IBM®
Skip to main content
    Country/region [select]      Terms of use
 
 
    
     Home      Products      Services & solutions      Support & downloads      My account     
developerWorks  >  Blogs  >   developerWorks

author Cell Broadband Engine/Power Architecture notebook

This web log is the product of the collaborative, innovative, virtual minds of the editors of the IBM developerWorks Multicore acceleration (Cell/B.E. SDK) zone.



Tuesday November 04, 2008

Product watch: SDK 3.1 documentation available

Version 3.1 of the SDK for Multicore Acceleration is here: With new documentation and links to the exciting new IBM Systems Information Center, a single, searchable Web place where the documentation is "live."


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  downloads  |  news  |  papers  ]

Nov 04 2008, 11:28:00 AM EST Permalink


Tuesday November 04, 2008

It came from the Lab: Don't eat so much CO2

Cell to reduce greenhouse gases via fast sims: IBM and USaskatchewan are collaborating to understand better how to limit carbon dioxide emissions from coal-fired electricity plants -- they're doing this by setting up a simulation system consisting of BladeCenter QS22 Cell/B.E. blades. USaskatchewan research lead Raymond Spiteri noted that such simulations -- including determining how the plants can be modified to harness pre-released CO2 and change it into benign by-products or other fuels like methanol -- "used to take 10 days to complete ..." because the university rented time on a system to run the results. Now the results "will now be completed in under one day ... getting results back faster enables us to be more ambitious in our simulations and try more ideas and different scenarios." Spiteri has already started working with IBM scientists to build a model for relevant chemical reactions and to craft algorithms and code for the Cell/B.E. processors.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  news  ]

Nov 04 2008, 11:25:00 AM EST Permalink


Tuesday November 04, 2008

Product watch: TotalView supports Sony's BCU-100

Adds support for the ZEGO platform: TotalView Technologies has added support for Sony's BCU-100 Cell Platform (ZEGO) to its TotalView 8.6 source code debugging, analysis, and memory-error-detection tool. The Cell/B.E.- and RSX-based BCU-100 is designed (through its multicore architecture) to improve the efficiency of workflows, especially in the area of digital video production. With TotalView 8.6's Cell/B.E. support, ZEGO users can now examine and troubleshoot digital video program execution. (For more on ZEGO, see "Sony debuts new hybrid multicore Cell/B.E. platform." For more on TotalView, see "TotalView Debugger gets Cell/B.E. support.")


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  news  ]

Nov 04 2008, 11:23:00 AM EST Permalink


Tuesday November 04, 2008

Oddments: What the world will look like ...

when robots take your job: Electrical engineer Marshall Brain (also founder of How Stuff Works) thinks robots may put us out of work in the next 20 to 30 years. At the recent Singularity Summit, Brain claimed that the coming industrial revolution will probably realize the fear that the original Industrial Revolution didn't -- that a "second intelligent species" may be a disruptive technology, at least to the human economy. But he's not trying to hold back the coming tide. Brain suggests we restructure the economy before this happens to make it beneficial for all, humans and robots. For example, distribute the benefits of the revolution to every person via a US$25K-year stipend. (He's also proposed some other interesting ideas to remove "dysfunctional elements from the capitalistic system.")

when robots take your dog's job too!: GATech researcher hope to reduce the cost and availability problems in the service dog industry by designing a robot to handle those tasks. The researchers claim that there are never enough service dogs to go around, they cost about US$16K a piece, and it takes about two years to train them. Phase One of their research yielded a point-and-click laser the user can use to point out the object to be fetched. The robot dogs already respond to a range of verbal commands, so the initial prototype was built with off-the-shelf robotic parts with a custom manipulator that mimics a dog's mouth.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   events  |  general  |  news  ]

Nov 04 2008, 11:21:00 AM EST Permalink



Monday November 03, 2008

Cell/B.E. Security SDK: APIs: Data transfer

  Cell/B.E. Security SDK: APIs: Data transfer INFObomb
A quick read on four data-transfer functions in the Security SDK 3.0.   More INFObombs

To enable data transfer through the open area of local store on an SPU, we will look at four data-transfer functions:

  • copyin.
  • copyout.
  • decrypt_in.
  • encrypt_out.

