8 ms·

I have drooled over the Talos II for quite some time... Do you have a particular use case that makes POWER make sense over x86, or do you share my paranoia and

I have drooled over the Talos II for quite some time... Do you have a particular use case that makes POWER make sense over x86, or do you share my paranoia and love of non-mainstream ISAs?

kop316 7y ago
I share and respect your paranoia. I have a love of inspecting code and not having backdoors in my processor.
- voldacar 7y ago
  For sure. It's nice that open source firmware replacements have been making progress, especially since the Intel ME fiasco, but it never ceases to amaze me that right now you can go out and get a modern, ultra high performance workstation with every single chip running auditable firmware. Hopefully we will start seeing more affordable POWER systems now that it is a fully open architecture
  - acqq 7y ago
    > with every single chip running auditable firmware But disks? Isn’t their firmware closed?
    - voldacar 7y ago
      Ugh I guess there always has to be an exception. Maybe you could run everything in a ramdisk? It supports up to 2TB of ram after all
    - justinclift 7y ago
      Maybe OpenSSD would be functional enough to use: http://openssd.io http://openssd.io http://www.openssd-project.org/wiki/The_OpenSSD_Project http://www.openssd-project.org/wiki/The_OpenSSD_Project
    - tpearson-raptor 7y ago
      What you can do with a trusted CPU domain is use FDE. FDE is standard practice for anyone even remotely concerned about security in the first place. So the firmware that matters -- the firmware that can subvert the system due to privilege level, etc. -- is open. No other vendor aside from some lower end ARM toy SoCs can say that.
    - throw0101a 7y ago
      > But disks? Isn’t their firmware closed? Encrypt your data in-memory with a file system feature (or something like LUKS/dm-crypt) before it's sent down the SATA cable to the disk. The NSA has gone after disk firmware: * https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa...
  - marmaduke 7y ago
    Isn't the price tag pretty amazing too?
    - voldacar 7y ago
      Well yeah it is hardly cheap but for the people who can afford it, I totally get how having a computer you can trust is worth the price tag
      - Annatar 7y ago
        Most people won't pay that kind of money just to tinker with it.
        wolfgke 7y ago
        > Most people won't pay that kind of money just to tinker with it. The interesting question rather is: how many of these simply cannot afford it and how many think that this is not worth it?
        marmaduke 7y ago
        I looked at the Talos website. They're asking 2-4k$ for a 4 core (4 way SMT, so let's say 8 core when comparing to x86_64 just to be nice) dev desktop, with 8 to 16 GB ram. The same spend on a Dell Xeon workstation nets quite a bit more hardware.
    - avhception 7y ago
      While not exactly cheap in absolute terms, there is the Blackbird from Raptor. It's a single-CPU board, cheaper than Talos.
classichasclass 7y ago
I don't especially, because my Talos II is "just" my desktop. I want a computer I can trust and that I know what it's doing from the ground up. It was already the best choice for that and today's announcement made the choice even better.
- Koshkin 7y ago
  > I know what it's doing from the ground up Do you now? There is not even a hidden embedded micro-core running a "secure operating system"?
  - classichasclass 7y ago
    You can audit the firmware and build it yourself. I did it. Raptor even encourages it: https://wiki.raptorcs.com/wiki/Compiling_Firmware https://wiki.raptorcs.com/wiki/Compiling_Firmware The biggest problem remaining is whatever blobs are in devices. That's being rapidly worked on.
  - nickpsecurity 7y ago
    It's worse than that: https://lobste.rs/s/noed0h/day_2_keynote_openpower_blows_doors_off#c_ikzyeu https://lobste.rs/s/noed0h/day_2_keynote_openpower_blows_doo... You can't trust any modern computer to not be subverted. So, you have to change how you use them. True secrets should be kept out of computers or rooms with technology. Go old school.
    - tempguy9999 7y ago
      > Go old school OK. How?
- _delirium 7y ago
  Interesting. How do you find it as a desktop? I'd read in reviews that it's incredibly loud, so more suited for datacenter than office or home use, but maybe it's not as bad as I'd gathered?
einpoklum 7y ago
Use of GPUs. Not Talos II it seems (?), but with POWER, GPUs are first-class citizens on the system, with NVLink-2-bus access to main memory as the CPU - 150 GB/sec in each direction! (simultaneously!)
- madez 7y ago
  Are all accesses to the memory from the GPU still checked for permissions at the hardware level by an IOMMU?
  - rrss 7y ago
    Yeah, checked for permissions in hardware, but not by an IOMMU. Requests from the GPU are forwarded to the "standard" SMMU. See http://www.ieee-hpec.org/2018/2018program/index_htm_files/135.pdf http://www.ieee-hpec.org/2018/2018program/index_htm_files/13...
- bubblethink 7y ago
  Actual GPU use on Talos seems to be problematic from their wiki page. The CUDA use case is supported, but that bandwidth seems too high. Or are you quoting some future number ? The current bandwidth on a P9 system with nvlink is closer to 30 GB/s. And I don't think Talos supports nvlink.
shaklee3 7y ago
I wouldn't drool over it. See the latest benchmarks comparing it to epyc and Intel. Power9 does pretty poorly throughout almost every test: https://www.phoronix.com/scan.php?page=article&item=rome-power9-arm&num=1 https://www.phoronix.com/scan.php?page=article&item=rome-pow...
- tpearson-raptor 7y ago
  Both of those processors insist on you ceding full system control to the vendor in perpetuity, with a literal "skeleton key" that let's the vendor in and keeps you out (the centrally signed, unremovable ME/PSP). If this doesn't concern you, then why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware? Unless you're loading the local machine 24/7, you're leaving a resource sitting idle for parts of the day without any real increase in security or control, meaning the cloud vendor can give you a cheaper experience overall by keeping hardware utilization over time high. And no, ME cleaner does NOT (and cannot) fully remove a modern ME. The PSP "disable" toggle in the UEFI configuration does NOT disable the PSP from running during startup.
  - wolfgke 7y ago
    > why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware? Because a cloud machine is rented and not owned. And because of the ping latency: there is a reason why there is for example still hardly any cloud gaming.
    - tpearson-raptor 7y ago
      And what exactly do you call a machine that you are, by design, cryptographically locked out of, but a third party has access to? Put another way, would you call a car that I kept duplicate keys and retained title for, but said you could use and maintain at your sole expense for a single upfront payment, rented or owned? Latency is being solved, Google etc. are working that problem. I'm playing devils advocate here, but fundamentally if you don't care about actually controlling or being able to modify something, and pricing is cheaper to rent, why own?

