9 ms·

Intel gets worse, but Power11 might get better

mbarbar 5y ago
>And if simple humanpower really was the reason IBM took shortcuts Is this referring to the closed blobs on Power10? Is there anywhere to read more? And is there any indication Power11 won't suffer the same? Someday POWER9 won't cut it for performance...
- monocasa 5y ago
  The blobs on POWER10 as I remember were firmware for the memory sticks themselves since it used OMI to talk to the DIMMs, and IBM had to get third party OMI<->DDRX controllers. I see why they could have reason to believe that situation could change.
- octoberfranklin 5y ago
  This has been echoing around the internet the past few days, but all the echoes lead back to this one comment: https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1311150-future-intel-systems-to-reportedly-be-even-less-friendly-for-open-source-firmware/page2#post1311211 https://www.phoronix.com/forums/forum/phoronix/latest-phoron... So really it's just one guy on phoronix who made that claim. Probably just wishful thinking. But if it is true, everybody with first-hand knowledge of it would be under NDA. So we'll probably never know.
ChuckNorris89 5y ago
>By the way, don't expect AMD to act any better. Remember that they're the company bringing you Pluton: quoted from the article, "Pluton will also prevent people from running software that has been modified without the permission of developers." It wouldn't be surprising to see AMD's Platform Security Processor pick up additional lock-in capabilities to reinforce this and other vendor controls. So the title should be Intel and AMD are getting worse.
- loeg 5y ago
  The whole thing is wild speculation.
- based2 5y ago
  https://arstechnica.com/information-technology/2022/01/pluton-microsofts-new-security-chip-will-finally-be-put-to-the-test/ https://arstechnica.com/information-technology/2022/01/pluto...
- agumonkey 5y ago
  I'll be so happy to drop advanced processors and go back to esp32 / risc-v based machines running my tiny OS and my tiny lisp repl
  - analognoise 5y ago
    I've been thinking the same thing, but on an FPGA. Just ditch the whole thing and live in an alternate computing reality.
    - donkarma 5y ago
      sounds like the precursor https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
- mjg59 5y ago
  I've seen literally zero evidence that the assertion that Pluton will prevent you running modified software is true.
  - userbinator 5y ago
    They learned from the whole "trusted computing" experiments in the late 90s and early 2000s that restrictions need to be introduced slowly. It's not hard to see where they're going though. Related discussion: https://news.ycombinator.com/item?id=29859106 https://news.ycombinator.com/item?id=29859106
theandrewbailey 5y ago
> (wars, pestilence, <s>locusts</s> and inflation notwithstanding) I wouldn't be so quick to discount locusts. There was a big swarm of them not long ago. The world is growing crazier by the year. https://www.npr.org/sections/goatsandsoda/2020/06/14/876002404/locusts-are-a-plague-of-biblical-scope-in-2020-why-and-what-are-they-exactly https://www.npr.org/sections/goatsandsoda/2020/06/14/8760024...
- jtbayly 5y ago
  Big Locust swarms are not a new thing. It would be a crazier world if they completely stopped.
ohazi 5y ago
All of this complexity that's being added to lock a system down, purportedly in the name of "security" is actually being done for control by the vendor, at the expense of control by the user. Microsoft wants an enforceable walled garden just like Apple's. The increased attack surface that all this brings, implemented in a way that's opaque and non-removable, makes me incredibly nervous. You think cars and IoT devices are insecure? We're going to end up with that level of danger baked into every PC on the planet.
- Animats 5y ago
  You think cars and IoT devices are insecure? We're going to end up with that level of danger baked into every PC on the planet. Tolerance for that among business customers may have just decreased substantially due to the current war.
  - hulitu 5y ago
    I would not bet on this. Purchases are made by department leaders based on beautiful Excel spreadsheets which have little to no relation to reality.
- slaymaker1907 5y ago
  I thought this was initially FUD, but this in particular sounds bad. TPMs really do enhance security since it massively increases the security for even weak passwords (which 90-95% of them are). However, any security feature should be zero cost such that if you don't use it/want it, it doesn't restrict what you can do. Secure Boot at least can be disabled most of the time and that is one of the most locked down features. Random tangent: I really wish we had a better way to customize code signing and verification. For very sensitive environments, you should be able to only trust certain certs/roots for particular binaries. I'd like to enforce that for some particular python script, it has been signed by one of *my* CI servers. Obviously this is possible, but I think you would need to roll your own code.
  - salawat 5y ago
    Secure boot can only be disabled on x86/_64 systems. It is decreed that ARM systems not be user deactivatable.
wmf 5y ago
I'm calling BS on all this. 1. Today we have FSP blobs but in the future we're going to have (menacing voice) Scalable FSP blobs. I consider Coreboot people to be unreliable narrators since Coreboot is feature-poor and isn't free from blobs anyway. 2. Pluton is going to be required for Windows so Intel, AMD, and Qualcomm will all have it. Resistance is futile. (It is really dumb that MS is FUDding themselves by not documenting Pluton.) 3. AFAIK Power10 was mostly finished before the pandemic. The switch from GloFo to Samsung and IBM's lack of experience with the Samsung process is more likely the cause of the third-party IP. Even if it was fully open the price/performance would still suck like all Power generations.
