With recent fears about security, and given that these processors are aiming to go to the Enterprise space, AMD had to dedicate some time to explaining how secure the new platform is. AMD has had its Secure Processor in several CPUs at this point: a 32-bit ARM Cortex-A5 acting as a microcontroller that runs a secure OS/kernel with secure off-chip storage for firmware and data – this helps provide cryptographic functionality for secure key generation and key management. This starts with hardware validated boot (TPM), but includes Secure Memory Encryption and Secure Encrypted Virtualization.

Encryption starts at the DRAM level, with an AES-128 engine directly attached to the MMU. This is designed to protect against physical memory attacks, with each VM and Hypervisor able to generate a separate key for their environment. The OS or Hypervisor can choose which pages to encrypt via page tables, and the DMA engines can provide support for external devices such as network storage and graphics cards to access encrypted pages.

Because each VM or container can obtain its own encryption key, this isolates them from each other, protecting against cross-contamination. It also allows unencrypted VMs to run alongside encrypted ones, removing the all-or-nothing scenario. The keys are transparent to the VMs themselves, managed by the protected hypervisor. It all integrates with existing AMD-V technology.

Alongside this are direct RAS features in the core, with the L1 data cache using SEC-DED ECC and L2/L3 caches using DEC-TED ECC. The DRAM support involves x4 DRAM device failure correction with addr/cmd parity and write CRC with replay. Data poisoning is handled with reporting and a machine check recovery mode. The Infinity Fabric between dies and between sockets is also link-packet CRC backed with retry.

One element that was not discussed is live VM migration across encrypted environments. We fully suspect that an AMD-to-AMD live migration be feasible, although an AMD-to-Intel or Intel-to-AMD will have issues, given that each microarchitecture has unique implementations of certain commands.

NUMA NUMA: Infinity Fabric Bandwidths Power Management and Performance
POST A COMMENT

129 Comments

View All Comments

  • stimudent - Wednesday, June 21, 2017 - link

    Still measuring in inches. How sad. Reply
  • richmaxw - Thursday, June 22, 2017 - link

    Why are the clock speeds so low? Even the eight-core model only runs at 2.1 GHz, whereas the desktop eight-core Ryzen model runs at 3.6 GHz. Intel Xeons are the same way. I don't understand why x86 server CPUs always run at a lower clock rate than their desktop counterparts. Reply
  • _zenith - Thursday, June 22, 2017 - link

    Efficiency. Datacenters primarily care about ops/watt as their metric of success, mostly. Reply
  • Dr.Neale - Thursday, June 22, 2017 - link

    On the first page, the article incorrectly states that the rest of the stack will be made avaiable AT the end of July.

    AMD actually announced that the rest of the stack would be released in a "staggered" fashion over the coming weeks, FINISHING at the end of July.

    I think this is a significant difference.
    Reply
  • SanX - Friday, June 23, 2017 - link

    $100 per core... How many orders larger then production cost? Reply
  • Threska - Sunday, June 25, 2017 - link

    Encrypted virtualization, anything like Intel's SGX? Reply
  • agentd - Tuesday, June 27, 2017 - link

    Do you think there will be Infinity socket to socket IP available? Previously there was IP for HyperTransport available from third parties. Reply
  • jjj - Saturday, July 01, 2017 - link

    New proof of a new stepping for Epyc
    https://browser.primatelabs.com/v4/cpu/3284583
    AuthenticAMD Family 23 Model 1 Stepping 2
    Reply
  • rangerdavid - Thursday, July 06, 2017 - link

    Yeah, but will it run Crysis???!? Reply

Log in

Don't have an account? Sign up now