As described in the Cell/B.E. Security architecture document, when an SPU is in hardware isolation mode, there is an open area of LS much like a "window" through which an application can DMA in and out data. The previously listed functions assist the programmer with this programming model. copyin/copyout allow users to transfer data between main memory and LS via the open area. decrypt_in/encrypt_out are based on copyin/copyout but additionally they apply an XOR mask to the data to mimic encryption.

For programmers who intend to only use the emulated isolation mode, you do not need to use these functions -- they are only for programmers who eventually want to move up to using the hardware isolation mode.

Let's take a closer look at these functions.


copyin


The copyin subroutine copies data from the main memory into the LS. ea and ls must be 16-byte aligned and size must be a multiple of 16 bytes. If all data are successfully transferred to the LS, this subroutine returns success as a value of 0; otherwise, it returns an error as -1.

C specification

#include <libisolation.h>

int copyin(uint64_t ea, void *ls, uint32_t size)

Dependencies
None.


copyout


The copyout subroutine copies data from LS to the main memory. ea and ls must be 16-byte aligned and size must be a multiple of 16 bytes. If all data are successfully transferred to the main memory, this subroutine returns success as a value of 0; otherwise, it returns an error as -1.

C specification

#include <libisolation.h>

int copyout(uint64_t ea, void *ls, uint32_t size)

Dependencies
None.


decrypt_in


The decrypt_in subroutine copies the message on ea into dst_ls and XORs the message at dst_ls with a library static mask. The XOR'd results are stored in dst_ls. ea and dst_ls must be 16-byte aligned and message_size must be a multiple of 16 bytes. shared_key is ignored in this release. If all data are correctly XOR'd into the LS, it returns success as value 0; otherwise, this subroutine returns errors.

C specification

#include <libisolation.h>

int decrypt_in(void *dst_ls, const uint64_t ea, const uint32_t message_size,
     const vector unsigned char shared_key)

Dependencies
copyin.


encrypt_out


The encrypt_out subroutine XOR's the message at src_ls with a library static mask and copies the XOR'd message to ea. ea and src_ls must be 16-byte aligned and message_size must be a multiple of 16 bytes. shared_key is ignored in this release. If all data are correctly XOR'd and copied out from the LS, it returns success (0). Otherwise, this subroutine returns errors.

C specification

#include <libisolation.h>

int encrypt_out(const uint64_t ea, void *src_ls, const uint32_t
     message_size, const vector unsigned char shared_key)

Dependencies
copyout.


Taken from the Cell BE Security SDK v3.0 Installation and User's Guide. Download the SDK. Check out some reference guides in the Cell Resource Center SDK library.

   ORIGINAL DOCUMENTATION | DOWNLOAD SDK | SDK LIBRARY | MORE INFObombs | BACK to BLOG | BACK to ZONE


Categories : [   Cell  |  infobombs  ]

Nov 03 2008, 12:01:00 PM EST Permalink


Monday November 03, 2008

Cell/B.E. Security SDK: APIs: Secure File Storage

  Cell/B.E. Security SDK: APIs: Secure File Storage INFObomb
A quick read on seven SFS functions in the Security SDK 3.0.   More INFObombs

To enable reading, writing, and verifying sensitive information to an encrypted file, we will look at these seven Secure File Storage functions:

  • SFS_FILE *.
  • sfs_fopen.
  • sfs_fclose.
  • sfs_fread.
  • sfs_fwrite.
  • sfs_fseek.
  • sfs_ftell.

The Secure File Storage APIs provide a facility for reading and writing sensitive information to an encrypted file with the added function that the content is verified after reading so that any tampering is detected. The Secure File Storage APIs mirror fopen and fread/fwrite for file streams, but with a slightly more limited set of semantics; in particular, not all of the file APIs are supported for the encrypted files.

When a secure file is created or opened, an encryption key is provided. Files may be shared between applications by sharing the encryption key. If the file is not to be shared, then the encryption key must be kept secret; this may be best done by encrypting the key as part of the encrypted section of the secure SPE application.

Let's take a closer look at these functions.


SFS_FILE *


The SFS_FILE * pointer is the Secure File Storage analog of the FILE * for file I/O. It references a structure that is allocated, maintained, and freed by the Secure File Storage APIs and it contains all of the information necessary to access the Secure File Storage.

