Mostly misdirection in the media, but...
Read between the lines and think only happy thoughts about all those
good people in places of authority. As always, GOOD americans have
no need to worry about any of this.
http://www.tomshardware.com/2006/05/23/amd_reinvents_itself/page19.html
AM2: AMD Reinvents Itself
Features: Virtualization And TCPA
AMD has joined the pack in using Pacifica virtualization technology,
equipping all Athlon 64 and FX CPUs with it. It is fully compatible
with Intel's VT technology.
What's more, these CPUs have a new security feature that goes by the
codename "Presidio". This refers to support for TCPA/Palladium,
which Intel calls Vanderpool. AMD thus places itself in the software
developers' camp, in an effort to stem the flow of pirate copies and
ensure more security for sensitive applications in banking, the
military sphere and public services.
AMD has yet to announce any more concrete information about either
feature. Whether this is a deliberate or not is as of yet unclear.
Sempron64 processors do not support either feature yet.
****
Intel, AMD spar over virtualization
By Stephen Shankland
URL:
http://news.zdnet.com/2100-3513_22-6035892.html
Intel and Advanced Micro Devices once again are angling for
leadership in virtualization, technology that increases a computer's
efficiency by letting it run multiple operating systems
simultaneously.
Intel is expected to declare Tuesday that its Virtualization
Technology (VT) is mature enough for testing and about three months
away from prime time. But AMD, whose rival "Pacifica" technology
won't debut in processors until midway through this year, is trying
to set its own technology as a standard for virtualization of
computer communications, an element not present in Intel's VT.
The two chipmakers are seeking the advantage in the strategic
virtualization area. Mainstream servers using x86 processors such as
Intel's Xeon and AMD's Opteron are getting features once reserved
for high-end mainframes or Unix machines that let them run multiple
operating systems simultaneously. That technology is timely, as
well: It's one important way to keep at bay the problems of
increasing electrical power consumption.
Intel's newest high-end Xeon processors--code-named
Paxville--shipped with VT, but server makers employing the chip
didn't enable the feature. Now, with new BIOS software available
from Dell, Hewlett-Packard and IBM, that's changing, said Lorie
Wigle, director of marketing for Intel's Server Platforms Group.
"We feel we're at critical mass in terms of having both software and
computer maker support far enough along that IT departments can
start to evaluate the technology," Wigle said. "We're at the stage
where people should start their pilot with a notion of moving to
production in a quarter or so."
VT will extend to more widely used chips for dual-processor servers
with the release of Dempsey systems in coming months. And Itanium
will get the support with "Montecito," delayed but due later this
year. AMD's virtualization will arrive in mid-2006 with the "Rev F"
version of its Opteron.
Software support for VT is in the new VMware Server, Wigle said, a
newly free package that lets a computer run several operating
systems simultaneously in partitions called virtual machines.
VT is required to run 64-bit operating systems on the software. In
addition, an open-source VMware competitor called Xen uses VT to let
an operating system run without having to be modified. That enables
Windows to run on Xen.
Virtualization is a broad term that in general describes how one
computing element can run atop a virtual foundation rather than the
real thing it expects. The virtualization foundation lets hardware
be used at higher capacity and lets software be reconfigured more
easily. VT virtualizes the processor, but one element missing from
first-generation VT is virtualization of input-output (I/O) tasks.
That work will endow virtual machines with direct channels to
network resources, Wigle said.
AMD's counterpunch: networking
But AMD, through work with software and hardware partners, believes
it will beat Intel to the punch in the I/O virtualization
department.
"We expect to see the first devices by the end of 2006," and broader
support that extends to personal computers in 2007, said Margaret
Lewis, director of commercial solutions for AMD. The technology
extends beyond processors and therefore requires support from
hardware partners that build chipsets connecting those processors to
other computer components, she said.
And to boost its approach, the company on Tuesday released a
royalty-free, public specification for its approach to I/O
virtualization. The technology elicited endorsements in statements
from VMware and Xen.
