NVIDIA Alerts Nouveau: They're Starting To Sign/Validate GPU Firmware Images

[whitecat]

This isn't about bugs in Nouveau, it's about preventing the latest Internet Explorer vulnerability or whatever from allowing an attacker to burn up your GPU.

AFAIK, this is the kernel role to protect this.

[artivision]

The fact is that real terrorists don't exist. If they were, they would have bombed Nvidia by now, probably.

[whitecat]

No offense to the nouveau or radeon developers, but if I'm dropping $300 - $400 for a GPU I would like to have the drivers made by the company who has the in-house engineering competence to understand the hardware and such.

Most of the Radeon developers are from AMD.
NVIDIA could do the same and provide safe and official open-source driver.

[johnc]

Most of the Radeon developers are from AMD.
NVIDIA could do the same and provide safe and official open-source driver.

That's certainly an acceptable idea for my purchase, like you say as AMD does some of the radeon work and in Intel's case they do all of it. Whether the driver source is open or closed is, in my case, less important than whether it's official.

[erendorn]

Good conspiracy theory is - people can't stop talking about it

Oh god the comment thread on this video :O

[artivision]

That's certainly an acceptable idea for my purchase, like you say as AMD does some of the radeon work and in Intel's case they do all of it. Whether the driver source is open or closed is, in my case, less important than whether it's official.

Wrong basically. When the thing is open then you can benefit from the work of another vendor or other person. That is the reason that Catalyst and many others on ARM space have poor driver quality.

[johnc]

Wrong basically. When the thing is open then you can benefit from the work of another vendor or other person. That is the reason that Catalyst and many others on ARM space have poor driver quality.

That's your opinion based on what you value. Like I said, I was speaking for what is valuable to me. And having official support from the designers of this kind of hardware is more important to me.

Your example is contradicted BTW by the fact that NVIDIA probably has the highest quality GPU driver in Linux, and probably all other platforms as well.

[Calinou]

You really need to go see a shrink. NVIDIA doesn't owe you anything. You don't like their GPUs? Don't use them.

NVIDIA has thousands of mouths to feed. You are only concerned about "freedom". Freedom from what? From rational thinking? Again, NVIDIA is not a charity - it's a company whose sole goal is to make money and survive.

Companies should be ethical, let's try aiming for that. The problem is similar to proprietary software (and NVIDIA is a repeated maker of that).

If you can create an open source GPU which can successfully compete with NVIDIA solutions - go do that. Alas, GPUs are the most complex computational devices nowadays - according to NVIDIA's own estimates over three thousand talented engineers and scientists worked for three years to create Maxwell.

Impossible – you would get sued for patent infringement. NVIDIA patents all the things.

Please, avoid personal attacks.

[johnc]

Proprietary and closed-source software are not unethical.

Let's avoid these personal attacks.

[Luke]

If Chinese vendors are selling small cards w big card firmware, that's a valid excuse

I doubt security is the only reason. This might be related to the "Chinese" versions of high-end GPUs which are old, low end chips with a modified fimrware image.
Plenty of people bought GTX780 cards for 100$... those were actually GTX240 :P

Given that customers defrauded by these cards cannot do anything about it unless they are willing to go to China and sue in a Chinese court, some kind of defense is needed.

A possible compromise defense would be cards that when running unsigned firmware show a watermark screen at initialization, warning new purchasers that they might have been scammed. An even simpler solution would be for all Nvidia cards to print a BIOS/UEFI message identifying the chip at POST, with the code to do this located in the GPU itself and not modifiable by any firmware. This would permit any potential future development of open firmware to proceed, yet ruin the scammer's business. Of course, anybody will still be able to throw any old junk board in a box, call it Nvidia's newest card and dress it up as such, then sell one shipment only of the counterfeit parts. They would not even have to POST, so long as the scammer's truck is down the road by the time that is found out. A card with no firmware at all won't show itself as such until someone tries to run a 3d desktop or program, Nvidia might lock 3d to keep these cards out of OEM computers from China for that exact reason.

At least Nividia has specifically agreed to provide the firmware images in a form that Nouveau can redistribute. Still, I'm just damned glad that hardware good enough for my purposes with no checks for any kind of signatures exists today, this kind of discussion makes me wonder about stockpiling. I just hope the scammers don't start targetting AMD when Nvidia blocks them.

We've been down this road before, when Intel started locking multipliers in the 1990's, not to keep users from overclocking, but rather to prevent OEM's from buying the cheaper chips, overclocking them, then selling them as the higher priced chips and at the price of those chips. Fortunately they were unable to stop front-side bus overclocking on those chips and may not have wanted to, as this would not have been as concealable by an OEM.