- oneplane 5y ago
  Since Windows is going to be irrelevant anyway (run everything in a browser, stream everything 'heavy', now the local OS is just a 'viewer'), and most 'connected' users on the planet are using a phone and whole generations grow up only ever using a phone for media/games/productivity and never touching a laptop/pc, all this will do is make Windows a niche. Coreboot might not be perfect, but until there is enough powerful hardware (like ARM and RISC-V that isn't just multi-core but also has enough single-threaded performance) it's not like you're going to be able to run free and libre firmware on reasonable hardware (and no, pre-CSME hardware and pre-FSP hardware is not reasonable, it's just old at this point). I hope POWER and ARM and later on RISC-V are getting powerful enough to not have to trust a CSME or FSP in the long run, but I doubt it. Even just having a PAVP DRM is something that is pushed by various corporate legal departments so hard that all the hardware that ends up in consumer land is going to be hobbled one way or another. I'm afraid we'll end up in a world where you can get that libre and free stack on high performance hardware, but won't get access to all the IP, including IP cores for embedded FPGAs and IP like streaming media including audio, video and games.
  - no_time 5y ago
    >I'm afraid we'll end up in a world where you can get that libre and free stack on high performance hardware, but won't get access to all the IP, including IP cores for embedded FPGAs and IP like streaming media including audio, video and games. Exactly. Also what worries me is that all it takes is one significant terrorist event to be organized over a libre software stack to get all this treachery in computing to become law too.
HstryrsrBttn 5y ago
At the end of the day: who cares that IBM wasn't able for whatever reason to supply a open CPU? If they fail to reliable provide that: sadly shows how weak that platform is Without any commitment to a future openness that can rapidly become an expensive cul-de-sac for anyone willing to develop for it.
- nine_k 5y ago
  Who cares? Possibly DoD.
calvin_ 5y ago
RCS dying on the hill of DDR training blobs seems a bit ridiculous to me when the system is much better elsewhere. RYF in action!
- octoberfranklin 5y ago
  It's not a training blob. It is an entire CPU, with its own firmware, sitting between the CPU and the DRAM chips. It has the bandwidth to examine every single memory access, which is something the Intel ME and PSP never had. I am extremely impressed with Tim's integrity. His decision to stand up to this nonsense has and will cost his business dearly, but it has won him him the kind of credibility that can't be bought at any price. People remember stuff like this for a long, long time.
userbinator 5y ago
The ISA is really irrelevant for these discussions on freedom. Once it gets popular for long enough, companies will start putting in these hostile features. x86, RISC-V, ARM, POWER, whatever. They all started out without the "security". I could just as easily imagine an alternative world where "Power11 gets worse, but Intel might get better" or any other combination. Related: https://news.ycombinator.com/item?id=29273829 https://news.ycombinator.com/item?id=29273829
superkuh 5y ago
Power11 is good, but doesn't it also use a novel serial RAM interface with closed proprietary firmware? This is less in the way than proprietary mobo firmware, but for purists, or those with extraordinary needs, it may still be an issue.
tyingq 5y ago
I think there's also a change in the server market where there's going to be (already is?) two pillars. So cloud vendors can pressure Intel/AMD into exclusive features, or turning off features they don't like, etc. Where Dell/HP/others increasingly lose that kind of leverage. Basically less of the vendor leverage bubbling down to normal end user owners of hardware.
yuhong 5y ago
snorrah 5y ago
"Pluton will also prevent people from running software that has been modified without the permission of developers." I don’t understand, why is this a downside?
- userbinator 5y ago
  Because to truly own something, you should also be able to modify it to do what you want.
physicsguy 5y ago
I'd never buy a POWER11 system given that IBM barely supported our POWER9 cluster, and we ended up compiling everything ourselves for it, with many, many errors and problems. Any difference in cost is more than made up for with the amount of staff time spend trying to fix bizarre compiler bugs.
- pabs3 5y ago
  What did you have to compile? Most Linux distros have a fully supported ppc64el port.
  - physicsguy 5y ago
    Pretty much every Python + scientific package (and these days, why else would you buy a P9 cluster but for that kind of work?)
    - pabs3 5y ago
      Some of the Linux distros (like Debian) already include that sort of stuff. For eg the Debian Science Team have packaged a lot of difference types of scientific software. The Debian Python modules team packages a lot of different Python modules too. https://blends.debian.org/science/tasks/ https://blends.debian.org/science/tasks/ https://wiki.debian.org/Teams/DebianScience https://wiki.debian.org/Teams/DebianScience Edit: of course a lot of more modern science and ML stuff is notoriously difficult to package, with pre-generated files, vendored code, lock files and so on.
      - physicsguy 5y ago
        Yeah, I am aware of that, but Linux distros package very old versions, and we need to be able to support multiple for users. Realistically, academic researchers like to use 'bleeding edge' type things. Generally a big HPC cluster comes with RHEL too and a support contract, because you need the drivers for the hardware - things like Infiniband networking, etc. so switching distro isn't an option really.