I have drooled over the Talos II for quite some time... Do you have a particular use case that makes POWER make sense over x86, or do you share my paranoia and love of non-mainstream ISAs?

kop316 7y ago

I share and respect your paranoia. I have a love of inspecting code and not having backdoors in my processor.

voldacar 7y ago
For sure. It's nice that open source firmware replacements have been making progress, especially since the Intel ME fiasco, but it never ceases to amaze me that right now you can go out and get a modern, ultra high performance workstation with every single chip running auditable firmware. Hopefully we will start seeing more affordable POWER systems now that it is a fully open architecture
- acqq 7y ago
  > with every single chip running auditable firmware But disks? Isn’t their firmware closed?
  - voldacar 7y ago
    Ugh I guess there always has to be an exception. Maybe you could run everything in a ramdisk? It supports up to 2TB of ram after all
  - justinclift 7y ago
    Maybe OpenSSD would be functional enough to use: http://openssd.io http://openssd.io http://www.openssd-project.org/wiki/The_OpenSSD_Project http://www.openssd-project.org/wiki/The_OpenSSD_Project
  - tpearson-raptor 7y ago
    What you can do with a trusted CPU domain is use FDE. FDE is standard practice for anyone even remotely concerned about security in the first place. So the firmware that matters -- the firmware that can subvert the system due to privilege level, etc. -- is open. No other vendor aside from some lower end ARM toy SoCs can say that.
  - throw0101a 7y ago
    > But disks? Isn’t their firmware closed? Encrypt your data in-memory with a file system feature (or something like LUKS/dm-crypt) before it's sent down the SATA cable to the disk. The NSA has gone after disk firmware: * https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equation_group/ https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa...
- marmaduke 7y ago
  Isn't the price tag pretty amazing too?
  - voldacar 7y ago
    Well yeah it is hardly cheap but for the people who can afford it, I totally get how having a computer you can trust is worth the price tag
    - Annatar 7y ago
      Most people won't pay that kind of money just to tinker with it.
      - wolfgke 7y ago
        > Most people won't pay that kind of money just to tinker with it. The interesting question rather is: how many of these simply cannot afford it and how many think that this is not worth it?
        marmaduke 7y ago
        I looked at the Talos website. They're asking 2-4k$ for a 4 core (4 way SMT, so let's say 8 core when comparing to x86_64 just to be nice) dev desktop, with 8 to 16 GB ram. The same spend on a Dell Xeon workstation nets quite a bit more hardware.
  - avhception 7y ago
    While not exactly cheap in absolute terms, there is the Blackbird from Raptor. It's a single-CPU board, cheaper than Talos.

