AMD Platform Security Processor

Short description: Trusted execution environment subsystem that runs on AMD microprocessors

AMD Platform Security Processor settings in an UEFI configuration screen.

The AMD Platform Security Processor (PSP), officially known as AMD Secure Technology, is a trusted execution environment subsystem incorporated since about 2013 into AMD microprocessors.[1] According to an AMD developer's guide, the subsystem is "responsible for creating, monitoring and maintaining the security environment" and "its functions include managing the boot process, initializing various security related mechanisms, and monitoring the system for any type of activity or events and implementing an appropriate response".[2] Critics worry it can be used as a backdoor and is a security concern.[3][4][5] AMD has denied requests to open source the code that runs on the PSP.[1]

The equivalent part of PSP on Intel processors is the Intel Management Engine (IME).

## Contents

* 1 Details
* 2 Boot process
* 3 Reported vulnerabilities
* 4 See also
* 5 References
* 6 External links

## Details

The PSP itself represents an ARM core (ARM Cortex-A5) with the TrustZone extension which is inserted into the main CPU die as a coprocessor. The PSP contains on-chip firmware which is responsible for verifying the SPI ROM and loading off-chip firmware from it. The PSP also includes a boot processor, which responsible for some hardware initialization tasks (such as DRAM initialization) in boot process. In 2019, a Berlin-based security group discovered the off-chip firmware in ordinary UEFI image files (the code that boots up the operating system), which meant that it could be easily analyzed. By using a few hand-written Python-based tools, they found that the off-chip firmware from the SPI ROM contained an application resembling an entire micro operating system.[6][7][8] Investigation of a Lenovo ThinkPad A285 notebook's motherboard flash chip (stores UEFI firmware) revealed that the PSP core itself (as a device) is run before the main CPU and that its firmware bootstrapping process starts just before basic UEFI gets loaded. They discovered that the firmware is run inside in the same system's memory space that user's applications do with unrestricted access to it (including MMIO) raising concerns over data safety.[6][7][8] Because PSP is the chip that decides whenever the x86 cores will run or not , it is used to implement hardware downcoring, specific cores on the system can be made permanently inaccessible during manufacturing. The PSP also provides a random number generator for the RDRAND instruction[9] and provides TPM services.

The OEM/ODM can OTP fuse its public key into the AMD FCH or AMD CPU, make digital signing of the UEFI firmware obligatory, and make tampering with the UEFI firmware impossible.

## Boot process

The PSP is an integral part of the boot process, without which the x86 cores would never be activated.

On-chip phase
Firmware ROM integrated directly on the PSP chip sets up the PSP, do early hardware initialization tasks such as system memory (DRAM) initialization, and verifies the integrity of the SPI ROM, using various data structures locates the off-chip firmware (AGESA) from the SPI ROM, and loads it into PSP memory.
Off-chip phase
The PSP will do further hardware initialization tasks such as reinitialize DRAM. The PSP may perform additional verification steps and if the system is deemed secure, the PSP will find and load UEFI firmware within the SPI ROM, thus starting x86 cores. While UEFI firmware and x86 cores is started, the PSP still do some hardware initialization tasks (such as I/O subsystem initialization) and collaborate with UEFI firmware in the boot process.

## Reported vulnerabilities

In September 2017, Google security researcher Cfir Cohen reported a vulnerability to AMD of a PSP subsystem that could allow an attacker access to passwords, certificates, and other sensitive information; a patch was rumored to become available to vendors in December 2017.[10][11]

In March 2018, an Israeli IT security company reported a handful of allegedly serious flaws related to the PSP in AMD's Zen architecture CPUs (EPYC, Ryzen, Ryzen Pro, and Ryzen Mobile) that could allow malware to run and gain access to sensitive information.[12] AMD announced firmware updates to handle these flaws.[13][14] Their validity from a technical standpoint was upheld by independent security experts who reviewed the disclosures, although the high risks claimed by CTS Labs were dismissed,[15] leading to claims that the flaws were published for the purpose of stock manipulation.[16][17]

