5 ms·

Could it be AMDs doing behind the scenes? I don't see the motivation for Lenovo here but I do see AMD asking vendors to do this to prevent OEM CPUs completing w

Could it be AMDs doing behind the scenes? I don't see the motivation for Lenovo here but I do see AMD asking vendors to do this to prevent OEM CPUs completing with retail CPUs.

YXNjaGVyZWdlbgo 5y ago
The feature was implemented in 2017 the only vendors that are using it are lenovo and dell. With lenovo being the only one using it on lower tier cpus than epyc.
- rasz 5y ago
  I imagine its Lenovo asking for lower prices on Chinese market bound CPUs and AMD being super happy killing secondary market after seeing Intel server/workstation CPUs flooding out of Asia.
  - YXNjaGVyZWdlbgo 5y ago
    It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
    - rasz 5y ago
      except those arent server chips
      - YXNjaGVyZWdlbgo 5y ago
        That's why I said in my initial comment that lenovo is the first vendor that uses it on workstation cpus. ie. Threadripper epyc is very much a server chip.
- monocasa 5y ago
  It's probably both of their fault. Lenovo wouldn't do it unless there was something in it for them. I wouldn't be surprised if they get a better deal from AMD on these CPUs for being locked to a specific board (killing off their ability to be used in the parts reseller market).
  - YXNjaGVyZWdlbgo 5y ago
    It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
    - captainmuon 5y ago
      That link doesn't explain how it improves security, as all mainboards of the vendor have the same key. All it does is prevent somebody from sneakily replacing the mainboard with a different brand! It would make more sense if the board was bound to the specific CPU (assuming the CPU is the root of trust). But then you could just encase it in some kind of thermal epoxy... It's obvious that this is supposed to limit the second hand server parts market.
      - YXNjaGVyZWdlbgo 5y ago
        If you read the two pages and you concluded that both AMD with their statement on Page 1 nor servethehome on Page 1 and Page 2 provided any information about how PSB works I can't help you.
        monocasa 5y ago
        Or that commenter read and understood the description of how it works, and failed to see how it increases security in a meaningful way. I also struggle to think of a threat model that this protects against.
        5y ago
- newsclues 5y ago
  Was it OEMs that asked for the feature or did three letter agencies pay AMD and Intel to back door all CPUs?
  - monocasa 5y ago
    CPUs being backdoored is orthogonal to this.
    - newsclues 5y ago
      The security processor is a black box. If the nsa wants a back door, could this functionality not be the justification for the security weakness created by installing the security processor? It’s what I’d do..,
      - monocasa 5y ago
        The security processor is there and starting the boot process whether or not it's checking a per CPU key on die.
  - chiph 5y ago
    Perhaps not to back-door them, but to ensure when they (the government agencies) buy from Dell that the supply chain is intact and the BIOS hasn't been tampered with during shipping by a foreign agency. Like the NSA did to Cisco routers destined for international customers.
vel0city 5y ago
The motivation from Lenovo's customer perspective is theoretically the customer knows this was the processor intended for the machine by Lenovo and nobody swapped it out in between the Lenovo factory and the customer's hands. Of course, no system is perfect so it's not a full guarantee and also there's the impact to the secondary market. But if you're an enterprise leasing these machines you don't care about the secondhand market anyways.
- zrm 5y ago
  > The motivation from Lenovo's customer perspective is theoretically the customer knows this was the processor intended for the machine by Lenovo and nobody swapped it out in between the Lenovo factory and the customer's hands. Except that it works the other way. You can put a generic retail processor in the machine -- which will then ruin it by locking it to that vendor. No customer benefit exists.
  - judge2020 5y ago
    > which will then ruin it by locking it to that vendor. Only if they click yes. https://twitter.com/FedsAgainstGunS/status/1473479524805492744?s=20 https://twitter.com/FedsAgainstGunS/status/14734795248054927...
    - zrm 5y ago
      Are you sure you want to permanently reduce the value of your CPU in exchange for no benefit of any kind?
- contravariant 5y ago
  I suppose that's helpful if you trust Lenovo. I've permanently lost trust in them after they decided to include malicious root certificates in their systems.

