Weekend Discussion: How Concerned Are You If Your CPU Is Completely Open?

[coder]

Maybe you can be more detailed here. What do you mean "via unknown transistors" exactly?

I think he's concerned about your transistors being spied upon via quantum entanglement with transistors somewhere in East Asia or maybe a listening post in Cyberia.

[wizard69]

A lot of bugs are easier to find than fix.

That is exactly what I was saying.

I'm not saying these ones are, but I think you're prejudging an outcome on the basis of almost no information. How much do you even know about modern CPU design? What do you consider a reasonable amount of time for the fixes to be rolled out? Please justify your answer in terms of their development cycle.

to further develop on the point one can imagine that the Intel engineers working on resolving some of these issues have decades of experience and work as a team. The fact that it takes these people so long to fix Intel vulnerabilities highlight the futility of having somebody with zero time in the trenches doing anything significant with the design. I really don't see the point. The number of people that can do something useful with a hardware description, like Intels current processors, is so thin as to not even make sense to argue the value in opening hardware.

Now that doesn't mean open hardware is bad. It is certainly a good place to train the next round of engineers. What I don't buy is that open hardware has any value to the population in general, the reason is the massive wall one would have to breach to do anything constructive with a hardware description. Beyond that what does one do i they should by chance find a bug in a piece of hardware, most of us can't spin our own.

I think some of Intel's side-channel vulnerabilities weren't necessarily unintentional. I'm not accusing them of intentionally introducing them, but I think they were cutting corners because they deemed such vulnerabilities as low-risk and were simply hoping that nobody would notice.

Possibly. I'm not in contact with any Intel engineer at the moment so don't even have one flavour of opinion on that matter.

Keep in mind that even full hardware fixes for some of them cost die area and performance. So, there's your incentive for being fast-and-loose, on security.

Actually it sounds like more and more that it is a management issue that downplayed the importance of security or simply proper operation of the CPU. It is notable that AMD, with far fewer resources and far fewer engineers, has done far better with respect to the recent "Intel" problems.

[torsionbar28]

Not sure if up to double, but I'd pay significantly more for an open hardware as well.

And this is why it will never happen. Modern x86 CPU's are as inexpensive as they are due to volume. The design and fab costs are static, and they are very very VERY expensive. In order to be profitable (i.e. a worthwhile endeavour for someone to pursue) you have to sell many millions of chips each year. If you only sell a few thousand, or less, because it's such a niche geek product, then buyers can expect to pay something like $50k per unit. Ain't nobody gonna pay that, so ain't never gonna happen.

The fact is, open CPU's simply cannot happen until the manufacturing fab process becomes commodity level. Basically what 3D printing has done to polymer prototyping. There is nothing even remotely on the horizon for bringing chip fab to consumer level, so if it ever happens, it's so far in the future that it's not worth discussing. DIY chip fab is today is like the flying cars in popular mechanics magazine half a century ago.

[torsionbar28]

The value in a completely open CPU is only with international economic giants who don't trust the supply chain and source coming from other corporations and countries.

Basically, that's no one. Outside of foreign intelligence agencies anyways. The industry trend is to not give a crap about hardware, and move all your stuff to the cloud. I.e. someone else's hardware. The fact is, nobody gives a crap about this "open CPU" talk anymore except geeks and academics. I'm not saying the arguments aren't valid, I'm just saying the whole Cloud trend has rendered the argument obsolete for essentially every corporation in the world. Without a customer base for this stuff, it will not be taking off any time soon.

[mearon]

I'm not sure about POWER; I would like to have it available, but it seems it's only available for larger, costly enterprise systems.

Open Source CPU firmware is more important now than ever. Security through obscurity is a fallacy. Having the ability for more people to test and scrutinize the stability and security of any system has been proven to be important. So, for what it's worth, bring it on! Open everything!

FWIW, have you seen the stuff from Raptor Computing Systems? They sell POWER9 mainboards / workstations which are quite open (schematics available + completely open firmware stack). It's about 2k USD for a complete system if you just buy the mainboard+CPU bundle and assemble it yourself, so yeah, it's more than what you would pay for a comparable x86 system, but on the other hand it's also more open and has some other niceties like solid engineering and extra-durable components.

