AMD SEV-ES firmware - TMR placement in MMIO space: MULTI-TENANT ISOLATION: SEV-ES firmware does not verify

Impact

MULTI-TENANT ISOLATION: SEV-ES firmware does not verify that the Trusted Memory Region is outside MMIO space. Point the TMR at MMIO and the secure firmware's private working memory is suddenly backed by device registers the host controls - a route to observing or influencing what the SEV firmware does, costing integrity or availability of confidential guests.

Who can reach it

Hypervisor-privileged attacker who controls where the TMR is placed.

What to do

Fixed in AMD reference firmware (AGESA / PSP / SEV firmware) and delivered only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo and the ODMs each rebuild and requalify AMD's AGESA drop before shipping. **Expect one to six months of OEM lag**, and on end-of-support platforms expect nothing. Applying it is a drain plus full power cycle, not a driver reload. Verify by reading back the PSP/SMU firmware version afterwards rather than trusting the BIOS version string. This sits inside the SEV-SNP trust boundary, so the update moves the platform's reported TCB version: refresh VCEK certificates from AMD's KDS and update any attestation policy your tenants pin, or confidential guest launches will start failing right after the BIOS lands.

References