Hacker News Reader

Comment by dtx1 | Hacker News Reader

I never understood why AMD is not at least making the source of these available. I would actually really like a secure cryptographic processor that's been extensively vetted and trustworthy.

View on HN

That's exactly what we're doing with OpenTitan: https://opentitan.org/

Which Google will be using in Chromebook for it's security chip https://lowrisc.org/news/nuvoton-develops-opentitan-based-se...

Very cool. Bookmarked.

They did publish the source: https://github.com/amd/AMD-ASPFW

This was the PR(!): https://ir.amd.com/news-events/press-releases/detail/1154/am...

I wonder if the reported exploits forced them to publish the source.

That is only the part that allows encrypted virtual machines on EPYC cpus. The PSP in some form is on all AMD processors since about 2013/2014.

Encrypted vm's? On epyc?

What's the performance penalty for that?

I don't know the performance implications, but the brief description of the feature is that guest memory is encrypted with a key that the host doesn't know, so the host can't observe the contents of guest memory.

In benchmarks from Microsoft Azure and Google Cloud, 1-8% overhead for throughput.

Microsoft Azure: https://community.amd.com/t5/epyc-processors/microsoft-azure...

Google Cloud: https://www.amd.com/content/dam/amd/en/documents/epyc-busine...

For CPU bound work loads, pretty low, but not low enough that it's free (~5%).

For devices (especially latency sensitive workloads), it's quite bad. Device accesses have to be bounce-buffered. You can't do anything vaguely zero copy, since the device can't DMA to or from the VM. Future hardware support will mitigate that (mutually attested VM/Device interactions), but no real world devices support it yet.

The common assumption is that their hands are tied on that matter.

Like OpenSIL, AMD could start a long-term project to replace the closed ASP with an open alternative. The industry now has Calpitra (AMD contributes), OpenTitan, TockOS (used by Pluton) and other open hardware and software projects for security enclaves.

Many believe it was not added as a result of customer requirements, but that the government leaned on them to add it as a tool of surveillance.

"AMD Confirms It Won't Opensource EPYC's Platform Security Processor Code" https://hothardware.com/news/amd-confirms-it-will-not-be-ope... (2017)

> Dr. Lisa Su gave some hope that something would be done when she said she'd discuss things internally as the result of a recent reddit AMA question. Ultimately, though, it turns out that AMD is not opening up the PSP

https://www.twitch.tv/videos/160097335?t=00h35m35s

Reply on news.ycombinator.com