The POWER and PowerPC General Discussion / News Thread

Yeah but I cannot get a modern kernel on the damn thing. The 3.16 ABI break prevents kexec from loading a new kernel.

I was wondering if dropping 50USD on an E3 and another 50 on the BDROM are worth it. I am a PCC fanboy but, 256MB of real system RAM…

1 Like

Drop an SSD in there and use the swap for ram, swap the system ram over to the GPU, play halo.

1 Like

I was using the GPU RAM as swap. The issue was that I was working on the nouveau driver port for PS3 before the ABI break. I would like to pick that up again so that there is a fully native driver with full hardware acceleration. Can’t do that when using the GPU memory.
#firstworldproblems

1 Like

That and its only the 304.11 driver :T

Well, I got a reply back from Raptor, in which they state:

In a nutshell, only the DD2.2 silicon changes were needed. DD2.2 silicon is able to close off these security holes, with the exception of the Spectre same-process read vulnerability that affects the entire CPU industry, with only changes to firmware and a small kernel change. Note that the kernel change is minimally invasive and is not related to the 30% performance loss Intel KPTI mitigation.

It would probably be more helpful if I understood production stepping better.

3 Likes

From @wuttztfz’s post on the immune CPUs list.

2 Likes

Thank your for this update. Your efforts are appreciated :hugs:

I’m removing Power6 and adding PPC750 and PPC7400

1 Like

I pulled this info from your thread though :confused:; what did you find that disqualifies POWER6? The Wikipedia page says that it worked in-order, I thought out-of-order was needed to allow these exploits.

He tested it successfully on Power6

1 Like

Wait ok is the 750, 7400, 7445, 7450/e, and 7600 chips under a general POWER denotation? I’ve always wondered if they were but never have really looked it up.

No, since POWER refers to the line of IBM processors, which these were not since they were PowerPC. You could call them Power processors, as that would imply the general term Power Architecture:

Writing POWER rather than Power becomes really confusing, really fast because there is an old IBM POWER ISA which is different from the modern Power ISA.

It is easiest to look at the history of the POWER chips:

IBM POWER ISA PowerPC ISA Power ISA
POWER1 → POWER2 POWER3 → POWER5 POWER6 → POWER9

It looks like many PowerPC chips are compliant with Power ISA, even if they were made before Power ISA was created. So you would probably be correct in calling them Power but not POWER since that would suggest either the chip line or the old ISA, neither of which applies.

1 Like

So more like POWER-1 :stuck_out_tongue: personally, at this point, I want a PS3 hacked with freebsd and lumina and I’ll be happy.

1 Like

I’m really starting to like the idea of a Linux PS3. Might have to invest.

Imagine using that as a work machine in an office. co-workers would be so confused.

1 Like

Most of your services would need to be external though, so keep that in mind. Theres no sound chip or controllers for much aside from bluetooth. Its all inegrated into the CELL chip itself. Theres only 1 core for real processing, 2 for games specifically, controller shit, then one layover core that mostly handles the background system updates. Its hard to unlock the whole chip so often its just the first 3 or 4 cores that can be made available. You’ve heard of the PS3 cluster right? Theres a reason they did a cluster of PS3’s and not a CELL/XELL server straight up. Less cores, but you cluster them together, get that sound core processing C only, get about 400 of them, and you’re still about 8000 USD under what a CELL/XELL server was priced at at the time and you have the firepower of almost 2 of those things.

1 Like

That’s freaking awesome. Not sure I could do that from a cost perspective, but still.

Someone on here has one running almost all cores. Ask them about it. Might have been mentioned in this thread?

1 Like

You rang!?

By default, you are running 6 SPEs max if you are using OFW 3.15 or lower. If you are Running CFW 3.55 or newer, you can unlock the 7th SPE by running with GameOS privileges . the PPC CPU is a single core dual thread 64bit unit.

If you were lucky to get a PHAT PS3 that did not have a defective 8th SPE, then you can turn that on by changing some hex lines in the boot up firmware. Some of the SKinnies had the 8th SPE lasered off. The Slims should have the 8th SPE turned off by software.

I have a PS3 Running Debian Wheezy because the ABI break in Linux Kernel 3.16 will not work with the PS3 Hypervisor. I have GameOS rights, all 8 SPEs active, and a GPU partially working with nouveau running OtherOS++. Unfortunately my BDRom died.

I mostly run it in CLI mode though because there is not enough RAM on the damn thing to do more than light graphical utilities. Adding and SSD to the system does not make a difference either because the SATA bus is shared with the BDRom and some other devices on the system. The HV throttles the speed so can’t use that as fast swap.

Unless you are a PPC fan, it is not worth your time trying to turn it into a daily. I use it to do video encoding mostly and cross compile stuff for my HP Touchpad. Trying to get a modern Linux on that thing.

4 Likes

Two things on the Speculative Execution front

  1. There is a new IBM firmware bulletin about Power and Speculative Execution
  2. My saga of pestering Raptor Engineering for details on GNU Social continues

The IBM bulletin makes it pretty clear that POWER7+ and POWER8 are vulnerable to Meltdown. Now I’m curious how AMD dodged this bullet when ARM, Intel, and IBM did not. According to Raptor Engineering, POWER9 on Talos will not need KPTI. Does this just mean that DD2.2 silicon is not vulnerable to Meltdown, or does Meltdown mitigation on Power not require KPTI in general?

Vulnerability cheatsheet

CVE Group GPZ number GPZ naming
CVE-2017-5715 Spectre variant 2 branch target injection
CVE-2017-5753 Spectre variant 1 bounds check bypass
CVE-2017-5754 Meltdown variant 3 rogue data cache load

Someone noticed that the Power ISA, as well as some other documents, mention an “ultravisor” mode in addition to the hypervisor.

The version 3.0B ISA document mentions it only as a possible type of privileged instruction in the appendix when it gives you a list of all the defined instructions. There are three of these lists (sorted by version, sorted by opcode, and sorted by mnemonic), so 3.0B mentions it once at the end of each list.

I also have a PDF of version 3.0, but —weird— it only mentions ultravisor in one of the lists, even though the only difference between these lists should be in how they are sorted!


I went and made a table on the RCS Wiki comparing the Machine State Register bits defined by different versions of the Power ISA. One of those reserved bits is probably the Ultravisor state.

Hypervisor state was introduced in POWER4 (see 4:11 in the video below) although it was not mentioned in documentation except as a reserved bit. I guess that we will find that one of the reserved bits turns out to indicate the Ultravisor state.

Meltdown fix for Power

PowerPC Memory Protection Keys In For Linux 4.16, Power Has Meltdown Mitigation In 4.15 (Phoronix)

powerpc/64s: Add support for RFI flush of L1-D cache (git commit)

According to the git commit, this fixes Meltdown on POWER7, POWER8 and POWER9. He explicitly states they don’t know if the 970 (Apple G5), pasemi CPUs (AmigaOne X1000) or Freescale CPUs are vulnerable.

According to the commit, Meltdown on the affected chips only works on the L1 cache, so the fix purges L1 when switching to a less privileged state (kernel to userspace).

In order for [the vulnerability] to happen, the first load must hit in the L1, because before the load is sent to the L2 the permission check is performed. Therefore if no kernel addresses hit in the L1 the vulnerability can not occur. We can ensure that is the case by flushing the L1 whenever we return to userspace. Similarly for hypervisor vs guest.

Also it sounds like these patches should help even without a firmware fix:

Newer firmwares are able to advertise to us that there is a special nop instruction that flushes the L1-D. If we do not see that advertised, we fall back to doing a displacement flush in software.


Edit: looks like @catsay beat me to it:

1 Like