C specification

#include <libisolation.h>

SFS_FILE *sfs_file_var;

Dependencies
None.


sfs_fopen


sfs_fopen creates or opens the Secure File Storage file associated with the string filename and associates a stream, referenced by the SFS_FILE structure, with the file.

The argument mode is interpreted as if for an fopen call to stdio; it must point to a string beginning with one of the following sequences:

  • r -- Open the file for reading. The stream is positioned at the beginning of the file. It is an error if the file does not exist.
  • r+ -- Open the file for reading and writing. The stream is positioned at the beginning of the file. It is an error if the file does not exist.
  • w -- Open the file for writing. Truncate an existing file or create a new file. The stream is positioned at the beginning of the file.
  • w+ -- Open the file for writing and reading. Truncate an existing file or create a new file. The stream is positioned at the beginning of the file.
  • a -- Open the file for writing. The file is created if it does not exist. The stream is positioned at the end of the file and all writes occur at the end of the file.
  • a+ -- Open the file for writing and reading. The file is created if it does not exist. The stream is positioned at the end of the file and all writes occur at the end of the file.

The argument key points to a vector of unsigned characters which contains the 16-character encryption key. This key is used for all encryption and decryption of the Secure File Storage.

During the open of the encrypted file, sfs_fopen reads the file header and verification data and may write additional verification data. As a result of these operations, sfs_fopen may set errno to any of the error codes associated with fopen, fread, and fwrite; it may also set errno to EINVAL if the encryption key can not correctly decrypt the file header; or to EIO if the verification data does not correctly verify.

C specification

#include <libisolation.h>

SFS_FILE *sfs_fopen(char *filename, char *mode,
     const vector unsigned char key);

Dependencies
None.


sfs_fclose


sfs_fclose closes the Secure File Storage associated with stream. If the stream is open for writing, any buffered data is first written to the file.

sfs_fclose returns 0 if successful, EOF otherwise. In either case, no further access to the stream is allowed.

During this operation, sfs_fclose updates the file header and verification data if the file was open for writing. As a result of these operations, sfs_fclose may set errno to any of the error codes associated with fwrite and fclose.

C specification

#include <libisolation.h>

int sfs_fclose(SFS_FILE *stream);

Dependencies
None.


sfs_fread


sfs_fread will read count elements from the stream, each of size element_size, into the memory referenced by buffer. If less than count elements are remaining in the stream, then fewer bytes will be returned. If the number of remaining bytes is not a multiple of element_size, then an error is returned.

Upon successful completion, sfs_fread returns the number of elements of size element_size that were read and returned. The stream location is incremented by the number of bytes returned.

As part of this operation, sfs_fread reads both the requested data and the associated verification information. sfs_fread may return with errno set to any of the error codes associated with fread. In addition, if the verification data does not agree with the computed verification over the requested data, then sfs_fread returns with errno set to EIO.

C specification

#include <libisolation.h>

int sfs_fread(void *buffer, size_t element_size, size_t count,
     SFS_FILE *stream);

Dependencies
None.


sfs_fwrite


sfs_fwrite will write count elements to the stream, each of size element_size, from the memory referenced by buffer.

sfs_fwrite returns the number of elements written. If the return value is less than count, then a write error occurred.

During this operation, sfs_fwrite writes the data to the encrypted file and computes the new verification data. As a result of these operations, sfs_fwrite may set errno to any of the error codes associated with fwrite.

C specification

#include <libisolation.h>

int sfs_fwrite(void *buffer, size_t element_size, size_t count,
     SFS_FILE *stream);

Dependencies
None.


sfs_fseek


sfs_fseek sets the current stream location to that specified by offset. The interpretation of offset is determined by wherefrom.

  • SEEK_SET -- Interpret offset as an absolute offset from the start of the file.
  • SEEK_CUR -- Interpret offset as a relative offset from the current stream location.
  • SEEK_END -- Interpret offset as a relative offset from the stream position immediately following the last data byte in the file.

If successful, sfs_fseek returns 0; otherwise, sfs_fseek returns -1. sfs_fseek may return with errno set to any of the error codes associated with fseek.

C specification

#include <libisolation.h>

int sfs_fseek(SFS_FILE *stream, long int offset, int wherefrom);

Dependencies
None.


sfs_ftell


sfs_ftell returns the current position offset within the stream.