"Assisted virtualization for I/O devices is the next logical step in
hardware virtualization," said Simon Crosby, chief technology
officer for XenSource, a start-up commercializing Xen. And Raghu
Raghuram, VMware's vice president of platforms products, said, "We
look forward to working with AMD on I/O virtualization to further
advance the state-of-the-art in virtual infrastructure."
Virtualization hardware is helpful today, but in the future it will
be mandatory for some. Microsoft is working on "hypervisor" software
to compete directly against similar technology such as Xen and
VMware ESX Server, and that project will require hardware support,
the company has said.
The Microsoft hypervisor, code-named Viridian, is scheduled to debut
in an update sometime after Microsoft's initial release of its
next-generation Windows server product, code-named Longhorn Server,
Wigle said.
Microsoft has said the hypervisor is a high priority. In a January
interview, Windows chief Jim Allchin said that the company wants to
make progress in its Next Generation Secure Computing Base, formerly
known as Palladium, but it must first complete the hypervisor.
CNET News.com staff writer Ina Fried contributed to this report.
****
Intel VT vs. AMD Pacifica
By Andy Dornan
11/01/2005 12:00 AM EST
URL:
http://www.itarchitect.com/shared/article/showArticle.jhtml?articleId=172302134
Claim: CPU extensions simplify the creation of VMs and other
management operations, making server virtualization simpler and
allowing an entire client OS to be run in a secure sandbox, separate
from management tools.
Context: The AMD and Intel architectures were originally driven by
Microsoft's Palladium initiative. Although Palladium was held up,
the chipmakers pressed ahead, and Intel has been working closely
with security vendors and the open-source community.
Credibility: Intel and AMD have a history of delivering on their
promises. But hardware isn't much use unless there's software to run
on it. Watch Xen and VMware closely.
Comparing CPUs used to be relatively simple. Sophisticated buyers
always knew to look beyond a chip's megahertz rating, but ultimately
it was still about speed. The math coprocessors, multimedia
extensions, and second-level caches were all in the service of
crunching through code as fast as possible.
Not anymore--at least, not if Intel has any say in the matter.
Instead of just trying to make its processors faster, it's adding
functionality that can't be quantified in gigaflops. Intel hopes
customers will do the same, looking beyond number-crunching
performance to focus on features such as security, manageability,
and power consumption.
Intel's stance could be seen as an attempt at distraction. Most
independent tests put AMD at the front of the x86 speed race, so
Intel's only hope of retaining market share is to make people look
at something else. However, AMD is also going beyond pure
performance. It has an equivalent to most of the new capabilities
that Intel is promoting, and in some cases AMD's versions are more
advanced.
Intel calls its new features "star technologies" (*Ts, see table at
left). Of the five announced so far, one is really just a rebranding
of the 64-bit extensions it licensed from AMD. Three more are
dependent on a fifth, Virtualization Technology (VT). Previously
known under the code names Vanderpool and Silverdale, VT is set to
ship by the end of 2005. AMD's equivalent is the Pacifica Secure
Virtual Machine (SVM), slated for early 2006. Both build
virtualization support into hardware.
From the vendors' marketing slides, VT and Pacifica look quite
different. Intel is promoting VT as a security and management
architecture for laptops, while AMD is selling Pacifica as a way to
consolidate servers in the data center. However, this is just spin,
representing the companies' strengths in other areas: The Pentium M
has helped Intel consolidate its hold on the mobile market, while
servers are increasingly turning to AMD's Opteron. The underlying
technologies are almost identical and will be included across the
full range of PCs within a year.
FIVE-RING CIRCUS
Building virtualization into hardware sounds contradictory. The
whole point of virtualization has traditionally been to avoid
hardware, simulating it in software. Why crawl around in the data
center every time a Unix server needs a memory upgrade when an IBM
mainframe can provision virtual Linux instances automatically? Why
keep that old Windows 95 box around when a modern XP workstation can
virtualize legacy DOS applications in the idle time between key
presses?
