 CPUs, with mitigations released by AMD in firmware API version 1.58.03 and higher.

Technical Deep Dive

▶ Watch: Motivation for research and overview of two attacks (4:40)

The technical foundation of these attacks lies in understanding and manipulating the AMD Infinity Fabric, specifically its data and control planes. The Infinity Fabric connects various blocks: Core Coherent Masters (x86 cores), Unified Memory Controllers (UMCs) which interface with Coherent Slaves (CS blocks) for DRAM, and IO Master Slave Blocks (IOMS) for other devices like PCI. The fabric uses sophisticated routing tables for both DRAM and MMIO accesses. Critically, these routing tables are configured by the CPU BIOS, an untrusted entity in the SEV-SNP threat model.

Fabric Attack: Manipulating Data Fabric Routing

The "Fabric" attack exploited the BIOS's role in configuring the data fabric. The researchers discovered MMIO base address and control registers in AMD's OpenSIL (an open-source library for CPU initialization) that govern Infinity Fabric routing. Initially, attempts to modify these registers from the operating system failed because they were locked. Through reverse engineering the UEFI firmware, they identified a function responsible for reading/writing to the data fabric and, crucially, found that the BIOS calls two PSP commands: exit boot service and lock data fabric register. By patching out both these calls in the BIOS, the PSP was never explicitly told that the BIOS was done, leaving the data fabric configuration registers unlocked and writable from the operating system.

With the data fabric unlocked, the researchers performed experiments:

1. MMIO Routing Tests: They reconfigured an MMIO routing rule to redirect requests to a non-existent IOMS block. An x86 core MMIO write to that address then returned 0xFF FF, confirming that the routing rules were indeed applied dynamically.
2. Core vs. PCI Device Routing: They attempted to shadow a DRAM range with an MMIO routing rule for x86 cores, but DRAM accesses still went through. This indicated that x86 cores could explicitly distinguish between DRAM and MMIO requests. However, when the same experiment was done for PCI devices, it worked. PCI devices, it appeared, do not explicitly distinguish between DRAM and MMIO requests at the data fabric level, making them susceptible to routing rule manipulation.
3. PSP as a PCI Device: The Platform Security Processor (PSP), exposed as the "Turin CCP / ASP" in lspci, also interacts with the Infinity Fabric through MMIO. Its MMIO range was found to route to destination fabric ID 22 hex. This was the critical insight: if the PSP's accesses were treated similarly to PCI devices, they could be redirected.

The core of the Fabric attack then involved using the PSP's page move API. This API allows a hypervisor to request the PSP to move a guest page from one physical DRAM location to another. The PSP reads from the source and writes to the destination. By introducing a malicious MMIO routing rule that shadowed the destination physical address of a PSP page move request, the researchers successfully blackholed the PSP's write. The PSP completed the operation without error, but the target DRAM page never changed.

This blackholing primitive was then escalated:

• RMP Corruption: During SEV-SNP initialization, the PSP writes the self-protecting entries of the Reverse Map Table (RMP) to DRAM. By blackholing these writes, the RMP's integrity protection could be disabled.
• Guest Context Page Corruption: The Guest Context Page stores critical SEV-SNP metadata, including policy bits like the debug API enable flag. Although the page is encrypted, by repeatedly blackholing PSP writes to this page (effectively writing random ciphertext due to AES's pseudo-random function properties), the debug bit could eventually be toggled high. Once enabled, the debug API allowed arbitrary read/write access to the CVM's memory, completely compromising confidentiality and integrity. This also allowed for forging launch measurements.

Breakfast Attack: Confused Deputy on the Control Fabric

The "Breakfast" attack focused on AMD's undocumented System Management Network (SMN) and other on-SOC components. Through further analysis of OpenSIL, the researchers identified several previously unknown on-SOC components (e.g., Fast Play Control, Fast Track Control Debug) with associated SMN register locations and sizes. These components are connected to the IO Hub Core (IOHC), which acts as a crossbar gateway to the data fabric.

The key to Breakfast was the ability to relocate these on-SOC components by writing new base addresses into their configuration registers. Inspired by Christopher Domas's 2015 "sinkhole attack" on SMM, the goal was to overlap a relocated on-SOC component with a critical DRAM region. Initial attempts to relocate to a DRAM address failed for x86 cores (due to explicit DRAM/MMIO distinction). Relocating to an MMIO address also initially failed because the chosen address mapped to the wrong IO Hub. Once an MMIO address within the correct IO Hub's range was chosen, the relocation succeeded, and the x86 core could access the relocated component.

The critical step was again using the PSP as a confused deputy. The PSP's page move API reads from a source and writes to a destination. By relocating an on-SOC component (like the Fast Play Control register) to overlap with the source page of a PSP page move, the PSP was tricked into reading from the on-SOC component instead of DRAM. This caused page states to go out of sync, directly breaking SEV-SNP.

