Shared in retrocomputing@lemmy.sdf.org 2 months ago

Possible AMD chips that were spychip-free as late as 2016

I’m in the rabbit hole trying to work out which AMD CPUs are spychip free. It’s non-trivial and looks like we cannot draw a line and simply say all successor chips released after that line are spychips.

One rabbit hole begins with this 2014 AMD family: “Kaveri” (2014) & “Godavari” (2015)

Which states:

“Integrated custom ARM Cortex-A5 co-processor[47] with TrustZone Security Extensions[48] in select APU models, except the Performance APU models.[49]”

This implies there are some Kaveri or Godavari CPUs that are spychip free. Footnote 49 links to this AMD sales pitch. Worth noting that someone on the coreboot project also found those same sales presentation slides interesting:

github.com/mikebdp2/coreboot-related/tree/master

Page 12 was cited in the footnote, which shows a claim that “Carrizo” (which describes a whole family of 2016 processors) is the “1st ARM TrustZone Capable Performance APU”. Yet 2013 is widely believed to be when the garbage came. Apparently the keyword is “APU”. If true, then pre-Carrizo (2016) APUs are spychip free, while conventional CPUs were enshitified as early as 2013.

But there could be a nastier nuance here. What is a “performance APU”? Is the word performance important in this context? If yes, then earlier non-performance APUs (whatever that may refer to) could be spy chips.

Anyway, by extension of page 12 info, some would conclude that all the APUs listed for “Kaveri” (2014) & “Godavari” (2015) are spychip free (that is, the processors which include an embedded GPU), but not the CPUs.

No one has mentioned page 22 of that presentation, which states that an AMD A9-9410 which is based on “Stoney Ridge” (2016) does not have “trusted execution security”, which implies no PSP IIUC. Do I understand correctly? Does this mean a 2016 chip based on Excavator does not have the PSP despite Carrizo having it in APUs a year prior? Update: the slide must be wrong. This page asserts that models 60h and later within the 15h family are spychips. That includes Excavator and thus Stoney Ridge, unless there is another exception that’s undocumented.

This article claims we must nix Kaveri and look for prior releases. OTOH, this article claims Kaveri is safe.

I am tempted to conclude that the APU half of Kaveri is safe. But there is another contradiction in Wikipedia. The Kaveri mobile processors are all APUs, and yet Wikipedia claims they are all: “Integrated custom ARM Cortex-A5 co-processor[47] with TrustZone Security Extensions[48]”. Does this go back to the keyword “performance” APUs? Are mobile APUs regarded as non-performance APUs?

(update) We can see that “ro” includes the conventional CPUs within Kaveri as spychip-free:

Steamroller/Kaveri (Desktop APUs)
Athlon X2 450 (2x 3,5 Ghz, 65W)
Athlon X4 840 (4x 3,1 Ghz, 65W)
Athlon X4 860K (4x 3,7 Ghz, 95W)
Athlon X4 870K (4x 3,9 Ghz, 95W)
Athlon X4 880K (4x 4,0 Ghz, 95W)
FX-770K (4x 3,5 Ghz, 65W)

But that’s likely a mistake per the sales slide and exception in the Wikipedia footnote. I would not trust those chips. Actually it’s not that clear cut. Excluding the APUs in that group as PSP does give cause to assume the CPUs have a PSP. Wikipedia lacks a source that attributes any chips in that section to having a PSP. We also don’t know what drives the claim that Kaveri is unsafe in this research… perhaps someone trusting Wikipedia.

(update) Another dicey set of chips: Kabini

If we have confidence in page 12 of the AMD sales slides, then we would trust the performance APUs among the “Kaveri” (2014) & “Godavari” (2015) families, which are based on Steamroller (15h gen3). So naturally we would be tempted to trust older performance APUs like the 2013 ones codenamed “Kabini”.

The wikipedia section for Kabini neglects to mention trustzone, which adds to our confidence. However, the microarchitecture for these chips is Jaguar, which is 16h. 16h is newer than 15h, and rightfully distrusted by “ro”, who spotlights this page which states:

“Please note that Family 16h and Family 15h-Models60h and later contain a PSP but it does not perform the memory initialization.”

Wikipedia claim unsubstantiated – leaves outstanding question on Kaveri. Any mobile APU Kaveri owners reading this?

Since Kaveri is based on Steamroller, which has not been documented to include spy chips, I see no evidence for the Wikipedia claim in this section that there is a PSP. There is footnote 47 and 48, but those are vague. The sources say nothing about which specific chips will have the PSP.

I suppose we need someone with a laptop with one of those mobile APUs in the Kaveri family to try to test or detect a PSP and report back.

It would also help if someone with Wikipedia access would add a citation needed tag.

