AMD Publishes SEV Firmware As Open-Source

[phoronix]

Phoronix: AMD Publishes SEV Firmware As Open-Source

While I have been eagerly following the AMD openSIL project for open-source CPU initialization that will eventually replace AGESA, today AMD announced a new open-source firmware drop: the SEV firmware has been made open-source...

https://www.phoronix.com/news/AMD-SEV-Firmware-Open-Source

[Lbibass]

Sweet. Glad to see it. Openness in firmware is always a good move.

[aviallon]

Phoronix: AMD Publishes SEV Firmware As Open-Source

While I hav been eagerly following the AMD openSIL project for open-source CPU initialization that will eventually replace AGESA, today AMD announced a new open-source firmware drop: the SEV firmware has been made open-source...

https://www.phoronix.com/news/AMD-SE...re-Open-Source

Michael you should probably change the title to "... As Source Available"

[shmerl]

Yeah, source available but not as formally what's understood as open source. Still better than nothing for security research. Not clear if it allows modified versions to be used legally even if they don't accept contributions.

[Old Grouch]

For this to be maximally useful, you need to be able to do a reproducible build to verify that the binary you get from AMD is built from this source, or replace the AMD-supplied binary with your own compiled from the public source.

[Inopia]

Open source but not free software, still a very welcome and appreciated move from AMD 👏👏👏

[hlandau]

This is not open source. It is licenced under a proprietary source-available licence: https://github.com/amd/AMD-ASPFW/blob/main/LICENSE.md

Originally I thought this was a mistake, but the proprietary licence is explicitly mentioned on the above page, so I'm confused why this is being headlined as "open source".

This is firmware which runs on the AMD PSP, the equivalent of Intel's ME and controls AMD SEV. Unfortunately this makes little difference because this firmware is, like the Intel ME, Tivoised - AMD CPUs will only run a PSP firmware image signed by AMD.

This means that while this source code has been made available, you can't actually compile it yourself or use it on your computer. It doesn't give you the freedom to modify the software, which is what open source is supposed to do. In short, this doesn't actually move things any closer to actually be able to have fully FOSS firmware on a PC, or to allow use of e.g. Libreboot with modern AMD systems.

About the only thing this enables is security researchers to audit this code for AMD (for free, I suppose), while not actually giving people any more control over their own computers. Also note that this isn't even all the firmware which runs on the PSP, just part of it, and it seems unlikely it can be properly audited without access to the rest of the code it links to. I assume they won't release the rest of the code due to its involvement in DRM schemes. There's not even a build system included - they're not expecting anyone to actually be able to build this at all.

In short, this doesn't actually advance things at all towards having open source firmware for an x86 machine.

[NeoMorpheus]

AMD offers/publishes/supports open source: Negative comments.

Ngreedia keeps treating Linux like shit: Forums members keeps giving them money and free passes.

[ayumu]

It is worth noting though that the firmware isn't under a traditional open-source license and they will not be accepting community contributions, but the source is mostly there for independent analysis purposes.

Michael, what this means is that it isn't Open Source. The headline is wrong.

Open Source is something very specific, defined by the OSI. The requirements are functionally the same as GNU's Free Software 4 freedoms.

Open source but not free software, still a very welcome and appreciated move from AMD 👏👏👏

Not open source. At most, "source available for public view". Like Microsoft's "shared source".

[GreenReaper]

While I agree that the title is misleading, different understandings on what "open source" actually means is one of the reasons it's a bad idea to use it if you actually mean "available to use under a free licence".