Further investigation revealed that the PSP possessed higher write privileges to these MMIO addresses compared to x86 cores. This led to the discovery of the System Management Network (SMN), AMD's true control plane, which governs everything from CPU bring-up to memory encryption keys. The SMN is a 4GB address space, accessible via index and data registers in PCI root ports. The PSP has the highest privilege (security level 0) on the SMN.

The "Breakfast" attack then leveraged two specific SMN-related registers:

1. Fast Wake Register: Maps a 1MB slice of the SMN address space into the data plane.
2. Fast Write Control Register: Contains a window selector that allows mapping different 1MB slices of the SMN.

By using the PSP as a confused deputy to write to the Fast Write Control register's window selector, the attackers could force it to map arbitrary 1MB slices of the SMN into the data plane. This effectively granted "security level zero" access to the entire SMN, allowing an untrusted entity to modify any SMN configuration. While this theoretically provided "god mode" on the platform, practical exploitation for PSP code execution was hindered by the SMN's undocumented nature and the 4KB page-granularity of the confused deputy primitive, leading to platform crashes when writing unknown values.

Demo / Proof of Concept

▶ Watch: AMD SEV memory protection: encryption and RMP (6:40)

The talk outlined a series of experiments and demonstrations that served as proof-of-concept for both the Fabric and Breakfast attacks, systematically validating each step of the exploit chain. While no live demo was shown during the presentation, the methodology described constitutes a robust verification of the vulnerabilities.

For the Fabric attack, the initial demonstrations focused on gaining control over the Infinity Fabric's routing configuration:

1. BIOS Patching: The researchers first demonstrated their ability to modify the UEFI BIOS by injecting code. A key step was patching out the PSP commands (exit boot service and lock data fabric register) that normally lock the data fabric configuration registers. This allowed the platform to boot into the operating system with the Infinity Fabric routing rules still writable from Ring 0.
2. Dynamic MMIO Rerouting: From the operating system, they reconfigured an MMIO routing rule to redirect accesses to a non-existent IOMS block. Subsequent MMIO reads to the target address returned 0xFF FF, clearly indicating that the new routing rule was active and being applied by the data fabric.
3. PCI Device Blackholing: They demonstrated a crucial distinction: while x86 core DRAM accesses were not affected by MMIO routing rules, PCI device accesses to DRAM could be rerouted. By shadowing a DRAM range with an MMIO routing rule and observing the effect on PCI-initiated memory operations, they confirmed that PCI devices (and by extension, the PSP) were susceptible to this type of manipulation.
4. PSP Write Blackholing: The core of the Fabric attack was proven by using the PSP's page move API. When the PSP was instructed to move a page, and the destination address was overlaid with a malicious MMIO routing rule, the physical memory at the destination did not change, even though the PSP reported the operation as successful. This confirmed the ability to "blackhole" PSP writes.
5. RMP and Guest Context Page Corruption: Building on the blackholing primitive, they demonstrated the ability to prevent the PSP from correctly initializing the Reverse Map Table (RMP) and to corrupt the encrypted Guest Context Page. By repeatedly blackholing writes to the Guest Context Page, they could eventually toggle the debug policy bit, which was verifiable by successfully invoking the debug API for arbitrary read/write access to the CVM's memory. This was the ultimate proof of compromise for SEV-SNP.

For the Breakfast attack, the proofs of concept focused on relocating on-SOC components and leveraging the PSP as a confused deputy:

1. On-SOC Component Access and Relocation: They successfully read the base addresses of various undocumented on-SOC components (e.g., Fast Play Control) from the System Management Network (SMN). They then demonstrated writing a new base address to relocate one of these components.
2. Relocated Component Access: After relocation, they confirmed that the x86 core could access the component at its new MMIO address, provided the address mapped to the correct IO Hub.
3. PSP Confused Deputy with Relocated Component: The key demonstration for Breakfast involved using the PSP's page move API. By relocating an on-SOC component to overlap with the source page of a PSP page move, they showed that the PSP would read from the relocated component instead of DRAM, leading to an immediate breakdown of SEV-SNP's page state consistency.
4. PSP Privilege Difference: They conducted a careful analysis comparing which bits in an on-SOC component's register could be flipped by an x86 core versus the PSP, clearly showing that the PSP had higher write privileges.
5. SMN Access via Confused Deputy: While full PSP code execution via SMN manipulation was not fully demonstrated due to the SMN's undocumented nature and platform stability issues (crashes), they confirmed the ability to use the PSP as a confused deputy to manipulate the Fast Write Control register's window selector, theoretically granting level-zero access to arbitrary 1MB slices of the SMN address space. AMD later confirmed the possibility of PSP code execution through this vulnerability.

These proofs of concept systematically validated the feasibility of both attack methodologies, from low-level fabric manipulation to high-impact guest compromise.

Defensive Implications

▶ Watch: Beginning the first attack: 'Fabric' (malicious rerouting) (8:00)

The "Fabric" and "Breakfast" attacks expose fundamental weaknesses in the design and implementation of AMD's SEV-SNP, particularly concerning the interaction between privileged components like the PSP and the underlying hardware interconnect. The root cause for both vulnerabilities stems from the PSP's implicit reliance on the Infinity Fabric's routing configuration, which can be manipulated by untrusted entities.