If successful, sfs_ftell returns 0 or a positive value; otherwise, sfs_ftell returns -1. sfs_ftell may return with errno set to any of the error codes associated with ftell.

C specification

#include <libisolation.h>

int sfs_ftell(SFS_FILE *stream);

Dependencies
None.


Taken from the Cell BE Security SDK v3.0 Installation and User's Guide. Download the SDK. Check out some reference guides in the Cell Resource Center SDK library.

   ORIGINAL DOCUMENTATION | DOWNLOAD SDK | SDK LIBRARY | MORE INFObombs | BACK to BLOG | BACK to ZONE


Categories : [   Cell  |  infobombs  ]

Nov 03 2008, 12:00:00 PM EST Permalink



Tuesday October 28, 2008

Product watch: SDK version 3.1 available

Version 3.1 of the SDK for Multicore Acceleration is here: With new documentation and links to the exciting new IBM Systems Information Center, a single, searchable Web place where the documentation is "live."


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  downloads  |  news  ]

Oct 28 2008, 11:58:00 AM EDT Permalink


Tuesday October 28, 2008

It came from the Lab: Plasmon lens create denser chips

Plasmonic lithography: UC-Berkeley engineers have found a way to breathe new life into optical lithography called plasmonic lithography -- by using metal lenses that focus light by exciting electrons (plasmons), they've been able to create line patterns 80nm wide or about 10 times smaller. The resolution and defraction you can get with regular light is a limiting factor; to overcome this, they leveraged a property of metals -- the presence of free electrons at the surface that oscillate when exposed to light (evanescent waves, smaller than the wavelength of light).


Return to zone ||| Return to blog ||| Previous postings



Categories : [   general  |  news  ]

Oct 28 2008, 11:57:00 AM EDT Permalink


Tuesday October 28, 2008

Product watch: Automated debugging and Cell benchmarks

TotalView batch debugger: TotalView 8.6 (source code analysis and error detection tool) has added features: automated batch and remote access debugging. Via a new troubleshooting utility called TVScript, users get automated and unattended debugging. They can also perform multiple runs of a single version of a program without recompiling or stopping to make source edits. Another feature, the Remote Display Client, offers users the ability to set up and securely operate a remote interactive graphical debugging session.

Cell benchmarks "good" for Express Logic NetX TCP/IP Stack: A paper by Sony engineers -- "Network Processing on an SPE Core in Cell Broadband Engine" -- shows that a recent test of the company's NetX TCP/IP network stack and ThreadX RTOS achieved speeds reaching 8.5Gbps. Due to Linux's standard protocol stacks's large memory footprints (which exceed the 256KB SPE memory size), it has been difficult to drive to the maximum bandwidth of on 10Gbps Ethernet. Express Logic's protocol stack designed for embedded applications is less than 30KB which makes it fit easily into the 256KB limits of SPE local memory.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  downloads  |  news  |  papers  ]

Oct 28 2008, 11:53:00 AM EDT Permalink



Tuesday October 21, 2008

Faster than a speeding bullet: There's a supercomputer on my lap

Most laptops best 1980's fastest: TechRepublic's John Sheesley takes you on a walk down memory lane when the phrase "supercomputer" didn't conjure up images of LANL's Roadrunner* Cell/B.E.-Opteron hybrid but instead made you think Cray. He points out that the laptop many of you are using right now is faster than the 1980s version of a supercomputer like the Cray Y-MP -- up to eight 32-bit processors that ran a max 333MFLOPS for a combined sustained speed of over 2GFLOPS. It sped along at 167Mhz and could handle both 24-bit and 32-bit instructions. (Remember, the best in desktop at the time was the 32-bit 486DX/2 66 with an internal clock rate of 66Mhz.)

Sheesley's got another post on How Star Trek influenced the development of the curved tower design of the Cray supercomputers.

How do we reach 1 exaFLOPS?
Practice, practice, practice?: In International Science Grid This Week, David Anderson, founder of the popular volunteer computing site Berkeley Open Infrastructure for Network Computing (BOINC), discusses how to best the current record of 1PFLOPS (earned by distributed efforts like BOINC and Folding@home and the solitary LANL Roadrunner*). Anderson notes that simple scaling current efforts may be hampered by steep power-consumption and heat-dissipation curves; his suggestion to reach the next height is a combination of volunteer computing and using graphics processing units (GPUs). Although the specific-task-oriented nature of GPUs made reprogramming them for compute-intensive scientific applications difficult, a newer trend in GPUs is for them to be more general-purpose (even delivering up the coveted double-precision floating-point math). Anderson mentions NVIDIA's CUDA system that allows GPUs to be programmed in C and makes it easier to develop and port scientific apps to GPUs.