Could it be AMDs doing behind the scenes? I don't see the motivation for Lenovo here but I do see AMD asking vendors to do this to prevent OEM CPUs completing with retail CPUs.

YXNjaGVyZWdlbgo 5y ago

The feature was implemented in 2017 the only vendors that are using it are lenovo and dell. With lenovo being the only one using it on lower tier cpus than epyc.

rasz 5y ago
I imagine its Lenovo asking for lower prices on Chinese market bound CPUs and AMD being super happy killing secondary market after seeing Intel server/workstation CPUs flooding out of Asia.
- YXNjaGVyZWdlbgo 5y ago
  It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
  - rasz 5y ago
    except those arent server chips
    - YXNjaGVyZWdlbgo 5y ago
      That's why I said in my initial comment that lenovo is the first vendor that uses it on workstation cpus. ie. Threadripper epyc is very much a server chip.
monocasa 5y ago
It's probably both of their fault. Lenovo wouldn't do it unless there was something in it for them. I wouldn't be surprised if they get a better deal from AMD on these CPUs for being locked to a specific board (killing off their ability to be used in the parts reseller market).
- YXNjaGVyZWdlbgo 5y ago
  It makes sense for server security as discussed by the same source as the op https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
  - captainmuon 5y ago
    That link doesn't explain how it improves security, as all mainboards of the vendor have the same key. All it does is prevent somebody from sneakily replacing the mainboard with a different brand! It would make more sense if the board was bound to the specific CPU (assuming the CPU is the root of trust). But then you could just encase it in some kind of thermal epoxy... It's obvious that this is supposed to limit the second hand server parts market.
    - YXNjaGVyZWdlbgo 5y ago
      If you read the two pages and you concluded that both AMD with their statement on Page 1 nor servethehome on Page 1 and Page 2 provided any information about how PSB works I can't help you.
      - monocasa 5y ago
        Or that commenter read and understood the description of how it works, and failed to see how it increases security in a meaningful way. I also struggle to think of a threat model that this protects against.
        5y ago
newsclues 5y ago
Was it OEMs that asked for the feature or did three letter agencies pay AMD and Intel to back door all CPUs?
- monocasa 5y ago
  CPUs being backdoored is orthogonal to this.
  - newsclues 5y ago
    The security processor is a black box. If the nsa wants a back door, could this functionality not be the justification for the security weakness created by installing the security processor? It’s what I’d do..,
    - monocasa 5y ago
      The security processor is there and starting the boot process whether or not it's checking a per CPU key on die.
- chiph 5y ago
  Perhaps not to back-door them, but to ensure when they (the government agencies) buy from Dell that the supply chain is intact and the BIOS hasn't been tampered with during shipping by a foreign agency. Like the NSA did to Cisco routers destined for international customers.

vel0city 5y ago

The motivation from Lenovo's customer perspective is theoretically the customer knows this was the processor intended for the machine by Lenovo and nobody swapped it out in between the Lenovo factory and the customer's hands. Of course, no system is perfect so it's not a full guarantee and also there's the impact to the secondary market. But if you're an enterprise leasing these machines you don't care about the secondhand market anyways.

zrm 5y ago
> The motivation from Lenovo's customer perspective is theoretically the customer knows this was the processor intended for the machine by Lenovo and nobody swapped it out in between the Lenovo factory and the customer's hands. Except that it works the other way. You can put a generic retail processor in the machine -- which will then ruin it by locking it to that vendor. No customer benefit exists.
- judge2020 5y ago
  > which will then ruin it by locking it to that vendor. Only if they click yes. https://twitter.com/FedsAgainstGunS/status/1473479524805492744?s=20 https://twitter.com/FedsAgainstGunS/status/14734795248054927...
  - zrm 5y ago
    Are you sure you want to permanently reduce the value of your CPU in exchange for no benefit of any kind?
contravariant 5y ago
I suppose that's helpful if you trust Lenovo. I've permanently lost trust in them after they decided to include malicious root certificates in their systems.