4 ms·

As the x86_64 world continues to get more locked down, it's going to be interesting to see whether a market niche opens up for a less-constrained platform.

witty_username 10y ago
Can you elaborate on how the x86_64 world has gotten more locked down?
- protomyth 10y ago
  The biggest example is Intel and their taking away of ability to do custom chipsets for their chips. That move torpedoed NVIDIA's Ion. If you want custom, then you go ARM.
- bnolsen 10y ago
  onboard trusted execution engine running God knows what.
- sevensor 10y ago
  The first two responses are right on the money -- "trusted" modules, locked-down chipsets, can't write or use open firmware. This is why we get so excited when a random ThinkPad model might have a firmware bug that allows us to bypass the TMM.
- oneplane 10y ago
  There as so many blobs and secret controllers in the x86 platform it's not even funny. Since Core 2 Duo there is basically no way to run a CPU+PCH (or 'chipset') with free software. An average x86 PC has 10 'hidden' controllers doing all sorts of magic, and you can't touch it. The Intel Management Engine and Boot Guard make it extremely hard to use the chips without Intel's approval, NDA and a truckload of money. Here are some pages with details: https://www.coreboot.org/Binary_situation https://www.coreboot.org/Binary_situation https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Blob_Matrix https://www.coreboot.org/Blob_Matrix Intel also made it so that a PC has a timer that turns it off after 30 minutes if you don't run their signed firmware.
wyldfire 10y ago
It's confusing to me that you're calling it "less-constrained." The signed-bootloader world really caught fire in SoCs like Snapdragon and indeed the 410E and 600E include SecureMSM/TrustZone. It hasn't (yet) found big popularity in x86_64 designs -- even when the processors offer it many customers don't leverage/enable it. The "locked down" designs come from two big motivators: DRM and security. Since many snapdragon phones are sold with subsidies, the signed bootloader allows the network operator to restrict the phone's "owner" in various fashions. The security provided by a signed bootloader is real -- it's much harder for a malicious actor to create ransomware that targets mobile phones like they do PCs. I'd expect/hope that you can decide not to opt-in on the Snapdragons' SecureMSM features, but it doesn't seem any "less-constrained" than Intel or AMD's offerings.
- Cieplak 10y ago
  The locked-down hardware architecture definitely enhances security, as far as protecting the embedded firmware and IP. As a consumer, I don't want a clipper chip in my pocket. It's a sad situation for hardware these days, because if you don't comply with the unwritten rules, you'll go the way of Joseph Nacchio and Qwest.
- sevensor 10y ago
  So, to be honest, I don't know all that much about the ARM world, and I hadn't heard of TrustZone. I looked it up, and it seems that the OEM has a great deal of discretion in setting it up, to the extent that there's a reference implementation on GitHub [0]. And if I buy a bag of loose SOCs, which I can apparently do now, I'm the OEM. [0] https://github.com/ARM-software/arm-trusted-firmware https://github.com/ARM-software/arm-trusted-firmware
  - wyldfire 10y ago
    Right, kinda like what happens when you buy a Xeon or an Opteron. You can enable AMD SKINIT / Intel TXT & UEFI Secure Boot if you like. Intel didn't force this upon the consumers, the OEMs requested the processor features.
wyager 10y ago
We might as well use an unencumbered ISA as well, like RISC-V. I'm hopeful that that project will take off. It seems to be doing quite well so far. There is still an uncomfortable amount of proprietary junk and questionable hardware modules in the ARM world as well, even if it's a lot easier to get a plain SoC and turn it into a computer.
- mindcrime 10y ago
  Yep. I'm actually really excited to get my hands on a Pulpino[0], just because it's based on RISC-V. Everytime this topic comes up, I flash back to "The Coming War on General Purpose Computing"[1] and think "we can't let computing become totally locked down". Hence I'm always interested in finding ways to support more open platforms, and something like an open ISA like RISC-V seems like an important element of that. [0]: http://www.pulp-platform.org/ http://www.pulp-platform.org/ [1]: http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html
  - wolfgke 10y ago
    > Everytime this topic comes up, I flash back to "The Coming War on General Purpose Computing" [http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html] Don't forget the sequel Fighting Back in the War on General Purpose Computers: > https://www.youtube.com/watch?v=pT6itfUUsoQ https://www.youtube.com/watch?v=pT6itfUUsoQ

witty_username 10y ago

Can you elaborate on how the x86_64 world has gotten more locked down?