The difficult part is that true virtualization requires each Virtual
Machine (VM) to simulate a real one exactly. This is a problem with
the x86 architecture because OS kernels expect direct control of the
CPU. In programming parlance, they run at "Ring 0," the deepest
level of access, with the most functionality. A traditional x86 chip
can't run a virtualized OS at Ring 0 because that's needed for the
hypervisor, the master OS that hosts all the VMs.
The x86 architecture provides three more rings, each with
progressively less functionality. For stability, modern OSs restrict
applications to the least functional, Ring 3. (This is why Windows
XP is so much more reliable than its DOS-based predecessors, which
let applications access Ring 0.) So the obvious approach to
virtualization is to run the guest OS in one of the two vacant
rings.
Unfortunately, some x86 machine code instructions only work at Ring
0. To run properly in higher rings, the OS must be rewritten (or at
least recompiled) to avoid those instructions, an approach known as
paravirtualization. This is popular in the Linux world--IBM uses a
similar technique to run Linux clusters on a mainframe--but it takes
work on the part of programmers, and it requires that the OS's
source code be available.
DRILLING DOWN
To run an unmodified OS outside Ring 0, the hypervisor must
intercept the forbidden instructions and emulate them. This is the
approach taken by VMware, as well as by Windows XP's own emulation
of DOS. The disadvantage is that emulation can use a lot of
computing power--not a problem for the occasional application
written to run on DOS-era hardware, but a significant one for an
entire OS that takes full advantage of a modern PC.
To assist virtualization, VT and Pacifica insert a new privilege
level beneath Ring 0. Both add nine new machine code instructions
that only work at "Ring -1," intended to be used by the hypervisor.
This way the OS doesn't have to be modified, and the performance
penalty from emulation is reduced. However, it isn't eliminated
completely: Each OS must be convinced that it alone has access to
the machine's memory and I/O buses, while the hypervisor juggles
access to the real devices to ensure that programs and data can't
leak between OSs.
Memory has been partly virtualized since the 386 in the sense that
the OS and a hardware memory controller allocate RAM (or disk space
if the RAM runs out) between applications. AMD has a definite
advantage here. Its CPUs include the memory controller, so Pacifica
can simply re-use that. In contrast, Intel's CPUs off-load memory
control to a separate chip that doesn't support VT, meaning the
hypervisor must take on more of the memory management work. Intel's
memory controller will eventually be able to use VT, but not until
it's brought into the CPU, expected to happen in 2007.
At present, I/O virtualization requires that drivers run on the
hypervisor, which then presents virtual drivers to the guest OSs.
Future versions of Pacifica and VT will eliminate the drivers from
the hypervisor, allowing guest OS drivers to communicate with the
hardware directly. However, this will require support from all PCI
devices and so needs to be built into the PCI specification. The
PCI-SIG began work on this in June, but has no timetable for a final
standard.
IT INSIDE
Microsoft originally planned to support VT and Pacifica through
Palladium, a new security architecture aimed mainly at consumer
Digital Rights Management (DRM). The principle was that a new, more
secure OS would run parallel to Windows and be invoked whenever
extra security was wanted. For example, a media player on the secure
OS would be able to play content that couldn't be captured by an
application on regular Windows.
Microsoft demonstrated the technology in early alpha versions of
Windows Vista, then called Longhorn. From the user's perspective,
applications running on the second, secure OS appeared to run in
Windows with highlighted borders. However, the extra OS wasn't
included in later beta versions, and the plan has since been put on
hold. Microsoft has announced a hypervisor for Windows Server 2007,
but that will ship later in 2007 (or perhaps 2008), not with the OS
itself, and may require an additional licensing fee.
Absent Microsoft, Intel is still promoting VT as a desktop (and
laptop) security technology, but focused on enterprise management.