## See also

* Intel Management Engine

## References

1. ↑ 1.0 1.1 "AMD Confirms It Won't Opensource EPYC's Platform Security Processor Code". 2017-07-19. https://hothardware.com/news/amd-confirms-it-will-not-be-opensourcing-epycs-platform-security-processor-code. "This chip is found on most AMD platforms from 2013 on, and behaves much like Intel's Management Engine does [...] The rather blunt realization that PSP wasn't being open sourced came out during a discussion with AMD top brass about EPYC."
2. ↑ "BIOS and Kernel Developer's Guide (BKDG) for AMD Family 16h Models 30h-3Fh Processors". AMD. 2016. p. 156. http://support.amd.com/TechDocs/52740_16h_Models_30h-3Fh_BKDG.pdf.
3. ↑ "Expert Says NSA Have Backdoors Built Into Intel And AMD Processors". eteknix.com. July 2013. https://www.eteknix.com/expert-says-nsa-have-backdoors-built-into-intel-and-amd-processors/.
4. ↑ Security hole in AMD CPUs' hidden secure processor code revealed ahead of patches, The Register, 2018-01-06, https://www.theregister.co.uk/2018/01/06/amd_cpu_psp_flaw/, retrieved 2018-01-14
5. ↑ "AMD Reportedly Allows Disabling PSP Secure Processor With Latest AGESA". 2017-12-07. https://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-Disable-Option. "This built-in AMD Secure Processor has been criticized by some as another possible attack vector..."
6. ↑ 6.0 6.1 Werling, Christian; Buhren, Robert (24 August 2019) (in en), Dissecting the AMD Platform Security Processor, https://media.ccc.de/v/thms-38-dissecting-the-amd-platform-security-processor#t=91, retrieved 2020-07-26
7. ↑ 7.0 7.1 Cameran, James (2020-03-06). "Dissecting the AMD Platform Security Processor" (in en-US). https://skillsfuturetv.com/dissecting-the-amd-platform-security-processor/.
8. ↑ 8.0 8.1 "Dissecting the AMD Platform Security Processor". 24 August 2019. https://www.youtube.com/watch?v=n9dhHG4tbE0.
9. ↑ "AMD Random Number Generator". AMD. 2017-06-27. https://www.amd.com/system/files/TechDocs/amd-random-number-generator.pdf.
10. ↑ "Security issue found in AMD's Platform Security Processor". 2018-01-08. https://www.scmagazineuk.com/security-issue-found-in-amds-platform-security-processor/article/735414/.
11. ↑ "Security Flaw in AMD's Secure Chip-On-Chip Processor Disclosed Online". 2018-01-06. https://www.bleepingcomputer.com/news/security/security-flaw-in-amds-secure-chip-on-chip-processor-disclosed-online/.
12. ↑ "A raft of flaws in AMD chips makes bad hacks much, much worse". Ars Technica. 2018-03-13. https://arstechnica.com/information-technology/2018/03/a-raft-of-flaws-in-amd-chips-make-bad-hacks-much-much-worse/.
13. ↑ "AMD promises firmware fixes for security processor bugs All bugs require administrative access to exploit". Ars Technica. 2018-03-20. https://arstechnica.com/gadgets/2018/03/amd-promises-firmware-fixes-for-security-processor-bugs/.
14. ↑ "Initial AMD Technical Assessment of CTS Labs Research". AMD Community. 2018-03-21. https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research.
15. ↑ ""AMD Flaws" Technical Summary". 15 March 2018. https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary.
16. ↑ Burke, Steve; Lathan, Patrick (2018-03-13). "Assassination Attempt on AMD by Viceroy Research & CTS Labs, AMD "Should Be $0"". https://www.gamersnexus.net/industry/3260-assassination-attempt-on-amd-by-viceroy-research-cts-labs.
17. ↑ Zynath Investment (2018-03-16). "AMD And CTS Labs: A Story Of Failed Stock Manipulation". https://seekingalpha.com/article/4157242-amd-cts-labs-story-failed-stock-manipulation.

## External links

* AMD Pro Security at AMD

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/AMD Platform Security Processor. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=AMD_Platform_Security_Processor&oldid=4348889"