Hacker News Reader

The high idle voltage was explained on reddit by AMD — The final word on idle voltages for 3rd Gen ryzen https://reddit.com/r/Amd/comments/cbls9g/the_final_word_on_i...

RDRAND fix from AMD is apparently out to motherboard manufacturers already. Hopefully it doesn't take them long to release an update.

https://www.phoronix.com/scan.php?page=news_item&px=AMD-Rele...

>1. RDRAND returns -1 (and sets the carry bit meaning it thinks -1 is a random number). Supposedly this will be fixed in a BIOS update (which makes me think it's an intended mode wrongly turned on... a backdoor?)

Yet more evidence not to trust hardware random number generators.

I'm very surprised that something like that even makes it into production. You'd think processor manufacturers would have an extensive set of test cases, at least one for each instruction...

I remember reading somewhere that, for a long time, Intel's "test cases" basically consisted of all the operating systems they could find, going back to MS-DOS 1.0 and including some more obscured ones, as well as tons of other third-party software.

Unfortunately it seems this new generation no longer follows the "NEVER break backwards compatibility" principle that made the PC such a great platform, and as a result we're seeing hardware/software/firmware that's increasingly buggy and divergent. It used to be the case that if a new processor couldn't run existing software (even that which depended on undocumented but constant behaviour) unmodified, it was a fatal flaw.

Everything on a CPU is subject to heavy validation .. but I bet the random number generator is exempt, because by definition it's not deterministic. It's more like a peripheral "listening" to randomness.

https://www.amd.com/system/files/TechDocs/amd-random-number-...

> "The RNG uses 16 separate ring oscillator chains as a noise source. Each chain consists of a different prime number of inverters in a free-running configuration which capture natural clock jitter"

So it's (deliberately) dependent on natural manufacturing variation in the silicon, and in any deterministic simulator won't produce random numbers. It also takes a while to start; it's possible that the startup conditions are bad such that "a while" turns out to be "forever".

Probably still worth checking that it doesn't return -1 every time.

Infinity of -1's is a valid random sequence, just saying.

They have way, way more than test cases. The logic synthesis, simulation, verification, and validation capabilities of top tier EDA tools are incredible.

The problem is as it always is with these kinds of things. They help assure that you can measure your model and your implementation of that model. They're much less capable of determining you've got the right model to begin with. That part is still up to the humans.

The state of commonplace capabilities for testing and verification of software is extremely far behind that of hardware. For a variety of economic, cultural, and use case incentives reasons.

This should teach systemd developers and other idiots who blindly use rdrand a lesson not to trust it.

Can you please follow the site guidelines when posting here?

https://news.ycombinator.com/newsguidelines.html

Have you read systemd's code comments regarding rdrand? It's quite a reasonable explanation

I have just read it. Well I have to say it's quite a reasonable.

https://github.com/systemd/systemd/blob/f90bcf8679e870878829...

"In such an environment using getrandom() synchronously means we'd block the entire system boot-up until the pool is initialized, i.e. very long."

How long is very long? 100ms, or 10s?

Debian buster VM on an old CPU without RDRAND takes about 5 minutes for the kernel crng init to complete and for sshd to start accepting connections. Stracing the sshd process shows that it's indeed blocked on `getrandom()`.

In some ways, it's very much WONTFIX because something like sshd might actually need the entropy. I'm glad that systemd has proper workarounds implemented so that the machine actually boots out of the box, though.

"It is very common that initialization of the random pool takes a longer time (up to many minutes..."

And it's my experience, too. It's one reason to install something like haveged. I had boot delays in the range of minutes, without it.

> So, you are a "security researcher", and you wonder why we bother

Oh, the art of insulting the audience in the first line of a message intended for them. And it ends up being the person you'd expect to write it.

First you call people idiots and then you say it’s reasonable without apology. Classic.

I still believe we shall never relies on rdrand because we cannot trust the hardware RNG implementation. For me, anybody who use rdrand a idiot unless it's a video game. I said "reasonable" for their argument. I do not agree with them.

I was wrong about point 2 being a spec issue. Linux just needed to be told "yes, this is one of those": https://github.com/groeck/k10temp/issues/12

Thanks for the info; I'd be interested to see a /proc/cpuinfo (just one core) from a Linux from one of these beasts. I've not seen any published.

  processor : 15
  vendor_id : AuthenticAMD
  cpu family : 23
  model  : 113
  model name : AMD Ryzen 7 3700X 8-Core Processor
  stepping : 0
  microcode : 0x8701013
  cpu MHz  : 1863.008
  cache size : 512 KB
  physical id : 0
  siblings : 16
  core id  : 7
  cpu cores : 8
  apicid  : 15
  initial apicid : 15
  fpu  : yes
  fpu_exception : yes
  cpuid level : 16
  wp  : yes
  flags  : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb cat_l3 cdp_l3 hw_pstate sme ssbd mba sev ibpb stibp vmmcall fsgsbase bmi1 avx2 smep bmi2 cqm rdt_a rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local clzero irperf xsaveerptr wbnoinvd arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif umip rdpid overflow_recov succor smca
  bugs  : sysret_ss_attrs spectre_v1 spectre_v2 spec_store_bypass
  bogomips : 7189.14
  TLB size : 3072 4K pages
  clflush size : 64
  cache_alignment : 64
  address sizes : 43 bits physical, 48 bits virtual
  power management: ts ttp tm hwpstate cpb eff_freq_ro [13] [14]

One advantage of AMD over Intel is AMD included SHA hardware acceleration on every Ryzen processor.

I actually wrote up about this back in 2017 [0]; the general feeling in the community at the time was that it would be “right around the corner” from Intel, but that hasn’t really happened.

[0]: https://neosmart.net/blog/2017/will-amds-ryzen-finally-bring...

A lot of software is compiled for very generic CPUs, I wouldn't be surprised if it's not used in many cases.

That's not how things are done. Practically every library that has optimized implementations for stuff selects the implementation at runtime based on CPUID.

Exactly, assuming optimized implementations in libraries, that's not always the case and binaries compiled just exactly for the one CPU tend to perform better.

Don't know why the downvotes, do people think optimized implementations utilizing certain CPU features or combinations of them are somehow super common?

People think that because it is correct. Any serious crypto library (libsodium, OpenSSL, crypto++, cryptlib, ...) that comes to mind uses this approach, codecs use it, your C standard library uses it etc.

But there's many other libraries out there than just those though?

"One advantage of AMD over Intel is AMD included SHA hardware acceleration on every Ryzen processor."

What do you think is more common? People rolling their own SHA implementation or people calling <insert crypto library>'s SHA256()? The former will barely get any sort of optimization, regardless of compiler flags, the latter will automatically use the SHA extensions.

You indeed have a point about SHA extensions and people predominantly using a good crypto library, I guess I should've been more verbose that I meant new extensions in-general being a bit underutilized.

SHA hardware acceleration is more likely to be used in SSH and some deduplication set ups, as well as git. It isn’t that much of a plus.

Thanks! Lots of flags....

Zen 1 (Naples) had all kinds of problems including that frequency scaling would hang the machine. It seems wise to not buy the VERY first Zen 2 rig.

> don't overshadow the price-performance success of these processors.

The choice is easy: pay more for intel and 'It Just Works (tm)' or pay less for amd and fight with issues.

And it's great.

> 'It Just Works

Well, apart from the major cloud-breaking side-channel security issues.