Zecoxao reports some progress in hacking the SMU (AMD System Management Unit) of PS4s, achieved by reusing a crypto key that was until now believed to only work on debug firmwares. Turns out the key can be used to hash retail firmwares as well. The scene’s “jack of all trades” believes this could be leveraged to dump per-console crypto keys and fuses on PS4.

What is the SMU on PS4 and PS5?

There is surprisingly little information on the SMU in the PS4 Dev wiki, except for the HMAC Key in question. The PS4 Dev wiki states:

AMD System Management Unit (SMU) is a thermal and electric management unit found in modern AMD x86 processors.

In a presentation where he demonstrated a hack of the AMD SMU, infosec researcher Rudolf Marek defined it as follows:

The system management unit (SMU) is a subcomponent of the northbridge that is responsible for a variety of system and power management tasks during boot and runtime. The SMU contains a microcontroller to assist.

The PS5 Dev wiki has more details on what the SMU does on the PS5, and I believe the responsibility of the chip is similar in both consoles (although, according to Zecoxao, there are some big differences in privileges, which could be very significant. See below)

MP1 (System Management Unit or “SMU”) is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

Another description, based on the AMD Zen architecture, states:

The system management unit (SMU) is tasked with the job of continuously sampling sensory data and making rapid corrections to various circuits on the chip. One such example is the control of the boost circuit we detailed earlier. Additional tasks include voltage level control which is supplied as targets to the power supply monitors (PSMs), C-state boosts, thermal management ensuring the chip does not exceed the spec temperatures, and electrical design current management which ensures the current draw does not exceed the specs of the external voltage rails.

It is safe to assume the SMU on PS4 basically performs similar tasks as described in the “generic” AMD definitions above. In particular, the PS4 SMU shouldn’t be confused with SAMU (Secure Asset/Access Management Unit), a separate processor that handles lots of the encryption/decryption tasks on the PS4.

Could SMU be leveraged to hack the PS4?

Today Zecoxao mentioned that progress has been made on SMU hacks, in particular it has been found that the crypto key used for debug firmwares can be used on retail firmwares. My assumption here is that some hackers have pretty much full control on the SMU processor.

Turns out the “debug key” that is used to hash “debug” firmwares from SMU effectively works on ALL retail versions of the PS4 smu firmware as well (the one on the wiki). Which means things are about to become VERY interesting…

— Jose Coixao (@notnotzecoxao) May 17, 2023

Now, the question that instantly comes to mind is how a processor in charge of power and fans can really do much damage to the rest of the console. But Zecoxao’s reply to my question has been: SMU is very privileged in PS4, not so privileged in PS5. The Scene veteran also said “now it’s confirmed that the SMU key is potentially useful to run nasty code“.

Looking at Rudolf Marek’s slideshow again, I think some PS4-Specific confusion could emanate from his presentation. In particular, the following slide has led people to believe that SMU control could directly lead to PS4 Custom Firmware. I do not believe this interpretation makes sense. As a matter of fact, the whole presentation talks about the SMU Firmware, not the Firmware of any other processor on the computer. What the presentation is about, as far as I understand, is the possibility to load a custom SMU Firmware, and then use that to communicate with the rest of the system in order to extract/leak information.

Therefore I believe the interesting part (for the PS4 scene) comes next when Zecoxao says “SMU is very privileged in PS4”. There’s also, in Marek’s presentation, a Q&A section in which it is confirmed (around the 45 minutes mark) that the SMU, having privileged access, could be used to read/leak other parts of the system’s memory. Something that was in part confirmed by Zecoxao:

you can probably dump your own keys/fuses with SMU code execution