Hacker News Reader

Comment by voldacar | Hacker News Reader

I have drooled over the Talos II for quite some time...

Do you have a particular use case that makes POWER make sense over x86, or do you share my paranoia and love of non-mainstream ISAs?

View on HN

Use of GPUs. Not Talos II it seems (?), but with POWER, GPUs are first-class citizens on the system, with NVLink-2-bus access to main memory as the CPU - 150 GB/sec in each direction! (simultaneously!)

Actual GPU use on Talos seems to be problematic from their wiki page. The CUDA use case is supported, but that bandwidth seems too high. Or are you quoting some future number ? The current bandwidth on a P9 system with nvlink is closer to 30 GB/s. And I don't think Talos supports nvlink.

Are all accesses to the memory from the GPU still checked for permissions at the hardware level by an IOMMU?

Yeah, checked for permissions in hardware, but not by an IOMMU. Requests from the GPU are forwarded to the "standard" SMMU. See http://www.ieee-hpec.org/2018/2018program/index_htm_files/13...

I don't especially, because my Talos II is "just" my desktop. I want a computer I can trust and that I know what it's doing from the ground up. It was already the best choice for that and today's announcement made the choice even better.

> I know what it's doing from the ground up

Do you now? There is not even a hidden embedded micro-core running a "secure operating system"?

You can audit the firmware and build it yourself. I did it. Raptor even encourages it: https://wiki.raptorcs.com/wiki/Compiling_Firmware

The biggest problem remaining is whatever blobs are in devices. That's being rapidly worked on.

It's worse than that:

https://lobste.rs/s/noed0h/day_2_keynote_openpower_blows_doo...

You can't trust any modern computer to not be subverted. So, you have to change how you use them. True secrets should be kept out of computers or rooms with technology. Go old school.

> Go old school

OK. How?

Interesting. How do you find it as a desktop? I'd read in reviews that it's incredibly loud, so more suited for datacenter than office or home use, but maybe it's not as bad as I'd gathered?

This is a very early unit (#12) and the initial firmware was indeed deafeningly loud. However, the current firmware is whisper quiet, certainly much quieter than the Quad G5 next to it (and the G5 is throttled down), and I also have super-quiet power supplies installed. I find it perfectly liveable.

I've had a system with two quad-core CPUs running at 100% load under my desk for many days, whisper-quiet.

For me, the biggest problems are the long booting of HosBoot and lack of "suspend to ram"

I share and respect your paranoia. I have a love of inspecting code and not having backdoors in my processor.

For sure. It's nice that open source firmware replacements have been making progress, especially since the Intel ME fiasco, but it never ceases to amaze me that right now you can go out and get a modern, ultra high performance workstation with every single chip running auditable firmware. Hopefully we will start seeing more affordable POWER systems now that it is a fully open architecture

> with every single chip running auditable firmware

But disks? Isn’t their firmware closed?

What you can do with a trusted CPU domain is use FDE. FDE is standard practice for anyone even remotely concerned about security in the first place.

So the firmware that matters -- the firmware that can subvert the system due to privilege level, etc. -- is open. No other vendor aside from some lower end ARM toy SoCs can say that.

Maybe OpenSSD would be functional enough to use:

http://openssd.io

http://www.openssd-project.org/wiki/The_OpenSSD_Project

> But disks? Isn’t their firmware closed?

Encrypt your data in-memory with a file system feature (or something like LUKS/dm-crypt) before it's sent down the SATA cable to the disk.

The NSA has gone after disk firmware:

* https://www.theregister.co.uk/2015/02/17/kaspersky_labs_equa...

Ugh I guess there always has to be an exception. Maybe you could run everything in a ramdisk? It supports up to 2TB of ram after all

Isn't the price tag pretty amazing too?

Well yeah it is hardly cheap but for the people who can afford it, I totally get how having a computer you can trust is worth the price tag

Most people won't pay that kind of money just to tinker with it.

> Most people won't pay that kind of money just to tinker with it.

The interesting question rather is: how many of these simply cannot afford it and how many think that this is not worth it?

I looked at the Talos website. They're asking 2-4k$ for a 4 core (4 way SMT, so let's say 8 core when comparing to x86_64 just to be nice) dev desktop, with 8 to 16 GB ram. The same spend on a Dell Xeon workstation nets quite a bit more hardware.

While not exactly cheap in absolute terms, there is the Blackbird from Raptor. It's a single-CPU board, cheaper than Talos.

I wouldn't drool over it. See the latest benchmarks comparing it to epyc and Intel. Power9 does pretty poorly throughout almost every test:

https://www.phoronix.com/scan.php?page=article&item=rome-pow...

Both of those processors insist on you ceding full system control to the vendor in perpetuity, with a literal "skeleton key" that let's the vendor in and keeps you out (the centrally signed, unremovable ME/PSP). If this doesn't concern you, then why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware? Unless you're loading the local machine 24/7, you're leaving a resource sitting idle for parts of the day without any real increase in security or control, meaning the cloud vendor can give you a cheaper experience overall by keeping hardware utilization over time high.

And no, ME cleaner does NOT (and cannot) fully remove a modern ME. The PSP "disable" toggle in the UEFI configuration does NOT disable the PSP from running during startup.

> why are you looking at a local machine at all when a cloud system may very well be less expensive to lease than to purchase and keep current, not to mention run, local hardware?

Because a cloud machine is rented and not owned. And because of the ping latency: there is a reason why there is for example still hardly any cloud gaming.

And what exactly do you call a machine that you are, by design, cryptographically locked out of, but a third party has access to?

Put another way, would you call a car that I kept duplicate keys and retained title for, but said you could use and maintain at your sole expense for a single upfront payment, rented or owned?

Latency is being solved, Google etc. are working that problem. I'm playing devils advocate here, but fundamentally if you don't care about actually controlling or being able to modify something, and pricing is cheaper to rent, why own?

> And what exactly do you call a machine that you are, by design, cryptographically locked out of, but a third party has access to?

Not a perfect solution, but such a problem can be mitigated by a firewall that blocks such ingoing/outgoing packets.

> I'm playing devils advocate here, but fundamentally if you don't care about actually controlling or being able to modify something, and pricing is cheaper to rent, why own?

Since I love to tinker with my computers, the answer is obvious to me.

I think this is apples and oranges. Sure, if those kinds of things are that important to you, then POWER9 is your only option. But if performance is important, POWER9 is a longshot from being the best. Most companies likely don't care about the things you're suggesting.

My understanding is that it is not really useful to compare Power9 to other cpus in these types of benchmarks, that Power9 is all about computation with massive datasets, not how fast it can zip a file.

> My understanding is that it is not really useful to compare Power9 to other cpus in these types of benchmarks, that Power9 is all about computation with massive datasets, not how fast it can zip a file.

Your understanding is wrong. For instance, running Java workloads on servers is a major Power9 use case.

The thing to remember, though, is that the Talos is only two four-core CPUs, for eight total. These benchmarks are comparing it to the Epyc 7742, which is a 64 core chip.

Naturally the Epyc will kill it on most highly threaded benchmarks. The individual cores on Power9 are quite fast, though.

> The individual cores on Power9 are quite fast, though.

Are there any benchmarks for single thread performance there that I could see ?

Reply on news.ycombinator.com