Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo vendor locking Ryzen CPUs with AMD PSB

servethehome.com

Post reply on HN
Print view View original

201–210 of 234 posts

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#201

Post by kevin_b_er »

fnord77 wrote: post #53
NablaSquaredG wrote: post #34

Earlier quoted context omitted.

locking: At least some AMD CPUs (EPYC, TR PRO, Ryzen Pro) can have cryptographic keys burned into the silicon by the BIOS (Dell and Lenovo do that) Once a CPU has those keys burned into it, it is locked to motherboards of this specific vendor, because other motherboards don't have a BIOS that is signed with the cryptographic key that was burned in. PSB: Platform Security Boot PSP: Platform Security Processor (a CPU i…

what advantage does locking a CPU to a specific vendor give the vendor?

By ending the fundamental right of ownership itself, the vendor ensures no one can resell stuff and lower the value of what they "sell". It has little to nothing to do with actual security, but instead pure greed.

You will own nothing, and you will be happy.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#202

Post by UltraViolence »

CoastalCoder wrote: post #10
UltraViolence wrote: post #7

Quoted post unavailable.

Out of curiosity, which vendors do you find acceptable?

Western manufacturers, even if they manufacture their stuff in China.

I don't want stuff made or designed by Chinese companies. They suck at it and most of their stuff is unfinished and barely works.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#205

Post by Mikeb85 »

Ysraes wrote: post #125
Shadonototra wrote: post #4

lenovo again.. when it's not shipping with rootkits (they did it twice!) and bloatware, it's about limiting HW a company to boycott

Is there any laptop manufacturer that doesn't ship complete bloat/mal/spy/ware in their products?

I'm going to guess when OEMs ship Linux (Dell, Lenovo, System76, etc...) there's no bloatware. No bloatware on Apple except their OS ;-). But yeah, it's shocking. When I bought my laptop (an Acer Swift 3) it was borderline unusable with Windows and the standard install (wasn't even using native resolution, like WTF!?). Thankfully runs perfectly and looks great with Linux (even suspend, fingerprint reader, bluetooth, etc...).

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#206

Post by raxxorrax »

alerighi wrote: post #165
mjg59 wrote: post #138

Earlier quoted context omitted.

You're conflating two different things - AMD's Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel's ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel's Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it. Both Boot Guard and PSB prevent you from modifying the system fir…

You said it: it prevents you from booting a custom firmware. If the manufacturer decides to lock down the stock firmware for only booting Windows (something that is not absurd and some manufacturers already attempted in the past, and keep in mind that Microsoft is requiring TPM and secure boot with Windows 11) you are basically screwed. You can't boot Linux with the stock firmware and you can't change the system firm…

> The real thing is, we don't need this kind of security

This is a real argument. While it might make sense for cloud computing for the client to verify system integrity, malware that modifies firmware is not the largest blip on the radar in these times. A good protection is actually the numerous different manufacturers.

I agree, these technologies aren't primarily for security, they are to enforce how devices are used.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#207

Post by pjmlp »

smoldesu wrote: post #164
pjmlp wrote: post #135

Earlier quoted context omitted.

Assuming that the software is all available from source and can be recompiled. Only the base RISC V is guaranteed thanks extensions. Also you are forgetting that just like Android and ARM, there are other forces at play that don't make it as easy in practice as FOSS advocates wish for.

> Assuming that the software is all available from source and can be recompiled. I remembered hearing that same line when I bought a Raspberry Pi in 2012. "It's useless! You can't run x86 software on it, so what's the point?" Flash-forwards a decade and now Graviton instances are blowing up like nothing else in the industry. RISC-V is in a very similar position to ARM 10 years ago; the groundwork has been laid, stand…

Are they? Where are the real numbers beyond Amazon marketing materials?

The problem is dreamers thinking RISC V will be any different than other CPUs in the industry when big players come playing.

LLVM, contributions level at the scale of Linux kernel, C++20 support now lags behind everyone else.

When money comes to play, the rainbows and flowers eventually turn into wall street yuppies.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#208

Post by pjmlp »

pabs3 wrote: post #193
pjmlp wrote: post #135

Earlier quoted context omitted.

Assuming that the software is all available from source and can be recompiled. Only the base RISC V is guaranteed thanks extensions. Also you are forgetting that just like Android and ARM, there are other forces at play that don't make it as easy in practice as FOSS advocates wish for.

Using qemu-user-static and similar you can run binaries from one arch on another arch.

With emulation one can always run one archicture in another one, there is nothing scientific about it, provided there is enough knowledge about the source architecture.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#209

Post by NablaSquaredG »

kllrnohj wrote: post #150
NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

> But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode) BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates fr…

> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get.

Yes, I forgot to add that point. It's also just as bad as the other options, because it means that the attacker has gained root access. Using the vendor locking as a method to remedy this issue (an attacker being able to compromise a servers' BIOS or BMC) is basically just fighting the symptoms, not the root cause (which is that inband updates from the OS for BIOS and BMC are generally a bad idea)

> And 99% of that hardware is sold together as a unit. It will hamper repair efforts, as the CPU & motherboard are now effectively a single unit, but it does not effectively kill or even significantly harm the second hand market.

This is generally not true. 90% of the hardware is sold separately, servers are mostly sold as barebones and CPUs without servers. Some vendors offer custom configurable servers and I know from many that they make the majority of their sales from barebones or single CPUs, not configured or assembled systems.

> Nobody is running a datacenter on second-hand hardware anyway, there's no market to cripple there.

Not hyperscalers, no. But many SMEs / SMBs buy refurbished hardware and running their datacenters on refurbished hardware. With your argument, we could as well say "just toss all server hardware in the bin once it has been decommissioned" which is obviously nonsense, because if there wasn't demand for refurbished server hardware, there wouldn't be a such a big market in the first place. You can assume that at least 95% of decommissioned server hardware (except HDDs, still too many of them are shredded) gets a second or third life.

Re: Lenovo vendor locking Ryzen CPUs with AMD PSB

#210

Post by NablaSquaredG »

hnthrowaway0315 wrote: post #104
NablaSquaredG wrote: post #43

There are a couple of issues I see with this. First, the security argument is nonsense in my opinion. This "feature" only prevents an attacker from flashing a modified, malicious BIOS on to the server. But: If an attacker manages to flash a new BIOS to your server, you're already lost. That either requires physical access (which is bad), or access to the OOB / BMC / IPMI (which is equally bad, because those usually h…

> You could permanently kill an entire datacenter with that within seconds Damn I bet someone perhaps a state player or a well financed group is able to do this, can't wait to see this happen...But how does anyone burn it remotely?

By finding a bug in the PSP.

Heck, bugs like Meltdown and Spectre were found. And exploits on the PSP have already been demonstrated, see here https://github.com/PSPReverse/amd-sp-glitch

Post reply on HN