8 ms·

How does this work at the lowest level? How does one know that the flashing itself is not being subverted or altered by the microcode? There has to be a level

How does this work at the lowest level? How does one know that the flashing itself is not being subverted or altered by the microcode? There has to be a level below all of the turtles, right?

kabdib 10y ago
You can probably hide evil in a few gates, in the right place. A little additional logic that perturbs an MMU mapping or TLB load, or fail to register an exception if a bit of hardware has seen a recent pattern of behavior. Heck, with a few thousand gates you could have a full microprocessor embedded on the sly. I don't know at what point this stuff becomes noticeable; do you subvert the silicon toolchain? Do you buy off the people who make the masks? Are there feedback loops in the silicon production chain where changes would make it back to a designer, who would say "Hmmm, that's funny..."? In the early 80s it looked possible for a chip designer to stick in Something Bad without much notice. With billion transistor chips, it seems a lot easier. Is there a VHDL equivalent of the Underhanded C contest? :-)
- sp332 10y ago
  How about a single capacitor that isn't even connected to anything? https://news.ycombinator.com/item?id=11768980 https://news.ycombinator.com/item?id=11768980
Dylan16807 10y ago
I don't know how POWER8 sets it up, but it's not particularly hard. You either use an external flash chip, or you set up internal flash so that it can be directly accessed by an external programmer. Then the microcode can't interfere with flashing. This doesn't save you from someone that can custom-fabricate alterations to the CPU, but honestly nothing will save you from that.
- jjnoakes 10y ago
  An external programmer would be connected to some black box though, right? I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU? I'm not trying to be pedantic; I'm simply unsure that the original comment of "The best part of POWER8 is the ability to flash and verify the CPU firmware using a completely open toolchain." and "[For Intel and others] you can't ever be sure what is running on them internally." How does one know that with POWER8 the same isn't true? Just because you think you can flash it "directly" doesn't seem good enough to warrant that statement. (Disclaimer: I have connections to both processors; my opinion on which is "better" or "more open" or "less likely to be compromised" is not stated here, and should not be inferred from this discussion. I'm merely trying to point out that I don't think the original comment's assertion is backed up by the reasoning it presented)
  - Dylan16807 10y ago
    > I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU? Inside which part? I suppose if you're worried about compromises inside the casing, you need to take off the heat spreader and look for yourself. Anything on-die falls under the custom fabrications exception.
    - jjnoakes 10y ago
      Forget custom fabrication; how does one know the real, official fabrication isn't compromised? I mean, the original comment was comparing the openness of POWER8 to the closeness of other processors, using only the ability to flash it openly as evidence, but if one is worried about other processors delivering compromised processors, why isn't one also worried about POWER8 delivering a compromised processor? I guess I don't understand how that's an argument to support "one can't ever be sure what is running on [the others] internally", unless you manufactured the processor yourself from the open design.

How does this work at the lowest level? How does one know that the flashing itself is not being subverted or altered by the microcode? There has to be a level below all of the turtles, right?

kabdib 10y ago

You can probably hide evil in a few gates, in the right place. A little additional logic that perturbs an MMU mapping or TLB load, or fail to register an exception if a bit of hardware has seen a recent pattern of behavior. Heck, with a few thousand gates you could have a full microprocessor embedded on the sly. I don't know at what point this stuff becomes noticeable; do you subvert the silicon toolchain? Do you buy off the people who make the masks? Are there feedback loops in the silicon production chain where changes would make it back to a designer, who would say "Hmmm, that's funny..."? In the early 80s it looked possible for a chip designer to stick in Something Bad without much notice. With billion transistor chips, it seems a lot easier. Is there a VHDL equivalent of the Underhanded C contest? :-)

sp332 10y ago
How about a single capacitor that isn't even connected to anything? https://news.ycombinator.com/item?id=11768980 https://news.ycombinator.com/item?id=11768980

Dylan16807 10y ago

I don't know how POWER8 sets it up, but it's not particularly hard. You either use an external flash chip, or you set up internal flash so that it can be directly accessed by an external programmer. Then the microcode can't interfere with flashing. This doesn't save you from someone that can custom-fabricate alterations to the CPU, but honestly nothing will save you from that.

jjnoakes 10y ago
An external programmer would be connected to some black box though, right? I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU? I'm not trying to be pedantic; I'm simply unsure that the original comment of "The best part of POWER8 is the ability to flash and verify the CPU firmware using a completely open toolchain." and "[For Intel and others] you can't ever be sure what is running on them internally." How does one know that with POWER8 the same isn't true? Just because you think you can flash it "directly" doesn't seem good enough to warrant that statement. (Disclaimer: I have connections to both processors; my opinion on which is "better" or "more open" or "less likely to be compromised" is not stated here, and should not be inferred from this discussion. I'm merely trying to point out that I don't think the original comment's assertion is backed up by the reasoning it presented)
- Dylan16807 10y ago
  > I mean, how do you know the interface the programmer is writing through isn't compromised inside the CPU? Inside which part? I suppose if you're worried about compromises inside the casing, you need to take off the heat spreader and look for yourself. Anything on-die falls under the custom fabrications exception.
  - jjnoakes 10y ago
    Forget custom fabrication; how does one know the real, official fabrication isn't compromised? I mean, the original comment was comparing the openness of POWER8 to the closeness of other processors, using only the ability to flash it openly as evidence, but if one is worried about other processors delivering compromised processors, why isn't one also worried about POWER8 delivering a compromised processor? I guess I don't understand how that's an argument to support "one can't ever be sure what is running on [the others] internally", unless you manufactured the processor yourself from the open design.