If you think it's hard to gain physical access to a consumer desktop, you're out of touch. Most desktops aren't locked inside a datacenter. Memory encryption is a valuable desktop (and laptop) security feature.
What we do have is millions of actual, real-world attacks (see any security body's top-ten list) that we aren't mitigating because we're too busy focusing on silly attacks that no-one ever uses.
Doesn't it also protect against rowhammer-like attacks?
I don’t even think its exposed in most BIOS’s
When they were the underdog to Intel, they gave away lots of premium features to beat Intel.
Since they got more popular, AMD has been taking away features, or not upgrading old tech, from their desktop/gaming CPUs: Their DDR5 interface is gimped, being slower than Intel now, and still limited to dual channel. Their chipset link is still PCIe 4x4 the same as two generations ago.
If you want these features now, you need a server product.
1. No dma, instead you use bounce buffers and the cpu manually encrypts and decrypts on behalf of the pcie
2. The IOMMU sets certain pages as unencrypted and ensures the pcie only accesses those pages and that part of ram alone is now not encrypted.
3. Newer pcie devices use the TDISP(handshake) and IDE(aes gcm hardware module related stuff) protocols to do encrypted communication with the CPUs PCIe root hub, where this functionality is called TIO i.e trusted io on amd and TX connect on intel. As far as nvidia GPUs go which is where I have used this, H100 onwards have the feature. Only server xeons and turins etc support this feature on the cpu side. I think some server SSDs do too. Here you get full encryption full DMA at full bandwidth.
I wonder if this was also something they just accidentally broke, or if it was an incompetent attempt at larger segmentation.
AMD Adrenalin, their software that manages things video/GPU features like clip saving, performance settings, game optimizations, update monitoring, performance overlaying, etc - is so fucking bad that if your mouse is set to a refresh rate over 500hz, it is virtually unusable because the mouse cursor takes half a second to respond to inputs. This is running on a card one step down from the flagship, current generation.
Don't even get me started about ROCm on Windows.
Their statement suggests it was a calculated decision, reversed after public backlash. I greatly appreciate they listened to user feedback, but they shouldn't have done it secretly to begin with.
> Based on valuable community feedback, we will reinstate this option in an upcoming BIOS release in July.
Do you know when this was fixed? I recently updated my B650D4U and ended up stuck at 5200MHz instead of 5600MHz. Asrock Rack don't seem to take every update, but I have had luck getting beta releases in the past when I've asked about specific versions.
Looking at Asrock consumer motherboards, it’s been rolled out to some but not all yet. The AGESA for that Asrock rack board looks way behind, so I’d definitely make a request to them to update since the squeaky wheel gets the grease if it’s going to at all.
AMD silently removes memory encryption from consumer Ryzen CPUs
If you want to strip some features from things we bought after the purchasing, you must ask me and every other customers for consents explicitly, with a reasonable explanation, and before the strip happens. If one of us show no consent, you cannot do that.
-------------
See the github issue [1]. @benkilpatrick found out the problem in April. There was absolutely no consent asking information transparency at all. There was inefficient to no information even for people willing to spend THEIR OWN TIME to solve the problem. After about two months of back and forth with motherboard manufacturer, @benkilpatrick found out the problem stems from some components inside the bios, and the components came from AMD. Another ~three weeks passed and no problem resolution at all. It was after things blow up AMD PR came out and said something about "valuable feedback".
Wait, what if there's no enough pushback? What if this github issue as well as the problem it raised is ignored by all? Just see this thread, that thread [2] and whatnot. Is your customers going to screw themselves and being stripped silently for being your customers and believing that new bios will solve their problems without causing shenanigans?
-------------
I won't upgrade bios without future third-party bios integrity checks showing the problem is solved properly.
"It's been disabled on my 7700X with AGESA 1.3.0.1 on an ASUS TUF B650M PLUS WIFI"