For the Fabric attack, the primary root cause is that the PSP does not explicitly manage its own DRAM accesses in a way that bypasses the configurable MMIO routing rules. Despite indications in the PSP source code that it should directly access DRAM and bypass the IOMMU, this was either not fully implemented or incorrectly configured. Furthermore, the CPU BIOS, an untrusted component, is responsible for configuring the data fabric's MMIO routing rules. SEV-SNP would successfully initialize even with an unlocked data fabric, allowing a malicious hypervisor to dynamically reconfigure it after boot.

Defensive measures for the Fabric attack include:

• PSP-Managed Routing: The ideal, albeit complex, solution would be to move the responsibility for configuring critical data fabric routing rules into the PSP's trusted code. This would ensure that only trusted firmware dictates how memory accesses are routed. However, this could significantly increase the Trusted Computing Base (TCB) of the PSP, which is generally undesirable.
• Pre-Initialization Locking and Verification: A more immediate mitigation involves ensuring that the data fabric's configuration registers are locked by the PSP before SEV-SNP initialization completes. Additionally, the PSP should verify that the routing configuration is correct and untampered before trusting the system. AMD has released firmware patches (API version 1.58.03 and higher) for Zen 5, which are designed to mitigate this by ensuring the data fabric is appropriately locked.

For the Breakfast attack, the core problem is that the PSP, when performing operations like page moves, can be tricked into reading from a relocated on-SOC component instead of the intended DRAM address. This allows an attacker to leverage the PSP as a confused deputy to access and manipulate the highly privileged System Management Network (SMN).

Defensive measures for the Breakfast attack focus on preventing the relocation of critical on-SOC components:

• Locking Relocation Registers: AMD's primary mitigation for Breakfast is to lock the registers that control the relocation of these on-SOC components. This prevents an untrusted entity from moving these components into memory regions that can be used to trick the PSP. These patches affect AMD Zen 4 and Zen 5 platforms.

In a broader context, these attacks highlight several critical takeaways for TEE security:

• Holistic Security: TEE security must extend beyond the CPU core and PSP to encompass the entire SoC, including all interconnects, memory controllers, and peripheral interfaces. Assumptions about hardware behavior or isolation must be rigorously validated.
• Untrusted Configuration: Any critical hardware configuration performed by untrusted software (like the BIOS) presents a significant attack surface. Trusted components must independently verify or enforce their own configuration integrity.
• PSP as a Target: Even the platform's root of trust (PSP) can be exploited if its interactions with other hardware components are not perfectly secure. The "confused deputy" pattern is a powerful exploit primitive against privileged entities.
• Undocumented Hardware: The existence of undocumented, privileged hardware components like the SMN, which can be manipulated via confused deputy attacks, poses a severe risk. Greater transparency or stronger hardware-level isolation for such components is crucial.

The "interconnect corruption attacks" class underscores that the complexity of modern SoCs introduces new vulnerabilities that require a shift in defensive strategies to consider the entire hardware fabric as a potential attack vector.

Key Takeaways

• Interconnects are a Critical Attack Surface: AMD's Infinity Fabric, the central interconnect of Zen-based SoCs, is not just a data highway but a complex, configurable system that can be exploited to undermine TEE security.
• Untrusted BIOS Configures Critical Hardware: The CPU BIOS, explicitly untrusted in the SEV-SNP threat model, configures fundamental aspects of the Infinity Fabric's routing, creating a significant vulnerability.
• PSP as a Confused Deputy: The Platform Security Processor (PSP), AMD's root of trust, can be tricked into performing malicious actions (e.g., blackholing writes, reading from relocated components) if its memory accesses are rerouted.
• SEV-SNP Protections Bypassable: Both Fabric and Breakfast attacks demonstrate how SEV-SNP's memory encryption and integrity protections (RMP, Guest Context Page) can be completely bypassed by manipulating the interconnect.
• Privilege Escalation to SMN: The Breakfast attack shows how to gain effective "security level zero" access to the System Management Network (SMN), AMD's undocumented control plane, by leveraging the PSP as a confused deputy.
• Holistic TEE Security is Paramount: These "interconnect corruption attacks" highlight the need for a comprehensive security model that extends beyond the CPU core and trusted firmware to encompass the entire SoC architecture, including all communication fabrics and their configuration mechanisms.

About the Speaker(s)

Benedict Schlueter is a 4th-year PhD student at ETH Zürich. His research has focused extensively on confidential computing, particularly AMD's Secure Encrypted Virtualization (SEV-SNP). He has dedicated the past two years to both building secure systems with SEV-SNP and, more notably, investigating methods to break its security guarantees, as demonstrated in this talk.

Chris is a 1st-year PhD student, also at ETH Zürich, and an independent security researcher. His involvement in this project highlights his expertise in dissecting complex hardware and software interactions to uncover critical security vulnerabilities.

The research also involved Philip, who was unable to attend the conference.