>And if simple humanpower really was the reason IBM took shortcuts Is this referring to the closed blobs on Power10? Is there anywhere to read more? And is there any indication Power11 won't suffer the same? Someday POWER9 won't cut it for performance...

monocasa 5y ago
The blobs on POWER10 as I remember were firmware for the memory sticks themselves since it used OMI to talk to the DIMMs, and IBM had to get third party OMI<->DDRX controllers. I see why they could have reason to believe that situation could change.
octoberfranklin 5y ago
This has been echoing around the internet the past few days, but all the echoes lead back to this one comment: https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1311150-future-intel-systems-to-reportedly-be-even-less-friendly-for-open-source-firmware/page2#post1311211 https://www.phoronix.com/forums/forum/phoronix/latest-phoron... So really it's just one guy on phoronix who made that claim. Probably just wishful thinking. But if it is true, everybody with first-hand knowledge of it would be under NDA. So we'll probably never know.

ChuckNorris89 5y ago

>By the way, don't expect AMD to act any better. Remember that they're the company bringing you Pluton: quoted from the article, "Pluton will also prevent people from running software that has been modified without the permission of developers." It wouldn't be surprising to see AMD's Platform Security Processor pick up additional lock-in capabilities to reinforce this and other vendor controls. So the title should be Intel and AMD are getting worse.

loeg 5y ago
The whole thing is wild speculation.
based2 5y ago
https://arstechnica.com/information-technology/2022/01/pluton-microsofts-new-security-chip-will-finally-be-put-to-the-test/ https://arstechnica.com/information-technology/2022/01/pluto...
agumonkey 5y ago
I'll be so happy to drop advanced processors and go back to esp32 / risc-v based machines running my tiny OS and my tiny lisp repl
- analognoise 5y ago
  I've been thinking the same thing, but on an FPGA. Just ditch the whole thing and live in an alternate computing reality.
  - donkarma 5y ago
    sounds like the precursor https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
mjg59 5y ago
I've seen literally zero evidence that the assertion that Pluton will prevent you running modified software is true.
- userbinator 5y ago
  They learned from the whole "trusted computing" experiments in the late 90s and early 2000s that restrictions need to be introduced slowly. It's not hard to see where they're going though. Related discussion: https://news.ycombinator.com/item?id=29859106 https://news.ycombinator.com/item?id=29859106

