5 ms·

Every day, more and more people are understanding just how little control they have over the processors that run in their Intel and AMD chips [1][2]. Maybe soon

Every day, more and more people are understanding just how little control they have over the processors that run in their Intel and AMD chips [1][2]. Maybe soon there will be enough people who care to stop giving Intel and AMD money and fund projects like these ones. OpenPOWER seems to be quite open and free. Normally it's quite expensive though, although their main products seem to be aimed at servers. Thought saying that, you always pay. Pay hard cash for a computer, or pay your privacy and freedom. 1. https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme 2. https://libreboot.org/faq.html#amd https://libreboot.org/faq.html#amd

jchw 9y ago
It's a balancing act. I don't believe I need absolute 100% control of all things going on in my computer; if I did, I wouldn't be able to utilize it anyways. It's pretty telling that Intel ME has been largely invisible to even savvy users until recently. Having competition is probably part of what's needed to ensure that there's some control. The problem is that none of the competition is currently approaching it from a user freedom standpoint. After all, most companies making processors are publicly traded and even if they weren't, need to sell a huge volume of them to break even and have decent per-unit costs. So trying to target what is unfortunately a very tiny niche of users isn't going to go well. And for the truly paranoid, it's impossible to prove that the processor wasn't tampered with, that there isn't a ring below yours. You can really only ever get to the point of being able to reasonably doubt the existence of it, which won't satisfy everyone. I think Intel is digging its own grave by taking the worst stances on issues of user freedom. Eventually, if Intel ME's power over the machine continues to increase, something bad is going to happen as a result of it, and it's going to erode the already fragile trust people have in them. The ME exploit was part 1 of that. But what about companies like AMD, or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom? There's no imaginable consequence for that. And there's no real benefit of reversing course, either. I can't see a future where open computing will be anything more than an extreme niche with sub-par options. One of the better scenarios I can think of is that computing as we know it today becomes a niche itself and a lot of the users do value privacy and security. This seems plausible the better that Chromebooks and phones and tablets get; the average user won't need a computer tower or a laptop with 16 GB of RAM. But I imagine it won't be good news for the prices we currently enjoy :)
- dman 9y ago
  Lot of good insights in this comment.
- userbinator 9y ago
  or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom? I think ARM SoCs are even worse. Try finding a full (or just partial) datasheet/technical documentation for anything like the ones used in recent smartphones and tablets, for example. They are going to want a NDA. The only ones publicly available were leaked. They also differ significantly between each other and often even within the same model line, so it's nothing like a PC where a lot of things still remain relatively standard. ARM also has TrustZone, their DRM technology of which there is almost no public documentation.
  - sweden 9y ago
    TrustZone is not DRM nor a management engine like Intel's ME. It is just a reference design in order to implement some sort of sandbox and security zone in the SoC. ARM doesn't mandate how TrustZone is used, it just provides the technology. If SoC designers use it to force DRM into their products, it's not really ARM's fault. Also, just to make it clear, it is not ARM's fault if ARM based SoCs lack proper documentation.
    - subway 9y ago
      It's at least partially ARM's fault, as ARM doesn't publish documentation for their cores. SoC vendors are just as bad, if not worse, but ARM doesn't get off scott-free.
      - pm215 9y ago
        Eh? Here's the TRM for the Cortex-A57, to pick the first arm core I thought of: https://developer.arm.com/docs/ddi0488/c/preface https://developer.arm.com/docs/ddi0488/c/preface The architecture manuals are also downloadable.
analognoise 9y ago
Running a multibillion dollar silicon foundry costs money. You're always welcome to design your own chips, then barter for them with pelts. The result of this project thus far is totally underwhelming and I'd think whoever was donating to it not only didn't need that computer and could wait an indefinite amount of time for one, but is likely throwing their money away and may never get a product.
- deleted 9y ago
  [deleted]
- profquail 9y ago
  This project isn’t about designing CPUs, so “running a foundry” is irrelevant. They’re working to build a laptop that’ll run an off-the-shelf POWER-based CPU, which is complex but still massively simpler than designing and building the CPUs themselves.