I can't help it, but to me it just feels wrong to depend on closed FW blobs which are several MiB in size to be able to run my hardware, which I cannot inspect nor repair. There are many low-level vulnerabilities these days, and you depend on the vendor to fix them in the firmware/microcode. Also, I have a feeling that the code quality of many closed-source firmware is quite bad, which is kind of not nice. It's not a problem per se, but I don't know, I'd rather not have the critical low-level components of my PC be a mess of spaghetti code à la "oh it compiles, great, let's ship it".

Regarding the second part of the quote:
Yes, I think open source firmware becomes more important these days. It is important to realize that open doesn't directly imply more secure/trustable. But at some point, it becomes a necessary condition for a trustable system. And having trustable systems is becoming more important these days because more and more of our lives and big parts of our society build on IT.

[mppix]

You did no such thing. The Clipper Chip reference was a non sequitur. That was my whole point.
All you did was reply with a non sequitur to my reply.
BTW, had you included those links in your original post, I'd have had nothing to complain about, and wouldn't have made the first reply.

Hillarious, but I'll edit the original post for you

[mulenmar]

Drag the older fab tech out of mothballs if we have to, to drive the price down -- give me an open, multicore CPU with Rowhammer-proof memory and at least USB2, slap it on a board with open, non-arsebackwards boot firmware (GPU booting the CPU, indeed! Silly Pi...), toss in storage that doesn't get bottlenecked by USB overhead, call it a day.

Oh, right, we need royalty free open SATA/whatever controllers, memory chip designs, USB2 controllers, and all that. Whoops, there goes the cost!

What we need is open firmware and specifications, and the source of the part of the Windows kernel responsible for built-up ACPI/UEFi/what-have-you stuff so we know *exactly* needs done on the stuff that refuses to boot correctly for anything else.

Work from there.

Heck, make some big FPGAs with open programing toolchains, let people temp-manufacture their own CPUs.

[qarium]

I really do not get the point of all the hate against IBM open-POWER...

in my point of view it must really be "the Holy Grail" of IT industry if all this negative people are against it.

so much babbling they claim intel won the ISA war and all other is death but this is complete wrong.
in fact INTEL lost the ISA war because AMD 64core cpu in 7nm proof that you can have the inferior ISA compared to the newer intel one and you can still win.
this means Intel lost their own ISA-War game.

because of this in the future the CPU ISA will become something you do not even need to know about because what Vulkan did to
GPUs will the bytecode Webassembly do to the CPU-ISA war. in near future all software will use Webassembly as a compatibility layer to make it compatible to all CPU ISAs on planet earth.

so in fact Intel lost the ISA war so big than the result is not even in the nerd/geek IT insiders mind YET....

this negativ low mindet people claim IBM Open-POWER ISA is death but they will just write a "bytecode Webassembly" layer and then no one cares about the CPU ISA anymore.

[azdaha]

I really do not get the point of all the hate against IBM open-POWER...

For what it's worth, I don't see it as mere hatred against IBM or POWER. Jon Masters, apparently, considers the POWER architecture to be on life-support at this point. I don't know enough about the situation to claim that he is wrong. What I do know is that it's difficult, if not impossible, to find a viable POWER system for purchase. In fact, personally, I had completely forgotten about it entirely until the announcements about Spectre and Meltdown vulnerabilities. However, AMD was able to benefit from this, as it created an opportunity to differentiate itself from Intel at a time when they were not impacted by Meltdown and by shipping a new line of CPUs and GPUs. The fact that IBM did not take advantage of this phenomenon can be seen as further proof that POWER architecture is on the way out, sadly--following in the footsteps of IBM's former consumer line of products (thinkpads).

[Space Heater]

The fact that IBM did not take advantage of this phenomenon can be seen as further proof that POWER architecture is on the way out.

Spectre affects essentially every processor with speculative execution. Also IBM's POWER 7, 8 and 9 were affected by Meltdown, it's not an Intel-specific problem.

https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/