Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

71–80 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#71

Post by my123 »

amluto wrote: post #63
NablaSquaredG wrote: post #49

Earlier quoted context omitted.

As far as I know, Intel does exactly that (or at least allows vendors to do that, I think HP does that) IIRC, in Intel's case, the chipset has the vendor keys burned into it. This is not an issue, as the chipset is not a part you would remove from the board and use elsewhere.

Intel’s or AMD’s assistance is not needed at all. There is a rather boring flash chip connected by SPI to the CPU and/or PCH. One could interpose a microcontroller that verifies whatever it pleases on that SPI link.

That’s the approach used by the Apple T2. On the Intel side, it’s the chipset soldered on the motherboard which does that verification, so CPU swapping isn’t affected.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#72

Post by UI_at_80x24 »

NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

>or access to the OOB / BMC / IPMI

I've worked on a few SuperMicro servers that bundled OOB/IPMI onto the same NIC that is used for the LAN. 1 RJ45, 2 MAC addresses

I will stab the bean-counter that thought this was an OK idea with a fork if I ever meet them.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#73

Post by Retr0id »

alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

> a free architecture that doesn't include that shit

There is nothing stopping RISC-V SoC/CPU vendors from tacking it on.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#74

Post by rasz »

amluto wrote: post #37
jfim wrote: post #21

This different article from STH explains what the AMD PSB is, without having to watch a video: https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-... > An OEM who trusts only their own cryptographically signed BIOS code to run on their platforms will use a PSB enabled motherboard and set one-time-programmable fuses in the processor to bind the processor to the OEM’s firmware code signing key. AMD processors…

A much nicer solution would be a move the static root of trust off the CPU package. The motherboard’s EC could easily verify a BIOS signature before allowing boot with no CPU involvement whatsoever.

AMD CPUs are full SOCs nowadays. Everything is on CPU die.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#75

Post by kube-system »

iratewizard wrote: post #35
R0b0t1 wrote: post #27

Earlier quoted context omitted.

Notably this seems to happen to CPUs that you might purchase yourself, which seems like a huge liability. If you somehow burn a $1000 CPU on a shitty mobo I can't see most people eating that.

My first thought was, is it really a big deal to do that to your laptop's cpu? Then I saw that they're doing this to desktops. My next thought was, people buy pre-built desktops still? Still really concerning to see Lenovo make boneheaded moves like this when they've had one of the better track records for manufacturers.

Businesses almost exclusively purchase prebuilt computers.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#76

Post by captainmuon »

YXNjaGVyZWdlbgo wrote: post #18
monocasa wrote: post #11

Earlier quoted context omitted.

It's probably both of their fault. Lenovo wouldn't do it unless there was something in it for them. I wouldn't be surprised if they get a better deal from AMD on these CPUs for being locked to a specific board (killing off their ability to be used in the parts reseller market).

It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...

That link doesn't explain how it improves security, as all mainboards of the vendor have the same key. All it does is prevent somebody from sneakily replacing the mainboard with a different brand! It would make more sense if the board was bound to the specific CPU (assuming the CPU is the root of trust). But then you could just encase it in some kind of thermal epoxy...

It's obvious that this is supposed to limit the second hand server parts market.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#77

Post by fartcannon »

BoorishBears wrote: post #69
sedatk wrote: post #58

Earlier quoted context omitted.

These would only help the power users, not the remaining 99%.

Trusted computing environments only hurt 1% of the users anyways. We live in a world where people talk about Thinkpads vs Macbook Pros, but for 99% of the world laptops are appliances they buy like we'd buy a toaster. They don't care that they can't run Linux, if anything onerous code signing requirements ala mobile devices would be great for the safety of their devices with minimal effects on what they can do. - I'm…

The hypothetical homogeneous group 'they' you refer to doesn't exist. It's billions of people and 'they' feel many ways. By painting with a common brush, you shut down discussions of what could be and encourage fence sitters to give up. Let's talk about why it's possible, easy to do, and how to do it.

The more fence sitters you convince that things are possible, pushes the fence further and further towards the other side.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#78

Post by rasz »

fnord77 wrote: post #53
NablaSquaredG wrote: post #34

Earlier quoted context omitted.

locking: At least some AMD CPUs (EPYC, TR PRO, Ryzen Pro) can have cryptographic keys burned into the silicon by the BIOS (Dell and Lenovo do that) Once a CPU has those keys burned into it, it is locked to motherboards of this specific vendor, because other motherboards don't have a BIOS that is signed with the cryptographic key that was burned in. PSB: Platform Security Boot PSP: Platform Security Processor (a CPU i…

what advantage does locking a CPU to a specific vendor give the vendor?

Cheaper region locked CPU for Chinese market.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#79

Post by INTPenis »

jfim wrote: post #21

This different article from STH explains what the AMD PSB is, without having to watch a video: https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-... > An OEM who trusts only their own cryptographically signed BIOS code to run on their platforms will use a PSB enabled motherboard and set one-time-programmable fuses in the processor to bind the processor to the OEM’s firmware code signing key. AMD processors…

Thanks for the explanation, this is what I suspected but it wasn't made clear by the hysteria of the video because I really don't see the problem here.

Most computers end up on the dump as one unit anyways. I've built a few computers in my time but never used an old CPU from one.

And especially not one with that form factor that I probably buy as a wardrobe homelab purpose. I'd compare it to my Asus PN50 that does have a later model Ryzen so it might just make use of this PSB.

Sure it sets an interesting precedent but then again a lot of CPUs in the business are welded to their boards.

And this conspiracy theory of this being like Intel ME, or being used maliciously, is just an exciting answer to what probably has a much simpler explanation, like maybe this is vendor locking their product just like Microsoft Windows has been doing for decades.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#80

Post by YXNjaGVyZWdlbgo »

captainmuon wrote: post #76
YXNjaGVyZWdlbgo wrote: post #18

Earlier quoted context omitted.

It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...

That link doesn't explain how it improves security, as all mainboards of the vendor have the same key. All it does is prevent somebody from sneakily replacing the mainboard with a different brand! It would make more sense if the board was bound to the specific CPU (assuming the CPU is the root of trust). But then you could just encase it in some kind of thermal epoxy... It's obvious that this is supposed to limit the…

If you read the two pages and you concluded that both AMD with their statement on Page 1 nor servethehome on Page 1 and Page 2 provided any information about how PSB works I can't help you.
Post reply on HN