  - profquail 9y ago
    Correction: I meant PowerPC, not POWER. The latter is not likely to fit comfortably in a laptop. If you want a POWER-based workstation, check out the Talos II from Raptor Computing.
    - aidenn0 9y ago
      Actually the PC suffix has been mostly dropped. See e.g. [1] which is much lower end than what would fit in a laptop. 1: https://www.nxp.com/products/microcontrollers-and-processors/power-architecture-processors/mpc5xxx-55xx-32-bit-mcus/ultra-reliable-mpc57xx-32-bit-automotive-industrial-microcontrollers-mcus/ultra-reliable-mpc5777c-mcu-for-automotive-industrial-engine-management:MPC5777C https://www.nxp.com/products/microcontrollers-and-processors...
microcolonel 9y ago
I'm hoping for RISC-V to come through, because it has a chance to commodify even further than OpenPOWER could (due to exercising somewhat less control at the point of control for the trademark, and having a design which will suit more levels of designers, possibly allowing designers to enter new markets more readily). That said, the current POWER designs perform very well, so they might be a good interim solution for me.
- sweden 9y ago
  RISC-V is just a green card describing an ISA, is not even a design. It is as open as OpenPOWER but way less mature.
- andreiw 9y ago
  RISC-V may do that tomorrow, but Arm servers are doing that today. You how a wide range of solutions with different CPUs in a variety of formats and compute power, from uCPE and IOT gw boxes all the way to high-density OCP designs with terabytes of RAM and a hundred cores...all compatible at the software and firmware level.
  - retailbuyout 9y ago
    Let me know when an affordable arm board with ecc support comes along, wholesale or “call for price” not allowed. Because as it stands it might as well be sparc or mips in how accessible the hardware is. Wait, who am I kidding: mips is still great.
    - andreiw 9y ago
      Easy. SoftIron.com. No quotes, just order. Also, calling is easy. https://www.phoenicselectronics.com https://www.phoenicselectronics.com will sell you a Gigabyte MT30-GS2 (Cavium ThunderX 32-core) 1U system for around $2k. If you want to provide your own ATX case - much less. Hardware is accessible, but there are a lot of big players buying things en masse, and the market isn’t oversaturated. This means long lead times and some price fluctuations. But things have been getting much better with every year (out of Arm servers’s whole 3 years of public availability). Definitely more accessible than anything OpenPower (which sadly will set you back the price of a small used Kia). The recent launch of third-gen Arm servers like the Qualcomm Centriq will lower the price for older kit. This is yet another SBSA board with a low price and 1-click order: https://www.solid-run.com/marvell-armada-family/armada-8040-community-board/ https://www.solid-run.com/marvell-armada-family/armada-8040-... All ECC.
stephenr 9y ago
My understanding is that Intel management engine can absolutely be disabled, and isn't enabled at all on some vendor computers, eg Apple. So while ppc is interesting for certain applications, I think the sky-is-falling type message is kind of off putting here.
- turblety 9y ago
  Your understanding is incorrect [1]. Intel ME is another processor running the MINIX operating system. It is used on all Intel chips made since 2008 and can not be disabled. It even contains a JVM for running Java. Inside that operating system contains modules (or "apps") that are running, some even when your computer is "turned off". For example, one application is AMT which can allow you to remotely control your computer, another is an app that controls the turning on of the fan. There are generally two versions of the firmware which can be used. A light version normally used for personal computers and a heavy version normally used for servers. The light version doesn’t contain the AMT module, the heavy one does. If you are using the firmware that includes AMT, it can be disabled. The problem is we don’t actually know what other modules are running, who can run modules and which ones use network access. 1. https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme
  - masswerk 9y ago
    This is true for the latest iterations, where MINIX 3 is embedded in the Platform Controller Hub (PCH). Earlier iterations were running on ThreadX RTOS embedded in the Northbridge. To my understanding some systems, but not all, implement wakeup-on-LAN for the ME, even, when the system is shut down but is still connected to a power source (which is true for most modern machines).
  - stephenr 9y ago
    Yes, my mistake - I read about AMT and conflated the two. Lesson: don't read things when half asleep and then think you understand what you read.
aidenn0 9y ago
Raptor makes a setup that is open and high-end, but it is really expensive. $2400 for just a 4-core CPU and motherboard. https://secure.raptorcs.com/content/TL2B01/purchase.html https://secure.raptorcs.com/content/TL2B01/purchase.html

