AMD's Future in Servers: New 7000-Series CPUs Launched and EPYC Analysis
by Ian Cutress on June 20, 2017 4:00 PM EST- Posted in
- CPUs
- AMD
- Enterprise CPUs
- EPYC
- Whitehaven
- 1P
- 2P
With recent fears about security, and given that these processors are aiming to go to the Enterprise space, AMD had to dedicate some time to explaining how secure the new platform is. AMD has had its Secure Processor in several CPUs at this point: a 32-bit ARM Cortex-A5 acting as a microcontroller that runs a secure OS/kernel with secure off-chip storage for firmware and data – this helps provide cryptographic functionality for secure key generation and key management. This starts with hardware validated boot (TPM), but includes Secure Memory Encryption and Secure Encrypted Virtualization.
Encryption starts at the DRAM level, with an AES-128 engine directly attached to the MMU. This is designed to protect against physical memory attacks, with each VM and Hypervisor able to generate a separate key for their environment. The OS or Hypervisor can choose which pages to encrypt via page tables, and the DMA engines can provide support for external devices such as network storage and graphics cards to access encrypted pages.
Because each VM or container can obtain its own encryption key, this isolates them from each other, protecting against cross-contamination. It also allows unencrypted VMs to run alongside encrypted ones, removing the all-or-nothing scenario. The keys are transparent to the VMs themselves, managed by the protected hypervisor. It all integrates with existing AMD-V technology.
Alongside this are direct RAS features in the core, with the L1 data cache using SEC-DED ECC and L2/L3 caches using DEC-TED ECC. The DRAM support involves x4 DRAM device failure correction with addr/cmd parity and write CRC with replay. Data poisoning is handled with reporting and a machine check recovery mode. The Infinity Fabric between dies and between sockets is also link-packet CRC backed with retry.
One element that was not discussed is live VM migration across encrypted environments. We fully suspect that an AMD-to-AMD live migration be feasible, although an AMD-to-Intel or Intel-to-AMD will have issues, given that each microarchitecture has unique implementations of certain commands.
Facebook
Twitter
RSS
131 Comments
View All Comments
patrickjp93 - Wednesday, June 21, 2017 - link
And Intel's ability to optimise exceeding LLVM's and GCC's is certainly not cheating. Perhaps Google, Apple, Microsoft, and GNU could catch up instead of bitching.deltaFx2 - Thursday, June 22, 2017 - link
"And Intel's ability to optimise exceeding LLVM's and GCC's" Complete and utter strawman. Nobody's questioning that icc is a good compiler. Plenty in HPC pay good money for icc. It's not nearly as good as SPEC suggests though because of stuff that is pretty much if (signature of libq, mcf, etc detected) { special codepath that nobody else uses/needs }. At issue is not whether icc is a better compiler but whether icc is also a fair compiler to use on benchmarks like SPEC. It's not, thanks to Intel's shenanigans with the compiler. The reason llvm and gcc don't have this is because they're not interested in selling chips (which intel is); they're interested in improving the average workload. Special casing libquantum doesn't align with those priorities.Luckz - Wednesday, June 21, 2017 - link
So they've only been cheating in the decade or so before, and they've been saints for 3 years, except they cheat at libquantum to inflate their SPEC scores, purely on merit. Yeah.willis936 - Tuesday, June 20, 2017 - link
Just wow. Finally a chip worthy of the "HEDT" moniker.nevcairiel - Tuesday, June 20, 2017 - link
Except its not anything like that. Its a server chip, not any end of the desktop/workstation spectrum.Gothmoth - Tuesday, June 20, 2017 - link
well at work i have a two socket system under my desk that uses server CPU´s.vanilla_gorilla - Tuesday, June 20, 2017 - link
>well at workYou mean like a work ... station with a workstation class CPU?
Drumsticks - Wednesday, June 21, 2017 - link
Probably, meaning exactly the kind of chip that nevcairel (who gothmoth replied to) implied that it wasn't.spikebike - Tuesday, June 20, 2017 - link
This is a server chip, likely not as nice to use as a HEDT targeted chip like threadripper. The threadripper is likely to have fewer cores, faster clocks, and half the memory bandwidth... but more cores, and double the bandwidth of the Ryzen.vision33r - Wednesday, June 21, 2017 - link
Typical novice user response that more is better.