theandrewbailey 5y ago

> (wars, pestilence, <s>locusts</s> and inflation notwithstanding) I wouldn't be so quick to discount locusts. There was a big swarm of them not long ago. The world is growing crazier by the year. https://www.npr.org/sections/goatsandsoda/2020/06/14/876002404/locusts-are-a-plague-of-biblical-scope-in-2020-why-and-what-are-they-exactly https://www.npr.org/sections/goatsandsoda/2020/06/14/8760024...

jtbayly 5y ago
Big Locust swarms are not a new thing. It would be a crazier world if they completely stopped.

ohazi 5y ago

All of this complexity that's being added to lock a system down, purportedly in the name of "security" is actually being done for control by the vendor, at the expense of control by the user. Microsoft wants an enforceable walled garden just like Apple's. The increased attack surface that all this brings, implemented in a way that's opaque and non-removable, makes me incredibly nervous. You think cars and IoT devices are insecure? We're going to end up with that level of danger baked into every PC on the planet.

Animats 5y ago
You think cars and IoT devices are insecure? We're going to end up with that level of danger baked into every PC on the planet. Tolerance for that among business customers may have just decreased substantially due to the current war.
- hulitu 5y ago
  I would not bet on this. Purchases are made by department leaders based on beautiful Excel spreadsheets which have little to no relation to reality.
slaymaker1907 5y ago
I thought this was initially FUD, but this in particular sounds bad. TPMs really do enhance security since it massively increases the security for even weak passwords (which 90-95% of them are). However, any security feature should be zero cost such that if you don't use it/want it, it doesn't restrict what you can do. Secure Boot at least can be disabled most of the time and that is one of the most locked down features. Random tangent: I really wish we had a better way to customize code signing and verification. For very sensitive environments, you should be able to only trust certain certs/roots for particular binaries. I'd like to enforce that for some particular python script, it has been signed by one of *my* CI servers. Obviously this is possible, but I think you would need to roll your own code.
- salawat 5y ago
  Secure boot can only be disabled on x86/_64 systems. It is decreed that ARM systems not be user deactivatable.

wmf 5y ago

I'm calling BS on all this. 1. Today we have FSP blobs but in the future we're going to have (menacing voice) Scalable FSP blobs. I consider Coreboot people to be unreliable narrators since Coreboot is feature-poor and isn't free from blobs anyway. 2. Pluton is going to be required for Windows so Intel, AMD, and Qualcomm will all have it. Resistance is futile. (It is really dumb that MS is FUDding themselves by not documenting Pluton.) 3. AFAIK Power10 was mostly finished before the pandemic. The switch from GloFo to Samsung and IBM's lack of experience with the Samsung process is more likely the cause of the third-party IP. Even if it was fully open the price/performance would still suck like all Power generations.

oneplane 5y ago
Since Windows is going to be irrelevant anyway (run everything in a browser, stream everything 'heavy', now the local OS is just a 'viewer'), and most 'connected' users on the planet are using a phone and whole generations grow up only ever using a phone for media/games/productivity and never touching a laptop/pc, all this will do is make Windows a niche. Coreboot might not be perfect, but until there is enough powerful hardware (like ARM and RISC-V that isn't just multi-core but also has enough single-threaded performance) it's not like you're going to be able to run free and libre firmware on reasonable hardware (and no, pre-CSME hardware and pre-FSP hardware is not reasonable, it's just old at this point). I hope POWER and ARM and later on RISC-V are getting powerful enough to not have to trust a CSME or FSP in the long run, but I doubt it. Even just having a PAVP DRM is something that is pushed by various corporate legal departments so hard that all the hardware that ends up in consumer land is going to be hobbled one way or another. I'm afraid we'll end up in a world where you can get that libre and free stack on high performance hardware, but won't get access to all the IP, including IP cores for embedded FPGAs and IP like streaming media including audio, video and games.
- no_time 5y ago
  >I'm afraid we'll end up in a world where you can get that libre and free stack on high performance hardware, but won't get access to all the IP, including IP cores for embedded FPGAs and IP like streaming media including audio, video and games. Exactly. Also what worries me is that all it takes is one significant terrorist event to be organized over a libre software stack to get all this treachery in computing to become law too.

