<story><title>Lenovo vendor locking Ryzen CPUs with AMD PSB</title><url>https://www.servethehome.com/lenovo-vendor-locking-ryzen-cpus-with-amd-psb-the-video/</url></story><parent_chain><item><author>alerighi</author><text>The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It&amp;#x27;s a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user.&lt;p&gt;The AMD PSB can also be used to lock down a processor to enforce secure boot and thus don&amp;#x27;t let you run an unsigned operating system, i.e. no longer allowing you to run Linux on your machine that comes out of the factory with Windows preinstalled. That would be a very very bad thing.&lt;p&gt;Unfortunately both for Intel and AMD you don&amp;#x27;t have choices these days. I&amp;#x27;m hoping someone develops a processor based on the RISCV architecture (a free architecture that doesn&amp;#x27;t include that shit) to be used in a computer entirely under the control of the user (hardware and software) and not the corporation that makes it.</text></item></parent_chain><comment><author>mjg59</author><text>You&amp;#x27;re conflating two different things - AMD&amp;#x27;s Platform Security Processor (PSP) and Platform Secure Boot (PSB). PSP is broadly equivalent to Intel&amp;#x27;s ME, but lives on the CPU package rather than in the chipset. PSB is equivalent to Intel&amp;#x27;s Boot Guard, a feature that verifies that the system firmware has a valid signature before letting the CPU boot it.&lt;p&gt;Both Boot Guard and PSB prevent you from modifying the system firmware (and, say, putting Coreboot on there), but because Boot Guard is implemented in the ME, and because the ME is in the chipset, not the CPU, you can take CPUs out of Intel-based systems and transfer them to somewhere else. If you do the same with a PSB-fused AMD, the firmware on the new board won&amp;#x27;t be signed with the same key and it&amp;#x27;ll refuse to boot.&lt;p&gt;None of this technology provides any real way to prevent you from booting Linux. If vendors wanted to do that, they could already just ship firmware that only supported the Windows signing key and didn&amp;#x27;t let users enroll new keys. They don&amp;#x27;t need PSP, ME, Boot Guard or PSB to do that.</text></comment>
<story><title>Lenovo vendor locking Ryzen CPUs with AMD PSB</title><url>https://www.servethehome.com/lenovo-vendor-locking-ryzen-cpus-with-amd-psb-the-video/</url></story><parent_chain><item><author>alerighi</author><text>The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It&amp;#x27;s a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user.&lt;p&gt;The AMD PSB can also be used to lock down a processor to enforce secure boot and thus don&amp;#x27;t let you run an unsigned operating system, i.e. no longer allowing you to run Linux on your machine that comes out of the factory with Windows preinstalled. That would be a very very bad thing.&lt;p&gt;Unfortunately both for Intel and AMD you don&amp;#x27;t have choices these days. I&amp;#x27;m hoping someone develops a processor based on the RISCV architecture (a free architecture that doesn&amp;#x27;t include that shit) to be used in a computer entirely under the control of the user (hardware and software) and not the corporation that makes it.</text></item></parent_chain><comment><author>Terry_Roll</author><text>Well its only a question of time before someone starts targeting the Intel vPro Management Engine and AMD PSB to alter CPU abilities using variations of code like that found on Github below.
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mostav02&amp;#x2F;Remove_IntelME_FPT&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mostav02&amp;#x2F;Remove_IntelME_FPT&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rootkovska&amp;#x2F;x86_harmful&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;x86_harmful.md&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;rootkovska&amp;#x2F;x86_harmful&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;x86_ha...&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;corna&amp;#x2F;me_cleaner&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;me_cleaner.py&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;corna&amp;#x2F;me_cleaner&amp;#x2F;blob&amp;#x2F;master&amp;#x2F;me_cleaner.p...&lt;/a&gt;</text></comment>