Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

161–170 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#161

Post by R0b0t1 »

kllrnohj wrote: post #152
jevoten wrote: post #38

Earlier quoted context omitted.

> OEM who trusts only their own cryptographically signed BIOS code to run on their platforms It's not their platform after they sell it. We should resist this trend of referring to items as still belonging to their manufacturers, legitimizing their control over them, while we are reduced to mere users, paying for items but not owning them. Let's see how it sounds: > An OEM who wants to restrict their customers from s…

It is the OEM's product. They are selling the BIOS, motherboard, and CPU as a single unit, along with a bunch of other stuff. If you wanted individual pieces, then buy individual pieces. Why are you even shopping for these products if you had any intention of ever dealing with in-socket CPU upgrades or parting it out second hand?

There's precedent that they can't do this. If you buy it intending to piece it out and you can't and this was not explained to you, whoever you bought it from or AMD is liable for damages.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#162

Post by fartcannon »

BoorishBears wrote: post #160
fartcannon wrote: post #119

Earlier quoted context omitted.

Huh? I like your ideas, but I'm not painting. I'm saying "don't paint". If you think of it like a nice dividing line through the people who think stuff can change and the people who don't, the folks on the line are 'on the fence'. You see? If you can convince a few of them (not large swathes of them, just a few), then the line shifts. If we all do that, we can change a lot of minds for good! You get what I mean? So y…

I'm saying you're painting though, and I'm saying you can't talk like things are easy to get better and have a meaningful conversation. Instead of trying to act like most people will ever care about locked bootloaders and PSB style co-processors, why don't we accept that they don't, they won't, and see what can happen from there? An example of that is looking at it from a national security perspective. If you can pai…

Interesting! I have to disagree that it can't lead to a meaningful conversation, but I'm definitely on board with painting it as a tech vulnerability!

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#163

Post by samstave »

alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

>>It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user.

This is EXACTLY what all the major handsets/cellphones have had in them for a very long time.

Carriers required certain side/backdoors into the devices.. which was really a tunnel for LEO/State...

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#164

Post by smoldesu »

pjmlp wrote: post #135
alerighi wrote: post #127

Earlier quoted context omitted.

RISCV is an open architecture. If a manufacturer does that, simply don't buy the processor from that manufacturer and buy it from another. All your software will still be compatible since it's the same architecture. Otherwise with x86 is more complex: you can choose between Intel and AMD (that has bought the license for the x86 instruction set - not something cheap to get), and both of them had their backdoor process…

Assuming that the software is all available from source and can be recompiled. Only the base RISC V is guaranteed thanks extensions. Also you are forgetting that just like Android and ARM, there are other forces at play that don't make it as easy in practice as FOSS advocates wish for.

> Assuming that the software is all available from source and can be recompiled.

I remembered hearing that same line when I bought a Raspberry Pi in 2012. "It's useless! You can't run x86 software on it, so what's the point?"

Flash-forwards a decade and now Graviton instances are blowing up like nothing else in the industry. RISC-V is in a very similar position to ARM 10 years ago; the groundwork has been laid, standards have been ratified and base packages/several kernels work perfectly fine on it. The only difference is that ARM is more expensive to license and is less flexible.

> Only the base RISC V is guaranteed thanks extensions.

Yeah. Is that a problem? The situation on ARM is equally bad if not worse (frequent iterations end up throwing even relatively recent CPU models under the bus), and the reason why RISC-V divided itself into extensions is so that you didn't have to start from scratch when John RISC decides to add in 3 new floating point instructions. It's a pretty damn good compromise if you ask me, and it certainly doesn't have any bearing on software availability; RISC-V programs run on RISC-V processors. ARM does not have that same liberty.

There are plenty of genuine constraints for RISC-V (the majority of them in the manufacturing/mass production side of things, now), but the majority of these software issues have been solved and taped out years ago.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#165

Post by alerighi »

mjg59 wrote: post #138
alerighi wrote: post #48

The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It's a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user. The AMD PSB can also be used to lock down a processor to enforce secure boot a…

You're conflating two different things - AMD's Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel's ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel's Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it. Both Boot Guard and PSB prevent you from modifying the system fir…

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firmware.

And given that is firmware, it's worse than that: the manufacturer can with a firmware update remove (that you can't downgrade thanks to all this security bullshit) the possibility to disable secure boot and revoke the keys used by Linux distributions. Reason why I tend to never update the firmware of computers (as to me the firmware is just a bootloader to GRUB that then boots the operating system).