protomyth 10y ago
The biggest example is Intel and their taking away of ability to do custom chipsets for their chips. That move torpedoed NVIDIA's Ion. If you want custom, then you go ARM.
bnolsen 10y ago
onboard trusted execution engine running God knows what.
sevensor 10y ago
The first two responses are right on the money -- "trusted" modules, locked-down chipsets, can't write or use open firmware. This is why we get so excited when a random ThinkPad model might have a firmware bug that allows us to bypass the TMM.
oneplane 10y ago
There as so many blobs and secret controllers in the x86 platform it's not even funny. Since Core 2 Duo there is basically no way to run a CPU+PCH (or 'chipset') with free software. An average x86 PC has 10 'hidden' controllers doing all sorts of magic, and you can't touch it. The Intel Management Engine and Boot Guard make it extremely hard to use the chips without Intel's approval, NDA and a truckload of money. Here are some pages with details: https://www.coreboot.org/Binary_situation https://www.coreboot.org/Binary_situation https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Intel_Management_Engine https://www.coreboot.org/Blob_Matrix https://www.coreboot.org/Blob_Matrix Intel also made it so that a PC has a timer that turns it off after 30 minutes if you don't run their signed firmware.

wyldfire 10y ago

It's confusing to me that you're calling it "less-constrained." The signed-bootloader world really caught fire in SoCs like Snapdragon and indeed the 410E and 600E include SecureMSM/TrustZone. It hasn't (yet) found big popularity in x86_64 designs -- even when the processors offer it many customers don't leverage/enable it. The "locked down" designs come from two big motivators: DRM and security. Since many snapdragon phones are sold with subsidies, the signed bootloader allows the network operator to restrict the phone's "owner" in various fashions. The security provided by a signed bootloader is real -- it's much harder for a malicious actor to create ransomware that targets mobile phones like they do PCs. I'd expect/hope that you can decide not to opt-in on the Snapdragons' SecureMSM features, but it doesn't seem any "less-constrained" than Intel or AMD's offerings.

Cieplak 10y ago
The locked-down hardware architecture definitely enhances security, as far as protecting the embedded firmware and IP. As a consumer, I don't want a clipper chip in my pocket. It's a sad situation for hardware these days, because if you don't comply with the unwritten rules, you'll go the way of Joseph Nacchio and Qwest.
sevensor 10y ago
So, to be honest, I don't know all that much about the ARM world, and I hadn't heard of TrustZone. I looked it up, and it seems that the OEM has a great deal of discretion in setting it up, to the extent that there's a reference implementation on GitHub [0]. And if I buy a bag of loose SOCs, which I can apparently do now, I'm the OEM. [0] https://github.com/ARM-software/arm-trusted-firmware https://github.com/ARM-software/arm-trusted-firmware
- wyldfire 10y ago
  Right, kinda like what happens when you buy a Xeon or an Opteron. You can enable AMD SKINIT / Intel TXT & UEFI Secure Boot if you like. Intel didn't force this upon the consumers, the OEMs requested the processor features.

wyager 10y ago

We might as well use an unencumbered ISA as well, like RISC-V. I'm hopeful that that project will take off. It seems to be doing quite well so far. There is still an uncomfortable amount of proprietary junk and questionable hardware modules in the ARM world as well, even if it's a lot easier to get a plain SoC and turn it into a computer.

mindcrime 10y ago
Yep. I'm actually really excited to get my hands on a Pulpino[0], just because it's based on RISC-V. Everytime this topic comes up, I flash back to "The Coming War on General Purpose Computing"[1] and think "we can't let computing become totally locked down". Hence I'm always interested in finding ways to support more open platforms, and something like an open ISA like RISC-V seems like an important element of that. [0]: http://www.pulp-platform.org/ http://www.pulp-platform.org/ [1]: http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html
- wolfgke 10y ago
  > Everytime this topic comes up, I flash back to "The Coming War on General Purpose Computing" [http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html] Don't forget the sequel Fighting Back in the War on General Purpose Computers: > https://www.youtube.com/watch?v=pT6itfUUsoQ https://www.youtube.com/watch?v=pT6itfUUsoQ