Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Graphics Open Source Security Hardware

NVIDIA Begins Requiring Signed GPU Firmware Images 192

An anonymous reader writes: In a blow to those working on open-source drivers, soft-mods for enhancing graphics cards, and the Chinese knock-offs of graphics cards, NVIDIA has begun signing and validating GPU firmware images. With the latest-generation Maxwell GPUs, not all engine functionality is being exposed unless the hardware detects the firmware image was signed by NVIDIA. This is a setback to the open-source Nouveau Linux graphics driver but they're working towards a solution where NVIDIA can provide signed, closed-source firmware images to the driver project for redistribution. Initially the lack of a signed firmware image will prevent some thermal-related bits from being programmed but with future hardware the list of requirements is expected to rise.
This discussion has been archived. No new comments can be posted.

NVIDIA Begins Requiring Signed GPU Firmware Images

Comments Filter:
  • Alibaba (Score:5, Insightful)

    by rsilvergun ( 571051 ) on Saturday September 27, 2014 @11:41AM (#48009099)
    I'm guessing this is a response to Alibaba, where you can buy a $300 graphics card for $100 so long as you're OK with being an $80 card with a flashed bios. Remember folks, if it looks too good to be true it probably is :(.
    • Re:Alibaba (Score:4, Interesting)

      by ThatsMyNick ( 2004126 ) on Saturday September 27, 2014 @12:00PM (#48009217)

      They are selling nvidia cards with a modded firmware? Why? Nvidia is going to change their hardware, and hardware will only accept signed firmware. Fake cards, can choose to simply not do any signature checks on their hardware. Unless the fake cards are real nvidia cards, which for some reason run a modded firmware instead of nvidia singed firmwares, this will have no effect on them.

      This is to simply prevent modding. Modded firmware often pushed the hardware beyond the recommended limits. This is more like some of the android phones only accepting signed firmware.

      • Re:Alibaba (Score:5, Informative)

        by Anonymous Coward on Saturday September 27, 2014 @12:06PM (#48009255)

        I don't think you understand what these fake cards are.

        They are legitimate $80 nvidia cards, flashed with modded firmware to enable cores and clock speeds that the silicon is incapable of handling (Hence why the chip became an $80 card in the first place, instead of a $300 card).

        The modder then puts the flashed $80 card on e-bay for $200 and makes a sweet profit.

        • by Anonymous Coward

          flashed with modded firmware to enable cores and clock speeds that the silicon is incapable of handling

          How do you know the silicon is incapable of handling higher speeds? For all we know, the hardware is capable of the speed, but the official nvidia bios intentionally degrades the speed so nvidia can sell at a lower price.

          • by rsilvergun ( 571051 ) on Saturday September 27, 2014 @12:44PM (#48009521)
            they are capable for a little while. Usually the 90 days to get out of any warranty work. Maybe a few of 'em even run at the clock freqs without crashing. It's not just clock freq either. Nvidia shuts off broken cores in software. You're games might run but they'll crash a lot. What Nvidia's worried about is that You'll blame them for a buggy card and go buy AMD. It has major brand damage potential especially with Alibaba about to become a household word what with their IPO.
            • they are capable for a little while. Usually the 90 days to get out of any warranty work. Maybe a few of 'em even run at the clock freqs without crashing. It's not just clock freq either. Nvidia shuts off broken cores in software. You're games might run but they'll crash a lot. What Nvidia's worried about is that You'll blame them for a buggy card and go buy AMD. It has major brand damage potential especially with Alibaba about to become a household word what with their IPO.

              Why would I not buy AMD anyway?

          • Becasue i trust Nvidia's binning process over some nobody on Alibaba.
        • Re:Alibaba (Score:5, Informative)

          by Mashiki ( 184564 ) <mashiki&gmail,com> on Saturday September 27, 2014 @01:13PM (#48009691) Homepage

          Quite often they're not even unlocking anything. Rather they're doing a dirty hack to change the bios information of the card to display something that it isn't. This isn't all that unfamiliar to those of us who were in the industry back in the mid to late 90's when scammers were resilking(cpu info used to be silk screened on, to counter this it's why all cpu's are now stamped) Cyrix cpu's as AMD and Intel. You only found out what the CPU actually was, when you plugged it into the board and it said "cyrix." And while there are cases of people doing this to binned parts, most of the time the links to enable those pathways are cut before they're made into a gpu to stop people from doing exactly that. And if you're wondering why, it's because Intel ran into a massive problem where fly-by-night companies would unlock the binned CPU, and then actually flashing the microcode to change what the CPU was.