The real thing is, we don't need this kind of security. We don't need ME, PSP, PSB, TPM, and all kind of bullshit. I've never herd of an attack in real life that exploits the boot process. When 99% of computers runs Windows that is full of security vulnerabilities, and nearly half of them even a no longer supported version of Windows, the other half a non updated version because updates are a waste of time.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#167

Post by coldtea »

userbinator wrote: post #123
judge2020 wrote: post #84

Earlier quoted context omitted.

> RISCV architecture (a free architecture that doesn't include that shit) Surely you can't think the architecture itself is the differentiator. x86 didn't have all of this security 20 years ago, give engineers a few years of time to throw some locks on a risc-v chip and it'll be Enterprise Ready™ in no time.

With the (already?) expiration of x86 patents, I'd love to see a "pure" x86 implementation without any of the user-hostile crap, and see how far the community can take it; but sadly, the RISC bandwagon is diverting attention away from that. A CPU without the user-hostile features but still able to run the massive existing software base would be ideal.

>I'd love to see a "pure" x86 implementation without any of the user-hostile crap, and see how far the community can take it;

And who would make the tens of billions of investment to build a fab for that?

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#168

Post by mjg59 »

alerighi wrote: post #165
mjg59 wrote: post #138

Earlier quoted context omitted.

You're conflating two different things - AMD's Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel's ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel's Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it. Both Boot Guard and PSB prevent you from modifying the system fir…

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firm…

A computer that requires the firmware to be replaced to boot Linux is already at the point where 99% of users are just not going to install Linux (I've personally ported Coreboot to two of my laptops, and even I would never buy hardware that required me to do that before I could run Linux).

And, well, you may well have never heard of attacks that would be mitigated by these technologies, but I have. Firmware-based attacks have existed for over a decade, and the Hacking Team leak included a firmware implant targeted at some ThinkPads. Do I think most users need to worry about this? No, I don't, and I don't know that there's enough people who do need to worry about this that it should be the default (I have thoughts on this, I'll write them up later this evening). But to deny that some people do need to worry about this is just inaccurate.

And Microsoft has required secure boot and TPMs on all certified client systems since Windows 8.1. Almost all shipped hardware already has all this functionality. If Microsoft had any interest in being evil here, they've had the opportunity to do so for years.

Anyway! Even if you can't replace the firmware, the secure boot database is in an unprotected variable store, so you can just replace it even if PSB is enabled. You're welcome.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#169

Post by coldtea »

userbinator wrote: post #137
alerighi wrote: post #131

Earlier quoted context omitted.

Would be too difficult to implement. x86 is a very big instruction that is impossible to implement with an hardware: both Intel and AMD processors in fact run inside a virtual machine that translates x86 instructions in an internal RISC instruction set that is manageable by the real CPU architecture. If Apple decided to move away from x86 and go to ARM to have their processor, and we are talking about one of the bigg…

I'm not sure if you're being satirical, but open source x86 cores do exist --- they're around a 486 in terms of compatibility. Look up ao486 for example. What I'm referring to is the expiration of patents from the P6 era, which would mean all the uop-based stuff is now free to implement. What a lot of the RISC hype doesn't understand is the huge value in backwards compatibility --- you can have your "100% free" world…

>I'm not sure if you're being satirical, but open source x86 cores do exist --- they're around a 486 in terms of compatibility.

And they will stay at that level, is the parent's point, which is 25+ years before today and thus affordable to clone and fabricate. It's not about 486 or for that matter 8086 beinh difficult...

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#170

Post by michaelmrose »

BoorishBears wrote: post #69
sedatk wrote: post #58

Earlier quoted context omitted.

These would only help the power users, not the remaining 99%.

Trusted computing environments only hurt 1% of the users anyways. We live in a world where people talk about Thinkpads vs Macbook Pros, but for 99% of the world laptops are appliances they buy like we'd buy a toaster. They don't care that they can't run Linux, if anything onerous code signing requirements ala mobile devices would be great for the safety of their devices with minimal effects on what they can do. - I'm…

You are supposing that people would only use total control of a platform to forbid things almost nobody wants to do. This seems rather a waste. It's like being superman and using the ability to fly to get to business meetings slightly faster.

One would suppose instead that the logical thing to do is create financial opportunities that wouldn't otherwise exist by restricting what you can do without allowing them to insert themselves in the revenue stream.

I recall a long junked verizon phone I owned before android was a thing that could only ever be used with verizon. Despite paying for the phone in full including its GPS because Verizon had full control of the platform the only way to actually use the GPS was to pay Verizon $10 per month for navigation.

An environment where I could repurpose my existing phone instead of buying a new one when I switched carriers, where I could keep my phone number even, or one in which actually using the GPS didn't cost as much over time as the entire phone didn't exist but if you asked me at the time if I would like to live in our present universe or one which those restrictions remained the norm I should easily be able to answer.

Post reply on HN