(*Please see the disclaimer on the use of the LANL Roadrunner name.)


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  general  |  news  ]

Oct 21 2008, 01:18:00 PM EDT Permalink


Tuesday October 21, 2008

Design on a dime: Multicore partitioning as a design issue

Learn how to think outside the linear execution box: Richard A. Quinnell of EE Times writes an interesting article highlighting the need to take partitioning into account when you design applications for multicore systems. He starts by providing a friendly warning that the trends show that even traditional general-purpose processors (and the products they are used in) are turning to multicore architectures. Quoting RTOS vendor Express Logic's John Carbone, Quinnell makes the point that moving software to multicore requires overcoming two obstacles:

  • You have to find a way to distribute the threads.
  • You have to find a way to enable "communications among the threads across processor boundaries."

Quinnell goes on to remind that the only way multicore processing is a win is if all the cores remain busy (that is, none are idle and none are overburdened) -- partitioning can be the answer to this problem (just as it can increase competition among cores for shared resources if not done correctly). Some of his basic suggestions to achieve adequate partitioning include message passing and semaphore mechanisms to help threads swap info and coordinate their actions across boundaries. Quinnell also supports simplifying the implementation of these mechanism (like with the Multicore Communications Applications Programming Interface standard effort) and tool-developers' efforts.

Users need this for on-chip mcore debugging
Mcore challenges debugging: This technical paper by Jens Braunes, software architect at pls Development Tools, details the importance of understanding user requirements before choosing an on-chip debug setup for a multicore system by providing a checklist of sorts, including

  • "Must each core and bus must be observable?"
  • "Is it crucial for system analysis to recognize events that arise from interactions between the cores and busses?"
  • "What level of complexity (in interactions between all SoC components) during debug is needed?"

Braunes covers four sets of signals for basic multicore debug capabilities (debug control, JTAG interface, debugger interface, and cross-trigger interface), how you may want to build specific debug functionality into the design (based on customer needs), how using the multicore debug solution (MCDS; configurable IP building blocks) helps measure performance indicators, and more.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   general  |  news  |  paper  ]

Oct 21 2008, 01:16:00 PM EDT Permalink


Tuesday October 21, 2008

Trends and tradeoffs: Slippery interconnect requirements for multicore

Are standards-based interconnects ready for the transition: Freescale systems architect Greg Shippen wonders if existing standards-based interconnects are ready for the transition that multicore SoC devices are beginning to trust on developers and designers -- namely, the rearrangement of boundaries among silicon devices, boards, and subsystems. Board and system-level interconnects were originally based on the shared bus; the demand for better interconnect performance was realized through an increase in the clock rate and a widening of bus widths, but physics put a stop to that. Shippen lays out a direction (including new protocol features to provide de-multiplexing services at the destination point) to make it possible for current interconnects to support multiple traffic streams.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   general  |  news  ]

Oct 21 2008, 01:12:00 PM EDT Permalink


Tuesday October 21, 2008

Product watch: Matrix Vision and MatLab

MatLab goes parallel: In a new release of the MatLab environment, MathWorks introduces parallel programming capabilities. MatLab 2008b allows users to distribute parallel MatLab applications as standalone executables or software components, making it easier to leverage clusters and multicore systems. This feature is a new language construct in MatLab's Parallel Computing Toolbox 4.0; it lets you mix serial programs with parallel ones using the familiar single program, multiple data construct (also known as spmd) used by parallel programmers in technical apps for clusters.

