Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

141–150 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#141

Post by als0 »

alerighi wrote: post #131
userbinator wrote: post #123

Earlier quoted context omitted.

With the (already?) expiration of x86 patents, I'd love to see a "pure" x86 implementation without any of the user-hostile crap, and see how far the community can take it; but sadly, the RISC bandwagon is diverting attention away from that. A CPU without the user-hostile features but still able to run the massive existing software base would be ideal.

Would be too difficult to implement. x86 is a very big instruction that is impossible to implement with an hardware: both Intel and AMD processors in fact run inside a virtual machine that translates x86 instructions in an internal RISC instruction set that is manageable by the real CPU architecture. If Apple decided to move away from x86 and go to ARM to have their processor, and we are talking about one of the bigg…

RISC-V is not immune to Spectre and Meltdown because these are implementation vulnerabilities. Any CPU implementation that uses out-of-order and speculative execution has to constantly worry about introducing these holes.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#142

Post by userbinator »

als0 wrote: post #141
alerighi wrote: post #131

Earlier quoted context omitted.

Would be too difficult to implement. x86 is a very big instruction that is impossible to implement with an hardware: both Intel and AMD processors in fact run inside a virtual machine that translates x86 instructions in an internal RISC instruction set that is manageable by the real CPU architecture. If Apple decided to move away from x86 and go to ARM to have their processor, and we are talking about one of the bigg…

RISC-V is not immune to Spectre and Meltdown because these are implementation vulnerabilities. Any CPU implementation that uses out-of-order and speculative execution has to constantly worry about introducing these holes.

And on the other side, neither were early Atoms; but everyone knows what their performance is like.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#143

Post by ndiddy »

supernovae wrote: post #124
smoldesu wrote: post #117

Earlier quoted context omitted.

Why are management engines not delegated to professional/enterprise machines only then? Seems like an awful lot of money to waste putting specialized hardware into every machine you ship if only a fraction of the users will actually ever take advantage of it.

economy of scale. Cheaper by volume and priced on utilization. There was a time when HP sold servers that could be up to say, 8 cores but only two were on by default and you cloud license the rest. It was cheaper to shop the hardware and software gate it rather than limit it and have a process in the middle.

Why does Intel, a company known for its extensive price discrimination (see ECC memory support, hardware virtualization, FPU support in the 90s) still put ME in all of its consumer CPUs when it’s only useful for the enterprise market?

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#144

Post by gjsman-1000 »

ndiddy wrote: post #143
supernovae wrote: post #124

Earlier quoted context omitted.

economy of scale. Cheaper by volume and priced on utilization. There was a time when HP sold servers that could be up to say, 8 cores but only two were on by default and you cloud license the rest. It was cheaper to shop the hardware and software gate it rather than limit it and have a process in the middle.

Why does Intel, a company known for its extensive price discrimination (see ECC memory support, hardware virtualization, FPU support in the 90s) still put ME in all of its consumer CPUs when it’s only useful for the enterprise market?

Economy of scale. The ME isn't just a management tool but is also used to help initialize the CPU. No reason to write a whole custom way of doing that instead of reusing the same technology.

Also, customer CPUs are often (due to binning) rebranded Enterprise CPUs that were rejected (or just not purchased) for whatever reason, or vice versa. Easier to build ME on them all and configure it later.

Your ECC memory? It's something Intel just flips on or off depending on how they want to sell the chip - many Core i7s and i9s have it on-die but you can't use it. That's because it might be useful on a Xeon Platinum equivalent.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#145

Post by monocasa »

YXNjaGVyZWdlbgo wrote: post #140
monocasa wrote: post #122

Earlier quoted context omitted.

I was pretty sure that I made it clear that the concept under discussion was using a hardware root of trust scheme like PSB to tie a specific CPU to a particular vendor's boards. As an aside I'm putting a lot of effort into staying civil; I'd appreciate seeing that effort be a bit more reciprocal.

PSB is there to protect you from a compromised motherboard it protects you from malware in your UEFI firmware. It's not even a vendor lock in it's signing key lock in that is used in that manner by AWS, Gcloud and Azure. Compromised UEFI Firmware is a constant point of failure in pentesting of the secure chain of trust. That you as a security researcher are dismissing the fact is honestly just unbelievable.

> It's not even a vendor lock in it's signing key lock in that is used in that manner by AWS, Gcloud and Azure.

Which is not the mechanism under discussion.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#146

Post by [deleted] »

smoldesu wrote: post #117
Godel_unicode wrote: post #105

Earlier quoted context omitted.

> ...the government had no problem forcing them to both add IME/PSP. This is a false narrative, these management engines were added because large (corporate) customers of the major CPU vendors asked for them. Enterprise IT shops love stuff like this, anything to help them tame the unruly beast of asset inventory and management. This is the same reason things like iLO and DRAC exist, and they have all of the same type…

Why are management engines not delegated to professional/enterprise machines only then? Seems like an awful lot of money to waste putting specialized hardware into every machine you ship if only a fraction of the users will actually ever take advantage of it.

[deleted]

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#147

Post by charcircuit »

alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

>malware like the Intel managament engine

The code is not malicious please do not call it malware. Your computer already has dozens of other chips running proprietary software on them. It's just a normal part of PC components except since a CPU doesn't have a board the chip is built right in.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#149

Post by p_l »

smoldesu wrote: post #117
Godel_unicode wrote: post #105

Earlier quoted context omitted.

> ...the government had no problem forcing them to both add IME/PSP. This is a false narrative, these management engines were added because large (corporate) customers of the major CPU vendors asked for them. Enterprise IT shops love stuff like this, anything to help them tame the unruly beast of asset inventory and management. This is the same reason things like iLO and DRAC exist, and they have all of the same type…

Why are management engines not delegated to professional/enterprise machines only then? Seems like an awful lot of money to waste putting specialized hardware into every machine you ship if only a fraction of the users will actually ever take advantage of it.

Because around the same time as intel started to experiment more with the AMT stuff, the complexity level of actually starting up the CPU and keeping it running had grown to the point where having an extra controller to help it run was found useful.

Another reason is that ME (and PSP) are used to assert "security" of "Protected Media Path", which is part of streaming services DRM.

It's not the only way to do it, sure, but there's a reason why IBM POWER designs have approximately 2.1x amount of cores that is stated in the spec - pretty much every core has a smaller, simpler one dedicated to keeping the big one running without melting and helping transition to low-power states and back, and there are at least two more cores whose only job is handling some of the early loading of code from flash. Part of why they have those cores is that since POWER8 there was a shift towards more standalone operation without external controller chip (and POWER9 even describes such boot process in manual). For comparison, traditionally the FSP (aka BMC) on IBM POWER systems initialized all of hardware before the CPU would execute first instruction, puppeting the CPU buses through debug interface.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#150

Post by kllrnohj »

NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

> But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode)

BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.

> About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market. Locked CPUs are essentially worthlese, especially if buyers or sellers don't know and throw the CPU away because they think it's defective.

And 99% of that hardware is sold together as a unit. It will hamper repair efforts, as the CPU & motherboard are now effectively a single unit, but it does not effectively kill or even significantly harm the second hand market.

> I think this is just AMD's greediness again in the cloak of "improving security"

Intel has this same feature. This almost certainly wasn't done by AMD's "greediness" but rather because major customers, like Lenovo, demanded it. And even as a "greed" argument it's a pretty flimsy one. Nobody is running a datacenter on second-hand hardware anyway, there's no market to cripple there.

Post reply on HN