jchw 9y ago

It's a balancing act. I don't believe I need absolute 100% control of all things going on in my computer; if I did, I wouldn't be able to utilize it anyways. It's pretty telling that Intel ME has been largely invisible to even savvy users until recently. Having competition is probably part of what's needed to ensure that there's some control. The problem is that none of the competition is currently approaching it from a user freedom standpoint. After all, most companies making processors are publicly traded and even if they weren't, need to sell a huge volume of them to break even and have decent per-unit costs. So trying to target what is unfortunately a very tiny niche of users isn't going to go well. And for the truly paranoid, it's impossible to prove that the processor wasn't tampered with, that there isn't a ring below yours. You can really only ever get to the point of being able to reasonably doubt the existence of it, which won't satisfy everyone. I think Intel is digging its own grave by taking the worst stances on issues of user freedom. Eventually, if Intel ME's power over the machine continues to increase, something bad is going to happen as a result of it, and it's going to erode the already fragile trust people have in them. The ME exploit was part 1 of that. But what about companies like AMD, or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom? There's no imaginable consequence for that. And there's no real benefit of reversing course, either. I can't see a future where open computing will be anything more than an extreme niche with sub-par options. One of the better scenarios I can think of is that computing as we know it today becomes a niche itself and a lot of the users do value privacy and security. This seems plausible the better that Chromebooks and phones and tablets get; the average user won't need a computer tower or a laptop with 16 GB of RAM. But I imagine it won't be good news for the prices we currently enjoy :)

dman 9y ago
Lot of good insights in this comment.
userbinator 9y ago
or the hundreds of ARM manufacturers that take a more passive route of not caring about user freedom? I think ARM SoCs are even worse. Try finding a full (or just partial) datasheet/technical documentation for anything like the ones used in recent smartphones and tablets, for example. They are going to want a NDA. The only ones publicly available were leaked. They also differ significantly between each other and often even within the same model line, so it's nothing like a PC where a lot of things still remain relatively standard. ARM also has TrustZone, their DRM technology of which there is almost no public documentation.
- sweden 9y ago
  TrustZone is not DRM nor a management engine like Intel's ME. It is just a reference design in order to implement some sort of sandbox and security zone in the SoC. ARM doesn't mandate how TrustZone is used, it just provides the technology. If SoC designers use it to force DRM into their products, it's not really ARM's fault. Also, just to make it clear, it is not ARM's fault if ARM based SoCs lack proper documentation.
  - subway 9y ago
    It's at least partially ARM's fault, as ARM doesn't publish documentation for their cores. SoC vendors are just as bad, if not worse, but ARM doesn't get off scott-free.
    - pm215 9y ago
      Eh? Here's the TRM for the Cortex-A57, to pick the first arm core I thought of: https://developer.arm.com/docs/ddi0488/c/preface https://developer.arm.com/docs/ddi0488/c/preface The architecture manuals are also downloadable.

analognoise 9y ago

Running a multibillion dollar silicon foundry costs money. You're always welcome to design your own chips, then barter for them with pelts. The result of this project thus far is totally underwhelming and I'd think whoever was donating to it not only didn't need that computer and could wait an indefinite amount of time for one, but is likely throwing their money away and may never get a product.

deleted 9y ago
[deleted]
profquail 9y ago
This project isn’t about designing CPUs, so “running a foundry” is irrelevant. They’re working to build a laptop that’ll run an off-the-shelf POWER-based CPU, which is complex but still massively simpler than designing and building the CPUs themselves.
- profquail 9y ago
  Correction: I meant PowerPC, not POWER. The latter is not likely to fit comfortably in a laptop. If you want a POWER-based workstation, check out the Talos II from Raptor Computing.
  - aidenn0 9y ago
    Actually the PC suffix has been mostly dropped. See e.g. [1] which is much lower end than what would fit in a laptop. 1: https://www.nxp.com/products/microcontrollers-and-processors/power-architecture-processors/mpc5xxx-55xx-32-bit-mcus/ultra-reliable-mpc57xx-32-bit-automotive-industrial-microcontrollers-mcus/ultra-reliable-mpc5777c-mcu-for-automotive-industrial-engine-management:MPC5777C https://www.nxp.com/products/microcontrollers-and-processors...