The slogan is "Embedded IT Architecture"--a VM dedicated to
anti-virus, anti-spyware, or backup software (see figure at left).
In most cases, this software would be controlled remotely by the IT
department, invisible to the user. Another VM can run Windows and
all its applications normally--except that a malicious program or
user wouldn't be able to disable the security software.
The same thing will be possible with Pacifica, though Intel's Active
Management Technology (AMT) gives Intel an edge in embedded IT. AMT
places a hardware management agent inside the NIC that can perform
basic management tasks even when the CPU is switched off. For
example, it could reboot a crashed PC or install a new hypervisor.
HYPE VISION
The big issue for both VT and Pacifica is software support. The
management VM will probably run a stripped-down version of Linux,
simply because it costs nothing and is easy for vendors to
customize. However, there's no reason in principle that it couldn't
run a hardened version of Windows or any other x86 OS. And the
possibilities aren't mutually exclusive.
Similarly, users can have access to more than one OS. The concept is
similar to current dual-boot systems, except that several partitions
can run at once. For example, Intel says it's giving its software
developers a Linux VM for their programming work, an empty x86 VM to
test the compiled code, and a Windows VM to run Office applications.
Even users who don't want to leave Windows could see benefits: They
can use one VM to surf the Web and another to hold sensitive
documents that shouldn't be exposed to the Internet.
Competition for the hypervisor has higher stakes. While VMs allow
several OSs to share a system, there can only be one hypervisor.
Windows servers will probably end up using Microsoft's. Clients and
other servers will have a harder choice.
So far, there are two main contenders: VMware and Xen, an
open-source hypervisor. The current versions still run at Ring
0--Xen uses paravirtualization, VMware emulation--but Intel and AMD
are helping them move down to Ring -1. Both plan to support VT and
Pacifica by the time the hardware is available.
Xen is the early favorite for embedded client management. It's used
in all of Intel's embedded IT demos and has attracted code
contributions from IBM as well as the chip vendors. For customers
who don't feel comfortable downloading free software, some of its
developers have formed a start-up, XenSource, to provide support and
custom development work.
The server virtualization market still belongs to VMware. And to
protect its position, it has formed a consortium including hardware
vendors IBM and Dell, Linux leaders Red Hat and Novell, and Intel
and AMD (see "Linux Virtually Ready For the Data Center" April 2005.
The consortium aims to develop an open hypervisor standard, though
it isn't clear yet whether Xen, Microsoft, and other competitors
will be able to implement that standard.
VMware is also targeting home users with an intuitive user
interface, offering features such as tabbed desktops (similar to
tabbed browsing, but with VMs instead of Web pages). And it promotes
virtualization as a security technology for the family PC. If you
believe its demos, you'll be able to let your kids play with your
computer, safe in the knowledge that even if they corrupt the OS,
the damage will be limited to their own partition.
-1 RING TO RULE THEM ALL
Virtualization can help protect a system against OS bugs or
vulnerabilities, but it really just pushes security and stability
problems down a level. The whole system is only as good as the
hypervisor.
Fortunately, hypervisors tend to be robust. Most VMware products
have never suffered a security advisory, a refreshing change to
anyone accustomed to the frequent patches required by other
software. And that's not just because of the programming skills of
VMware employees. A hypervisor can be much smaller than a full-scale
OS--Microsoft calls its own a "microkernel"--so auditing one for
security is easier.
But VT and Pacifica can still introduce new vulnerabilities,
especially for users who don't want the new VM capability. An attack
on a system running a single, non-virtualized OS wouldn't even
require hacking the hypervisor, as the attacker could just slip a
virus or Trojan into the unused Ring -1.
A Ring -1 virus is the ultimate rootkit. Because it operates beneath
the OS and simulates the legacy x86 chip exactly, it can attack even
perfectly secure software. What's more, it's OS-independent: The
same virus can compromise every x86 OS, from CP/M to Solaris. Worst
of all, it's mathematically impossible for software alone to detect.
