23K views · Dec 28, 2019 · 56:37 · 1 HN recommender · 5 mentions · discussed 2019–2021
A 36C3 talk on the AMD Platform Security Processor, an undocumented ARM core inside AMD CPUs that runs before the main processor. The speakers present their reverse engineering of its internals.
Why Hacker News points people here: Cited in discussions of open firmware and trust as a thorough reverse engineering of the PSP.
“(Btw, watch the whole talk, it's nothing short of incredible.)”HN comment, 2021
“(Btw, watch the whole talk, it's nothing short of incredible.)”
Reverse engineering of PSP; found nothing evil
There's this great talk from a CCC about reverse engeneering the PSP: Uncover, Understand, Own - Regaining Control Over Your AMD CPU this video At 47:10, they mention that they haven't found anything evil. Ofc, this isn't hard proof, but if I trust anyone's answer, then it's theirs. (Btw, watch the whole talk, it's nothing short of incredible.)
“There's this great talk from a CCC about reverse engeneering the PSP”
Reverse engineering the PSP found nothing evil
There's this great talk from a CCC about reverse engeneering the PSP: Uncover, Understand, Own - Regaining Control Over Your AMD CPU this video At 47:10, they mention that they haven't found anything evil. Ofc, this isn't hard proof, but if I trust anyone's answer, then it's theirs. I think the likelihood of it being malicious is nonzero, but small enough that I'd condemn active backdoors into the realm of conspiracy theories. There's always the possibility of it being exploited by others, but c'mon: Basically ANY other exploit would be way easier to distribute and activate than one in the PSP.
Posts the talk abstract on the AMD PSP
Excerpt: "The AMD Platform Security Processor (PSP) is a dedicated ARM CPU inside your AMD processor and runs undocumented, proprietary firmware provided by AMD. It is a processor inside your processor that you don't control. It is essential for system startup. In fact, in runs before the main processor is even started and is responsible for bootstrapping all other components. This talk presents our efforts investigating the PSP internals and functionality and how you can better understand it. Our talk is divided into three parts: The first part covers the firmware structure of the PSP and how we analyzed this proprietary firmware. We will demonstrate how to extract and replace individual firmware components of the PSP and how to observe the PSP during boot. The second part covers the functionality of the PSP and how it interacts with other components of the x86 CPU like the DRAM controller or System Management Unit (SMU). We will present our method to gain access to the, otherwise hidden, debug output. The talk concludes with a security analysis of the PSP firmware. We will demonstrate how to provide custom firmare to run on the PSP and introduce our toolchain that helps building custom applications for the PSP. This talk documents the PSP firmware's proprietary filesystem and provides insights into reverse-engineering such a deeply embedded system. It further sheds light on how we might regain trust in AMD CPUs despite the delicate nature of the PSP." Researchers: Robert Bu
Cited as evidence analysts think the PSP is safe
If you’re referring to Intel ME and the AMD PSP, people who have analyzed the PSP seem to think it’s safe: this video
Cited to show PSP cannot be disabled
That's switch for TPM features only. You cannot disable PSP as it is responsible for x86 initialization. this video