Video application/hardware solutions: Matrix Vision offers a host of products to help you with digital image processing on your Cell/B.E. system, including the mvHYPERION-16R16 and 32R16 frame grabbers (which acquires 16 video channels in real-time via PCIe x4 and are optimized for Cell/B.E. processors) and the newest, the CameraLink frame grabber mvHYPERION-CLf/Cell for FULL CL cameras, optimized for applications in high-end machine vision solutions.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   Cell  |  general  |  news  ]

Oct 21 2008, 01:10:00 PM EDT Permalink


Tuesday October 21, 2008

Oddments: BANs, qencryption, local power, and fake flowers

Again with the wearable network!
Low-power DSP: IMEC researchers are planning a custom ultra-low power digital signal processor to be used in a wireless sensor node that will most likely be the centerpiece of a body-area network. Plans are for the node to consumer 100microwatts or less. An off-the-shelf prototype used an algorithm running on a PC to determine an overall level of excitement based on readings of heart rate, skin conductance, temperature, and breathing rate.

Quantum encryption: Awesome and pointless
Famed security expert Bruce Schneier weighs in: Security expert Bruce Schneier thinks quantum cryptography is a very cool idea -- and that it is probably almost completely useless in real-world application. Schneier doesn't believe it solves any problem that needs solving because the quantum part doesn't address the real weaknesses in the system (in his words, "Systems that use it don't magically become unbreakable"). Schneier notes that his opinion comes about because he sees security as a chain, only as strong as its weakest link -- mathematical cryptography (which qencryption would replace) is already the strongest point in the chain. So qencryption would still be subject to the effect of the other weak links. As always, Schneier makes you think. (See "Tap this you eavesdroppers! Qencryption prepares to ravage small blue planet" for more on qencryption.)

Blender operates without wires
Plop it on the power pad: Fulton Innovation has linked its eCoupled technology with a kitchen blender, producing a blender without a power cord. You simply plop it on eCoupled-enabled countertop. So for those of you who hate power cords, here's your chance.

And speaking of power ...
Thomas Jefferson's idea on local generation gets new life: VATech researchers are resurrecting Thomas Edison's concept of local power generation to minimize blackouts at the local level. They're planning a network of privately-owned microgrids that use renewable energy sources in order to test two issues -- how resilient and how sustainable interdependent electric power and communications systems can be. On the resilience side, they will be examining how well microgrids can manage risk of cascading failures (that lead to the big blackouts); on the sustainability side, they'll determine how easy it is to make the system agile enough to respond to changing conditions and environmental challenges.

Smells like a real flower
Droid plants do the same thing as real ones, but they're robots: ChonnamNatU's robot lab has gotten a pseudo-green thumb -- it's building a robotic plant that humidifies, produces oxygen, emits aromas, and responds to stimuli (like bending towards light, music, or approaching people -- Triffids?!?). It looks like a Rose of Sharon and early indications are it doesn't need watering. In fact, you need a power surge to kill it.


Return to zone ||| Return to blog ||| Previous postings



Categories : [   general  |  news  ]

Oct 21 2008, 01:08:00 PM EDT Permalink



Monday October 20, 2008

Cell/B.E. Security SDK: Building apps: Introduction

  Cell/B.E. Security SDK: Building apps: Introduction INFObomb
A quick read introducing how to build and secure applications with the Security SDK 3.0.   More INFObombs

The normal process flow for building secure applications comprises the following steps:

  1. Build and test the application.
  2. Secure the application.
  3. Run the application in emulated isolation mode.

Easy, right? Let's look a little closer.


Building and testing


The most common way to build and test a secure application would be to build and test the application as a non-secure application using all of the standard tools and libraries of the SDK, then modify the application to invoke the SPE emulated isolation mode. Please see the Cell Broadband Engine Programming Tutorial for instructions and tips for programming using the non-secure SDK.


Securing


Modifying an existing application to run in SPE isolation mode involves the following steps:

  1. Modify the spe_context_create of the existing PPE application to add the SPE_ISOLATE_EMULATE flag as a parameter. These changes signal to libspe that the SPE is to be placed into emulated isolation mode.
  2. Replace the include of make.footer with make.iso.footer in the makefile for your SPU code; add the defines for ISO_SIGN_KEY and ISO_SIGN_CERT for the files containing the application signing key and application signing certificate. Both the signing key and signing certificate must be in PEM format.

    Optionally, add the defines for ISO_ENCRYPT_SEC if a section of the application is to be encrypted. ISO_ENCRYPT_SEC may be the name of an ELF section of the SPE application or ALL if all code and data sections are to be encrypted. This step invokes the Build Tool to sign and (optionally) encrypt the SPE application prior to its being embedded within the PPE application. (Please see the makefiles in the examples directories for more concrete examples.)
  3. Finally, build that application.