To protect against such a virus, the system needs a hardware
component that can't be virtualized. This is provided by the Trusted
Platform Module (TPM), the controversial PKI chip already included
in many PCs. The TPM watches the hypervisor and other programs as
they load into memory, checking that they match precomputed hash
values. Once it's sure that the hypervisor hasn't been tampered
with, it signs a digital certificate that can be verified by the
virtualized OS or security software.
This process, known as attestation, isn't limited to software. It
can also prove whether or not particular components are present. In
the original Palladium DRM architecture, it would be used to
reassure a media player or video-streaming site that movies aren't
being saved to a TiVo.
Intel and AMD both plan to do something similar in 2007, with
technologies known respectively as La Grande and Presidio.
Supposedly intended for enterprise security, these will encrypt the
link to local USB and video devices, protecting against hardware
keyboard sniffers.
In the meantime, VT and Pacifica both provide a compelling
application for the TPM--even for enterprises that don't yet need
VMs and hypervisors on desktops or laptops. While the chip has other
uses such as disk encryption, virtualization-aware hardware could be
what persuades users to activate it.
Intel and AMD are moving ever more PC features onto the CPU.
Click here to read Andy Dornan's commentary or write to him at
(e-mail address removed).
****
Intel quietly adds DRM to new chips
Friday 27 May 2005 - 11:02
http://www.digitmag.co.uk/news/index.cfm?NewsID=4915
Microsoft and the entertainment industry's holy grail of controlling
copyright through the motherboard has moved a step closer with Intel
Corp. now embedding digital rights management within in its latest
dual-core processor Pentium D and accompanying 945 chipset.
Officially launched worldwide on the May 26, the new offerings come
DRM-enabled and will, at least in theory, allow copyright holders to
prevent unauthorized copying and distribution of copyrighted
materials from the motherboard rather than through the operating
system as is currently the case.
While Intel steered clear of mentioning the new DRM technology at
its Australian launch of the new products, Intel's Australian
technical manager Graham Tucker publicly confirmed
Microsoft-flavored DRM technology will be a feature of Pentium D and
945.
"[The] 945g [chipset] supports DRM, it helps implement Microsoft's
DRM ... but it supports DRM looking forward," Tucker said, adding
the DRM technology would not be able to be applied retrospectively
to media or files that did not interoperate with the new technology.
However, Tucker ducked questions regarding technical details of how
embedded DRM would work saying it was not in the interests of his
company to spell out how the technology in the interests of
security.
The situation presents an interesting dilemma for IT security
managers as they may now be beholden to hardware-embedded security
over which they have little say, information or control.
Conversely, Intel is heavily promoting what it calls "active
management technology" (AMT) in the new chips as a major plus for
system administrators and enterprise IT. Understood to be a
sub-operating system residing in the chip's firmware, AMT will allow
administrators to both monitor or control individual machines
independent of an operating system.
Additionally, AMT also features what Intel calls "IDE redirection"
which will allow administrators to remotely enable, disable or
format or configure individual drives and reload operating systems
and software from remote locations, again independent of operating
systems. Both AMT and IDE control are enabled by a new network
interface controller.
"We all know our [operating system] friends don't crash that often,
but it does happen," Tucker said.
Intel's reticence to speak publicly about what lies under the hood
of its latest firmware technology has also prompted calls to come
clean from IT security experts, including Queensland University of
Technology's assistant dean for strategy and innovation, IT faculty,
Bill Caelli.
"It's a dual use technology. It's got uses and misuses. Intel has to
answer what guarantees it is prepared to give that home users are
safe from hackers. Not maybes, guarantees".
Caelli said it was "critical Intel comes clean" about how the
current DRM technology is embedded into the new CPU and chipset
offering.
Microsoft was unavailable for comment at press time.
****
Black helicopters supplied by Dillon Precision
