For the moment, i’m not asking anything other then how to make this happen, pointing to Qubes user base as being the target for such platform. I’m not either a finance person, have zero crowdfunding knowledge, and not a silicon person nor hardware maker myself. This is why I’m saying that this will need collaboration to even have numbers you are asking for.
Power9 CPU is targeted at servers, and used in workstation. Doing a CPU for laptop/mobiles will definitely be a custom design. The point here is: would there be interest. Enough for lets say Raptor to dig into those, and come out with something more precise to get some funding without having to cover all the design and engineering from their own profits, and or, launch a crowd funding effort (let’s remember that Talos I crowd funding didn’t fly and failed.)
No clue, but that CPU could be used in other open source hardware designs. It all depends on what is desired there. I’m pretty sure the idea there would be to have a CPU to be sold on other SOC and platforms, not only one motherboard otherwise the cost would be too high. There is no such thing as doing limited productions of CPUs… That would be suicidal investment. This is probably why nobody is doing it.
I have no idea how to make this work. What I know is that 3BTC were offered by community members that wanted to see Qubes supported on PPC64LE, referred in past post. That Xen port is now happening. But slowly (inflation, recession, some of those funds having gone to KVM port which was easier then doing a whole Xen port for unsupported architecture).
I know that I was crazy enough to fund the first coreboot port for Power9 on Talos II Talos Lite.
My question here is who is next doing crazy moves to have the future we want to have? Or is everyone else just magically waiting for others to do the work?
Exactly the problem and reasoning for why we are still stuck in a nearly exclusive x86 world for global market computing. You pay a higher price, but in more hidden ways right now, in terms of freedom and user xonttollable ways. With more and more locking of platforms and security mechanisms. Donating/ reinvesting to Xen port, Qubes port requires a really long term vision as of now, agreed. Investing into alternative OpenPower CPU would permit some return on investment if the intention after that is to create platforms and selling them. Again long term. Investing in coreboot port means having additional services/customizations offer in mind based on open source. We do not consider firmware as an investment as of now because we think of coreboot and seabios/grub payloads. But Dasharo is slowly changing that. Having prime services, prime support, a say in the development of features. Firmware as a service.
An example here could be to have, directly in firmware, the possibility to restore your Qubes installation from a remote SSH server, at the condition that your public key is recognized by that server. So here, a service offered directly from the pre-boot environment. the end-user dream of having trustable and revertible states could be offered as a service. Deploying new templates, like Windows. Deploying templates oriented to specific use cases, like redaction, communication. Without any contradiction with the idea of open source. But paying for services and support, added value. See?.
Coreboot may be free, but cannot magically natively initialize hardware anymore without depending on FSP blobs. Coreboot is more like a shimboot now, basically using FSP to do most of the hardware init, and does some glue to be able totune what it can prior of passing control to payloads. There is not much open sourceness there anymore. Same applies to Agesa for AMD, PSP/CSME(ME) to pass control to main CPU etc.
Those are the current costs, which is the actual scam. But that is a perspective game. Why are there only old 2012-2013 platforms certified right now? Because those are the last platforms coreboot natively initializes. You go one generation further on x86 with Haswell (t440p) and you need MRC blob to init ram. And if we had native initialization of that ram, we could have 32gb of ram on that board. With TXT, and also SRTM (meaning that ACM blobs could be used at user’s advantage to use the main CPU instruction to measure the bootblock and have a real Root of Trust into hardware, without having Intel’s FSP blobs).
Each and every single platforms after that requires FSP, MRC blobs, MCSE(ME blobs) and more and more are added in flash, or hidden on additional flash chips on the motherboard. This is the scam that is actually happening since 2008 with the addition of another non-user controller CPU in our machines, controlling the main CPU. And things are just going faster and faster. Ivy bridge (2012) is the last platform not needing blobs to initialize the platform from a coreboot perspective. Ivy is the last platform permitting to neuter ME, removing its kernel and syslibs in flash. After that generation of platform, Intel understood and decided to put more modules under signature check, adding kernel and syslibs into the ME(now CSME) flash (ME descriptor region under flash).
On the other hand, Power9 doesn’t require any of those. Talos (Raptor) reversed all the blobs and upstreamed open versions, including the ASpeed BMC. But the problem there is that only IBM is producing the processors. Power10 requires blobs on memory controller. They, as everybody else, took a turn to decide for us what is best for us. Let it be a economy based direction (pandemic hit us all) to survive or whatever other reason (they also had a legal fiasco with their foundry for CPU production as well for Power10) it seems that they needed to reduce costs for production. And unfortunately, decided to use patent/blob based components for the moment to produce their next gen (Power 10). I’m not the most knowledgeable in the area, and learning my way testing coreboot on my Talos II to attempt to push things farther there.
But as I said before, nobody here (Qubes community) will get interested to buy a Talos II if Qubes cannot run on it? And like I said earlier as wel, the path to have Qubes running on Talos II (Power whatever version) requires Xen to have Qubes supported, and tested… This is a long run before user consumable product. Who funds this?
People that want o have this happen. The more people who will want to see this happen, the more chances it has to happen. And again, other then understanding what is missing to have this happen and doing what I can to make it happen, I do not know how to make this happen faster. And writing those lines to see who wants this to happen, and how. Outside of just passively waiting for someone else to make it happen. I have invested a lot personally in this journey, without a clear view of how to make it economically viable. Because it needs to happen. In the hope that the community would jump in. I’m still waiting for the community to jump in.
And this post is about two platforms, right? Two platforms without FSP, without ME, user controllable. But the funny part of this is that both those platforms won’t have Qubes OS fly. X200 is too old. Its virtualization extension (vtx) requires microcode updates (so no libreboot here, because politics) and doesn provide vt-d2 nor interrupt remapping, while Raptor Talos II (Power 9) doesn’t have Xen support, because Xen dropped support (politics, economics) on PowerPC a while back because KVM had a bigger ecosystem and bigger community (if I recall well). But here, KVM is not really desired for Qubes (not the subject).
So again. How would you resolve this chicken egg problem? Every manufacturer will go into designing boards that has the most userbase (x86, AMD/Intel), paying royalties to pay for chipsets already existing and buy already existing matching CPUs to sell at the lowest cost possible. But we know, in accelerating pace since 2008 that this path is locking the platforms we use more and more, and once we open the can of worms of what blobs we depend on, every security cautious person will be worried on what we currently depend on for computing. We compartmentalize, yes, and decide to live in denial about the components in each of our computers that have access to all RAM, accept SMM existence on x86 etc, just because we lack other, better choices. But when its time to talk about what it would take to create such better alternatives, people expect some other rich person to pay for all the R&D, testing and manufacturing prior of having a return on investment. Do you realize that this limit the possibility of creating such alternatives only by the present rich companies? Investing for years to have a coreboot port on Power without having it yet released because not enough tested is not providing any return on investment, and I am no billionaire here. I’m just doing my best. And I expect others to do the same to see alternatives happening in the future. Otherwise, they won’t happen. cost of alternative platforms will not become cheap and accessible. They will stay niche.
Do we all understand the mechanics at play here?