News for hackers. Stuff that matters.

A comment on Assessing IBM's POWER8, Part 1: A Low Level Look at Little Endian.

Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by superkuh on Thursday July 21, 2016 @10:19PM (#12141333)
The best part of POWER8 is the ability to flash and verify the CPU firmware using a completely open toolchain. All modern Intel and AMD processors have secret sauce signed firmware (that can even access and use the network). You can't ever be sure what is running on them internally. POWER8 is a secure architecture even in the case of an NSA targeted hardware intercept during shipping. You can just reflash with known/verified good firmware when you get it.
[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by jjnoakes on Thursday July 21, 2016 @10:42PM (#12141414)
How does this work at the lowest level? How does one know that the flashing itself is not being subverted or altered by the microcode?

There has to be a level below all of the turtles, right?

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by kabdib on Thursday July 21, 2016 @10:52PM (#12141450)
You can probably hide evil in a few gates, in the right place. A little additional logic that perturbs an MMU mapping or TLB load, or fail to register an exception if a bit of hardware has seen a recent pattern of behavior. Heck, with a few thousand gates you could have a full microprocessor embedded on the sly.

I don't know at what point this stuff becomes noticeable; do you subvert the silicon toolchain? Do you buy off the people who make the masks? Are there feedback loops in the silicon production chain where changes would make it back to a designer, who would say "Hmmm, that's funny..."?

In the early 80s it looked possible for a chip designer to stick in Something Bad without much notice. With billion transistor chips, it seems a lot easier.

Is there a VHDL equivalent of the Underhanded C contest? :-)

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by sp332 on Thursday July 21, 2016 @11:12PM (#12141504)
How about a single capacitor that isn't even connected to anything? https://news.ycombinator.com/item?id=11768980
[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by Dylan16807 on Friday July 22, 2016 @03:09AM (#12142174)
I don't know how POWER8 sets it up, but it's not particularly hard. You either use an external flash chip, or you set up internal flash so that it can be directly accessed by an external programmer. Then the microcode can't interfere with flashing.

This doesn't save you from someone that can custom-fabricate alterations to the CPU, but honestly nothing will save you from that.

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by jjnoakes on Friday July 22, 2016 @10:54AM (#12143883)
An external programmer would be connected to some black box though, right? I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU?

I'm not trying to be pedantic; I'm simply unsure that the original comment of "The best part of POWER8 is the ability to flash and verify the CPU firmware using a completely open toolchain." and "[For Intel and others] you can't ever be sure what is running on them internally."

How does one know that with POWER8 the same isn't true? Just because you think you can flash it "directly" doesn't seem good enough to warrant that statement.

(Disclaimer: I have connections to both processors; my opinion on which is "better" or "more open" or "less likely to be compromised" is not stated here, and should not be inferred from this discussion. I'm merely trying to point out that I don't think the original comment's assertion is backed up by the reasoning it presented)

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by Dylan16807 on Friday July 22, 2016 @03:47PM (#12146268)
> I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU?

Inside which part? I suppose if you're worried about compromises inside the casing, you need to take off the heat spreader and look for yourself.

Anything on-die falls under the custom fabrications exception.

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by jjnoakes on Friday July 22, 2016 @04:00PM (#12146351)
Forget custom fabrication; how does one know the real, official fabrication isn't compromised? I mean, the original comment was comparing the openness of POWER8 to the closeness of other processors, using only the ability to flash it openly as evidence, but if one is worried about other processors delivering compromised processors, why isn't one also worried about POWER8 delivering a compromised processor?

I guess I don't understand how that's an argument to support "one can't ever be sure what is running on [the others] internally", unless you manufactured the processor yourself from the open design.

[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by ashitlerferad on Friday July 22, 2016 @02:28AM (#12142030)
Got a link to the source code of the POWER8 CPU firmware?
[ Parent | on HN ]
Re:Assessing IBM's POWER8, Part 1: A Low Level Look at Littl... by ajdlinux on Friday July 22, 2016 @03:21AM (#12142208)
https://github.com/open-power/skiboot (runtime firmware)

https://github.com/open-power/hostboot (initialisation firmware)

https://github.com/open-power/occ (on-chip controller firmware)

https://github.com/openbmc (BMC - currently in development!)

[Disclaimer: IBMer, opinions my own.]

[ Parent | on HN ]