microcolonel 9y ago

I'm hoping for RISC-V to come through, because it has a chance to commodify even further than OpenPOWER could (due to exercising somewhat less control at the point of control for the trademark, and having a design which will suit more levels of designers, possibly allowing designers to enter new markets more readily). That said, the current POWER designs perform very well, so they might be a good interim solution for me.

sweden 9y ago
RISC-V is just a green card describing an ISA, is not even a design. It is as open as OpenPOWER but way less mature.
andreiw 9y ago
RISC-V may do that tomorrow, but Arm servers are doing that today. You how a wide range of solutions with different CPUs in a variety of formats and compute power, from uCPE and IOT gw boxes all the way to high-density OCP designs with terabytes of RAM and a hundred cores...all compatible at the software and firmware level.
- retailbuyout 9y ago
  Let me know when an affordable arm board with ecc support comes along, wholesale or “call for price” not allowed. Because as it stands it might as well be sparc or mips in how accessible the hardware is. Wait, who am I kidding: mips is still great.
  - andreiw 9y ago
    Easy. SoftIron.com. No quotes, just order. Also, calling is easy. https://www.phoenicselectronics.com https://www.phoenicselectronics.com will sell you a Gigabyte MT30-GS2 (Cavium ThunderX 32-core) 1U system for around $2k. If you want to provide your own ATX case - much less. Hardware is accessible, but there are a lot of big players buying things en masse, and the market isn’t oversaturated. This means long lead times and some price fluctuations. But things have been getting much better with every year (out of Arm servers’s whole 3 years of public availability). Definitely more accessible than anything OpenPower (which sadly will set you back the price of a small used Kia). The recent launch of third-gen Arm servers like the Qualcomm Centriq will lower the price for older kit. This is yet another SBSA board with a low price and 1-click order: https://www.solid-run.com/marvell-armada-family/armada-8040-community-board/ https://www.solid-run.com/marvell-armada-family/armada-8040-... All ECC.

stephenr 9y ago

My understanding is that Intel management engine can absolutely be disabled, and isn't enabled at all on some vendor computers, eg Apple. So while ppc is interesting for certain applications, I think the sky-is-falling type message is kind of off putting here.

turblety 9y ago
Your understanding is incorrect [1]. Intel ME is another processor running the MINIX operating system. It is used on all Intel chips made since 2008 and can not be disabled. It even contains a JVM for running Java. Inside that operating system contains modules (or "apps") that are running, some even when your computer is "turned off". For example, one application is AMT which can allow you to remotely control your computer, another is an app that controls the turning on of the fan. There are generally two versions of the firmware which can be used. A light version normally used for personal computers and a heavy version normally used for servers. The light version doesn’t contain the AMT module, the heavy one does. If you are using the firmware that includes AMT, it can be disabled. The problem is we don’t actually know what other modules are running, who can run modules and which ones use network access. 1. https://libreboot.org/faq.html#intelme https://libreboot.org/faq.html#intelme
- masswerk 9y ago
  This is true for the latest iterations, where MINIX 3 is embedded in the Platform Controller Hub (PCH). Earlier iterations were running on ThreadX RTOS embedded in the Northbridge. To my understanding some systems, but not all, implement wakeup-on-LAN for the ME, even, when the system is shut down but is still connected to a power source (which is true for most modern machines).
- stephenr 9y ago
  Yes, my mistake - I read about AMT and conflated the two. Lesson: don't read things when half asleep and then think you understand what you read.

aidenn0 9y ago

Raptor makes a setup that is open and high-end, but it is really expensive. $2400 for just a 4-core CPU and motherboard. https://secure.raptorcs.com/content/TL2B01/purchase.html https://secure.raptorcs.com/content/TL2B01/purchase.html