5 ms·
This different article from STH explains what the AMD PSB is, without having to watch a video: https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-e
by jfim 5y ago
This different article from STH explains what the AMD PSB is, without having to watch a video: https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-for-enhanced-security-at-a-cost/ https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
> An OEM who trusts only their own cryptographically signed BIOS code to run on their platforms will use a PSB enabled motherboard and set one-time-programmable fuses in the processor to bind the processor to the OEM’s firmware code signing key. AMD processors are shipped unlocked from the factory, and can initially be used with any OEM’s motherboard. But once they are used with a motherboard with PSB enabled, the security fuses will be set, and from that point on, that processor can only be used with motherboards that use the same code signing key.
Basically, the CPU once in that mode will only work with the same signing key, and cannot be put on a motherboard from another brand (or potentially another model from the same manufacturer).
- R0b0t1 5y agoNotably this seems to happen to CPUs that you might purchase yourself, which seems like a huge liability. If you somehow burn a $1000 CPU on a shitty mobo I can't see most people eating that.
- iratewizard 5y agoMy first thought was, is it really a big deal to do that to your laptop's cpu? Then I saw that they're doing this to desktops. My next thought was, people buy pre-built desktops still? Still really concerning to see Lenovo make boneheaded moves like this when they've had one of the better track records for manufacturers.
- seized 5y agoMaybe not the worst track record but they have made other terrible choices... https://en.m.wikipedia.org/wiki/Superfish https://en.m.wikipedia.org/wiki/Superfish
- vetinari 5y ago> My next thought was, people buy pre-built desktops still? If you are enthusiast and need a one or two desktops, then probably not. If you need to procure several hundred of them every few months, then probably yes. What this definitely will do is to affect the market price of these desktops once the lease (or depreciation time) runs out and owner will try to unload them on second hand market.
- overtonwhy 5y agoMost people buy pre built desktops. Partly because it's the only way to get a high end video card.
- kube-system 5y agoBusinesses almost exclusively purchase prebuilt computers.
- pram 5y agoYou think businesses have some computer janitor working for them that puts together heckin epic artisanal gaming rigs? lol
- amluto 5y agoA much nicer solution would be a move the static root of trust off the CPU package. The motherboard’s EC could easily verify a BIOS signature before allowing boot with no CPU involvement whatsoever.
- qmarchi 5y agoSee: The Sony PS3
- NablaSquaredG 5y agoAs far as I know, Intel does exactly that (or at least allows vendors to do that, I think HP does that) IIRC, in Intel's case, the chipset has the vendor keys burned into it. This is not an issue, as the chipset is not a part you would remove from the board and use elsewhere.
- my123 5y agoIn Intel’s case the ME as a whole is on the PCH.
- amluto 5y agoIntel’s or AMD’s assistance is not needed at all. There is a rather boring flash chip connected by SPI to the CPU and/or PCH. One could interpose a microcontroller that verifies whatever it pleases on that SPI link.
- my123 5y agoThat’s the approach used by the Apple T2. On the Intel side, it’s the chipset soldered on the motherboard which does that verification, so CPU swapping isn’t affected.
- rasz 5y agoAMD CPUs are full SOCs nowadays. Everything is on CPU die.
- MertsA 5y ago
- jevoten 5y ago> OEM who trusts only their own cryptographically signed BIOS code to run on their platforms It's not their platform after they sell it. We should resist this trend of referring to items as still belonging to their manufacturers, legitimizing their control over them, while we are reduced to mere users, paying for items but not owning them. Let's see how it sounds: > An OEM who wants to restrict their customers from selling their CPU, or buying one second-hand, will use a PSB enabled..
- kllrnohj 5y agoIt is the OEM's product. They are selling the BIOS, motherboard, and CPU as a single unit, along with a bunch of other stuff. If you wanted individual pieces, then buy individual pieces. Why are you even shopping for these products if you had any intention of ever dealing with in-socket CPU upgrades or parting it out second hand?
- R0b0t1 5y agoThere's precedent that they can't do this. If you buy it intending to piece it out and you can't and this was not explained to you, whoever you bought it from or AMD is liable for damages.
- michaelmrose 5y agoMost of us aren't merchants we as a society aren't obliged to let you do business save on our terms. If they think they can get more favorable terms elsewhere they can very well sell locked down elsewhere. This is a trend we ought to have shut down 20 years ago and we should darn well shut down now.
- chiph 5y ago> or potentially another model from the same manufacturer This would allow an OEM/ODM to segment their offerings by having two or more sets of signing keys. "Oh sorry, that CPU only works in our entry-level offerings. You will need our enterprise-certified AMD CPU for your large server." "But it's the same socket!"
- INTPenis 5y agoThanks for the explanation, this is what I suspected but it wasn't made clear by the hysteria of the video because I really don't see the problem here. Most computers end up on the dump as one unit anyways. I've built a few computers in my time but never used an old CPU from one. And especially not one with that form factor that I probably buy as a wardrobe homelab purpose. I'd compare it to my Asus PN50 that does have a later model Ryzen so it might just make use of this PSB. Sure it sets an interesting precedent but then again a lot of CPUs in the business are welded to their boards. And this conspiracy theory of this being like Intel ME, or being used maliciously, is just an exciting answer to what probably has a much simpler explanation, like maybe this is vendor locking their product just like Microsoft Windows has been doing for decades.
- jacquesm 5y ago> I've built a few computers in my time but never used an old CPU from one. I've routinely upgraded drives, graphics cards and memory to give an older system a new lease on life. Usually they're good for a couple of years after that. Essentially the only things remaining where motherboard, CPU and the power supply.