classichasclass 7y ago

I don't especially, because my Talos II is "just" my desktop. I want a computer I can trust and that I know what it's doing from the ground up. It was already the best choice for that and today's announcement made the choice even better.

Koshkin 7y ago
> I know what it's doing from the ground up Do you now? There is not even a hidden embedded micro-core running a "secure operating system"?
- classichasclass 7y ago
  You can audit the firmware and build it yourself. I did it. Raptor even encourages it: https://wiki.raptorcs.com/wiki/Compiling_Firmware https://wiki.raptorcs.com/wiki/Compiling_Firmware The biggest problem remaining is whatever blobs are in devices. That's being rapidly worked on.
- nickpsecurity 7y ago
  It's worse than that: https://lobste.rs/s/noed0h/day_2_keynote_openpower_blows_doors_off#c_ikzyeu https://lobste.rs/s/noed0h/day_2_keynote_openpower_blows_doo... You can't trust any modern computer to not be subverted. So, you have to change how you use them. True secrets should be kept out of computers or rooms with technology. Go old school.
  - tempguy9999 7y ago
    > Go old school OK. How?
_delirium 7y ago
Interesting. How do you find it as a desktop? I'd read in reviews that it's incredibly loud, so more suited for datacenter than office or home use, but maybe it's not as bad as I'd gathered?

einpoklum 7y ago

Use of GPUs. Not Talos II it seems (?), but with POWER, GPUs are first-class citizens on the system, with NVLink-2-bus access to main memory as the CPU - 150 GB/sec in each direction! (simultaneously!)

madez 7y ago
Are all accesses to the memory from the GPU still checked for permissions at the hardware level by an IOMMU?
- rrss 7y ago
  Yeah, checked for permissions in hardware, but not by an IOMMU. Requests from the GPU are forwarded to the "standard" SMMU. See http://www.ieee-hpec.org/2018/2018program/index_htm_files/135.pdf http://www.ieee-hpec.org/2018/2018program/index_htm_files/13...
bubblethink 7y ago
Actual GPU use on Talos seems to be problematic from their wiki page. The CUDA use case is supported, but that bandwidth seems too high. Or are you quoting some future number ? The current bandwidth on a P9 system with nvlink is closer to 30 GB/s. And I don't think Talos supports nvlink.

shaklee3 7y ago

I wouldn't drool over it. See the latest benchmarks comparing it to epyc and Intel. Power9 does pretty poorly throughout almost every test: https://www.phoronix.com/scan.php?page=article&item=rome-power9-arm&num=1 https://www.phoronix.com/scan.php?page=article&item=rome-pow...

tpearson-raptor 7y ago
Both of those processors insist on you ceding full system control to the vendor in perpetuity, with a literal "skeleton key" that let's the vendor in and keeps you out (the centrally signed, unremovable ME/PSP). If this doesn't concern you, then why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware? Unless you're loading the local machine 24/7, you're leaving a resource sitting idle for parts of the day without any real increase in security or control, meaning the cloud vendor can give you a cheaper experience overall by keeping hardware utilization over time high. And no, ME cleaner does NOT (and cannot) fully remove a modern ME. The PSP "disable" toggle in the UEFI configuration does NOT disable the PSP from running during startup.
- wolfgke 7y ago
  > why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware? Because a cloud machine is rented and not owned. And because of the ping latency: there is a reason why there is for example still hardly any cloud gaming.
  - tpearson-raptor 7y ago
    And what exactly do you call a machine that you are, by design, cryptographically locked out of, but a third party has access to? Put another way, would you call a car that I kept duplicate keys and retained title for, but said you could use and maintain at your sole expense for a single upfront payment, rented or owned? Latency is being solved, Google etc. are working that problem. I'm playing devils advocate here, but fundamentally if you don't care about actually controlling or being able to modify something, and pricing is cheaper to rent, why own?