Again, what's the emulated isolation mode?


Before, you were stuck with using a security-enabled simulator to execute the runtime Cell/B.E. Security SDK stack. With the emulated isolation mode, you can develop and execute the stack on an IBM QS2x blade server or a regular (meaning: non-security-enabled) simulator. It allows the GNU project debugger GDB to work with the security application while you're developing it. If you're only planning to follow the first approach (not using the hardware SPU isolation feature), then this is the mode for you.


Bonus: The SPE Secure Application Build Tool, spu-isolated-app


The isolated SPE application build tool is a standalone application that signs and (optionally) encrypts the SPE secure application using the supplied keys. The specifics of the key usage model and hierarchy are described in the "Key Hierarchy" section of the original documentation or in the developerWorks quick-read installments starting with Cell/B.E. Security SDK: Key hierarchy from a high level.

The tool binary is installed as /opt/cell/sdk/prototype/usr/bin/spu-isolated-app. The source, installed by the cell-spu-isolation-tool-source rpm, is installed in the directory /opt/ibm/cell-sdk/prototype/src/tools/isolation. The flow at build-time is as follows:

  1. The developer codes the application. At this point, the developer can annotate one block of code or data that will be encrypted.
  2. Using the regular compiler and linker, an SPE-ELF (Executable and Linkable Format) executable is generated.
  3. The build tool takes the SPE-ELF executable and, using keys provided for signing, generates an image that is signed and (optionally) encrypted.
  4. The output format of the build tool is SPE-ELF compatible.

The application is called with the following parameter list:

spu-isolated-app <infile> <outfile> <signKey> <signCert> [<encryptSec>]

in which

  • infile is the name of the input file (SPE ELF executable).
  • outfile is the name of the output file (secure SPE ELF executable).
  • signKey is the name of the file containing the Application Authentication Private Key for signing.
  • signCert is the name of the file containing the signed X.509 Application Authentication Public Key certificate for certifying the digital signature of the file.
  • encryptSec is the name of the section to encrypt or ALL if all sections, both code and data, are to be encrypted.

The build tool expects keys and certificates in PEM format. If you have keys or certificates in DER format, then you can convert to PEM format using openssl or other tools.

Editor's note: To wrap up this two-parter, next we'll look at a programming example.


Taken from the Cell BE Security SDK v3.0 Installation and User's Guide. Download the SDK. Check out some reference guides in the Cell Resource Center SDK library.

   ORIGINAL DOCUMENTATION | DOWNLOAD SDK | SDK LIBRARY | MORE INFObombs | BACK to BLOG | BACK to ZONE


Categories : [   Cell  |  infobombs  ]

Oct 20 2008, 12:01:00 PM EDT Permalink

Previous month
  November 2008
Next month
S M T W T F S
      1
2345678
9101112131415
16171819202122
23242526272829
30      
Today

RSS for

RSS for

Favorites
Cell Broadband Engine Architecture forum
Cell Resource Center
IBM microNews newsletter
Multicore acceleration zone (formerly Power Architecture)
alphaWorks Cell technologies

Categories
Cell (173)
disclaimer (1)
downloads (26)
events (146)
forums (23)
general (171)
infobombs (65)
infobombs theme (4)
misc (6)
news (906)
newsletter (3)
paper (1)
papers (150)
tech update (1)

Recent Entries
Product watch: SDK 3.1 documenta...
It came from the Lab: Don't eat ...
Product watch: TotalView support...
Oddments: What the world will lo...
Cell/B.E. Security SDK: APIs: Da...
Cell/B.E. Security SDK: APIs: Se...
Product watch: SDK version 3.1 a...
It came from the Lab: Plasmon le...
Product watch: Automated debuggi...
Faster than a speeding bullet: T...
Design on a dime: Multicore part...
Trends and tradeoffs: Slippery i...
Product watch: Matrix Vision and...
Oddments: BANs, qencryption, loc...
Cell/B.E. Security SDK: Building...

Blogs I read
CellPerformance.com
Power.org blog
Slashdot

Special offers
Save on Rational testing software
Download trial versions of popular IBM software
Register for the DB2 Information Management Technical Conference

More offers


 
    About IBM Privacy Contact