Update: Corporate boot lickers are ironically thick in this forum

Street-wise consumers phrase the question this way:

“Is there credible evidence that the hardware will serve my best interests as an individual non-corporate user?”

Corporate spokespeople, boot lickers, and convenience¹ addicts spin the question this way:

“Is there credible evidence that an attack has be demonstrated?”

There are two things going on here:

① First they want to do away with the prospect that the closed-source blob does anything intentional that works against the interest of the consumer who owns the CPU. The bias downplays malignment of interests. They shrink the focus to attacks.

② Then they play a game with burden of proof, suggesting the consumer has the burden of proof.

Wise consumers don’t accept that burden. It’s the seller’s burden. It’s the seller’s burden to show us the code. It is the seller’s burden to obtain a 3rd-party audit by infosec researchers. Sellers who neglect that burden can fuck off. AMD has not earned the business of smart consumers post 2013.

Wise consumers are increasingly in short supply. This is why the marketplace is becoming increasingly enshitified. And ultimately in part why retrocomputing is interesting to the small demographic of wise consumers.

(1) Convenience addicts being those who cannot resist fast and cheap - a demographic we don’t expect to find in !retrocomputing@lemmy.sdf.org.

Laptop specs dataset wanted. Would be useful to find 2012—4 Windows 8 era AMD-based laptops.

This follows from my previous thread. I am struggling to find a list of laptops and their CPUs from that time period. Data sources covering that would be appreciated!

In principle, www.notebookcheck.net would be useful. But there are some ad-pushing protectionist motherfuckers behind that site. And 12ft.io is gone (either bullyed offline or could not workaround Google pulling the plug on their caches).

(update) Wow, here is a gem. Do I understand correctly – there are 2025 laptops with a Trinity CPU? (edit) Something seems off… they mention the Ideapad 1 as having the Trinity chip, but this says otherwise. Although “Ideapad 1” is apparently a series.

evenwicht@lemmy.sdf.org

Shared in retrocomputing@lemmy.sdf.org 3 months ago

spychip-free AMD processors from 2013 (update: we don’t really know which chips are spychip-free!)

Linked to https://freundschafter.com/amd-processors-without-amd-psp-secure-technology/

Someone made an effort to work out which are the latest AMD chips that were released just prior to the PSP (iow, they discovered the non-spy chips). The linked article gives a list resulting from their efforts. This is interesting because intel began their spy chips in 2008. So an AMD from 2013 likely well outperforms the last of the spy-chip-free intels.

The author ended with:

Conclusion: You can choose any CPU/APU of the leftmost list to get the „latest“/last CPU without a PSP builtin.

What is meant by “leftmost list”? I just see a single list in my browser. And the sequence seems to be the opposite of what is claimed. Bulldozer seems to be older than Piledriver.

This is also just the 1st step. It would be useful to know which devices contain these AMD chips from 2013. In particular, laptops and mini PCs would be interesting. The search must be painful because ads for hardware tend not to mention the code names. In fact, h/w makers were not proud of their AMD selection and might altogether not mention AMD.

Where do I start? Anyone know which makers of laptops and mini PCs made heavy use of AMD in 2013? Searching for AMD mini pc 2013 gets a lot of hits mentioning “Ryzen”, which did not exist in 2013.

(update) Bulldozer was for the desktop and server markets. So probably safe to assume it would not be found in a mini PC or laptop. Worth noting that in 2025 there were FOSS firmware updates for piledriver and bulldozer.

(update 2) It is strange and annoying that Thinkpad timelines and history pages deceive readers into thinking AMD chips did not appear in Thinkpads until 2017. The 15h.org page reveals that the Thinkpad e545 not only has an AMD chip but it is pre-spychip. Searching specifically for Thinkpad e545 shows this.

(update 3) The author (“ro”) relied heavily on the cpu list in Wikipedia. But Wikipedia is incomplete. E.g. the AMD A4-9120e (code named “Stoney Ridge”) is unknown to wikipedia. It likely has PSP b/c it was designed 5 yrs after the first spy chip. But it’s hard to know what other CPUs were overlooked by Wikipedia around 2013.

(update 4) I’ve lost confidence in the work presented in the linked article. The author states this:

The Steamroller-Family incorporates the CPUs code-named by Kaveri. You could also use the Piledriver architecture with its code-names Trinity and Richland since they are prior to Steamroller.

We are led to believe that all chips based on the steamroller microarchitecture are safe (that is, spychip-free). After some digging, it was initially pleasing to find that some 2015 chips were still based on Steamroller. Which implies we can trust some chips as late as 2015. But in fact wikipedia states Kaveri has “Integrated custom ARM Cortex-A5 co-processor[34] with TrustZone Security Extensions[35]”.

Yikes!

It means we must reject the assumption that a microarchitecture is either wholly with or wholly without the PSP!