HstryrsrBttn 5y ago

At the end of the day: who cares that IBM wasn't able for whatever reason to supply a open CPU? If they fail to reliable provide that: sadly shows how weak that platform is Without any commitment to a future openness that can rapidly become an expensive cul-de-sac for anyone willing to develop for it.

nine_k 5y ago
Who cares? Possibly DoD.

calvin_ 5y ago

RCS dying on the hill of DDR training blobs seems a bit ridiculous to me when the system is much better elsewhere. RYF in action!

octoberfranklin 5y ago
It's not a training blob. It is an entire CPU, with its own firmware, sitting between the CPU and the DRAM chips. It has the bandwidth to examine every single memory access, which is something the Intel ME and PSP never had. I am extremely impressed with Tim's integrity. His decision to stand up to this nonsense has and will cost his business dearly, but it has won him him the kind of credibility that can't be bought at any price. People remember stuff like this for a long, long time.

userbinator 5y ago

The ISA is really irrelevant for these discussions on freedom. Once it gets popular for long enough, companies will start putting in these hostile features. x86, RISC-V, ARM, POWER, whatever. They all started out without the "security". I could just as easily imagine an alternative world where "Power11 gets worse, but Intel might get better" or any other combination. Related: https://news.ycombinator.com/item?id=29273829 https://news.ycombinator.com/item?id=29273829

superkuh 5y ago

Power11 is good, but doesn't it also use a novel serial RAM interface with closed proprietary firmware? This is less in the way than proprietary mobo firmware, but for purists, or those with extraordinary needs, it may still be an issue.

tyingq 5y ago

I think there's also a change in the server market where there's going to be (already is?) two pillars. So cloud vendors can pressure Intel/AMD into exclusive features, or turning off features they don't like, etc. Where Dell/HP/others increasingly lose that kind of leverage. Basically less of the vendor leverage bubbling down to normal end user owners of hardware.

yuhong 5y ago

snorrah 5y ago

"Pluton will also prevent people from running software that has been modified without the permission of developers." I don’t understand, why is this a downside?

userbinator 5y ago
Because to truly own something, you should also be able to modify it to do what you want.

physicsguy 5y ago

I'd never buy a POWER11 system given that IBM barely supported our POWER9 cluster, and we ended up compiling everything ourselves for it, with many, many errors and problems. Any difference in cost is more than made up for with the amount of staff time spend trying to fix bizarre compiler bugs.

pabs3 5y ago
What did you have to compile? Most Linux distros have a fully supported ppc64el port.
- physicsguy 5y ago
  Pretty much every Python + scientific package (and these days, why else would you buy a P9 cluster but for that kind of work?)
  - pabs3 5y ago
    Some of the Linux distros (like Debian) already include that sort of stuff. For eg the Debian Science Team have packaged a lot of difference types of scientific software. The Debian Python modules team packages a lot of different Python modules too. https://blends.debian.org/science/tasks/ https://blends.debian.org/science/tasks/ https://wiki.debian.org/Teams/DebianScience https://wiki.debian.org/Teams/DebianScience Edit: of course a lot of more modern science and ML stuff is notoriously difficult to package, with pre-generated files, vendored code, lock files and so on.
    - physicsguy 5y ago
      Yeah, I am aware of that, but Linux distros package very old versions, and we need to be able to support multiple for users. Realistically, academic researchers like to use 'bleeding edge' type things. Generally a big HPC cluster comes with RHEL too and a support contract, because you need the drivers for the hardware - things like Infiniband networking, etc. so switching distro isn't an option really.