          The cheap and dirty way to unlock CPU's during that time period was to use a graphite pencil across a unfinished path. I think it was pin 14 or 23 on the board. Very nasty problems with Slot 1 cpus.

      • by Anonymous Coward
        nVidia will often use some of the same hardware in their lower end cards as they do in their higher end cards, with some functionality throttled or disabled. Taking one of these lower end cards, and flashing it with a modified firmware meant for a higher end card will sometimes activate some functionality, but at the least the card will report to the OS that it is a better card than it is. Then you jack up the price and sell it to suckers/cheapskates. Again, if it seems like a deal is too good to be true
        • by Anonymous Coward

          >nVidia will often use some of the same hardware in their lower end cards as they do in their higher end cards, with some functionality throttled or disabled.

          Not just Nvida. Everyone in the computer industry bins their silicon the same way. Got an i7 chip with a bad core? you turn it into an i5. got an i7 chip that just doesn't clock very high? It becomes a cheap i7 instead of a K series.

      • Re:Alibaba (Score:5, Interesting)

        by Baloroth ( 2370816 ) on Saturday September 27, 2014 @12:28PM (#48009405)

        They are selling nvidia cards with a modded firmware? Why? Nvidia is going to change their hardware, and hardware will only accept signed firmware. Fake cards, can choose to simply not do any signature checks on their hardware. Unless the fake cards are real nvidia cards, which for some reason run a modded firmware instead of nvidia singed firmwares, this will have no effect on them.

        That's exactly what they are. It's pretty trivial to take, say, GTX 440, and reflash the firmware to report that it's a GTX660. It's extremely difficult to make a fake nvidia card that isn't actually an nvidia card that actually works as a video card and isn't completely obviously a fake. The story [slashdot.org] was even on slashdot.

        • That is interesting. Thanks for the link

        • NVIDIA did that three times with GT430s. They started selling them as fake GT 520s, then they continued with selling them as fake GT 620s, and today they're selling them as fake GT 730 128b DDR3. They're perfectly happy with fakes on the market, they just don't want anyone else to sell them!
          • by Anonymous Coward

            The thing is, nVidia does not sake "fakes". They relabel their own products and guarantee certain specs.

            The 3rd parties sell fakes. They take something like an nVidia card, reflash the bios and resell it as something that is no longer guaranteed by nVidia. They did this before. Take customer card, flashed it as Quadro.

            See the problem?

            Customers can get shafted in the 2nd version and have no recourse. Then because they are ignorant in the first place, blames nVidia for the fuck up. In the 1st version, the cus

      • There was this case in which GT440 where modified to report themselfs as GTX660:
        http://m.hexus.net/business/ne... [hexus.net]

    • Comment removed based on user account deletion
  • f**k nvidia... (Score:2, Insightful)

    by Anonymous Coward

    "NVIDIA, f**k you!" - Linus Torvalds

    • f**k nvidia... (Score:4, Insightful)

      by Anonymous Coward on Saturday September 27, 2014 @11:49AM (#48009153)

      Yeah. F**k Nvidia for keeping scammers from selling faulty video cards with hacked bios's.

      How dare they protect their brand integrity!

      • by smash ( 1351 )
        Pretty much. Also, given the general purpose nature of GPUs now for running "other" code, it's only a matter of time before someone writes malware that lives in your GPU firmware.
      • Re:f**k nvidia... (Score:4, Insightful)

        by Anonymous Coward on Saturday September 27, 2014 @12:13PM (#48009297)

        Nonsense, it's not on Nvidia to stop fake cards, its on law enforcement. All they are doing is fucking everyone into having to use their signed firmware. Its another avenue for NSA style snooping from public and private parties without you ever knowing. No code reviews, no way to know if that signed firmware is actually what you would've compiled from any code snippets they may provide. No way to know if other functions are being executed from withing the code without your knowledge.

        • by armanox ( 826486 )

          It's on nVidia to keep people from counterfeiting cards, it's on law enforcement to punish those who do. It's one of those problems you attack from both ends.

        • by west ( 39918 ) on Saturday September 27, 2014 @12:23PM (#48009373)

          Nonsense, it's not on Nvidia to stop fake cards, its on law enforcement.

          Actually, if it cuts their into sales because purchasing NVidia is perceived as risky, then it makes complete commercial sense to make changes to protect people who think they're purchasing NVidia. It's straight dollars and cents.

          Now perhaps NVidia is only using this as an excuse to launch their evil conspiracy, but as excuses go, it's completely legit.

          (And while I'd love to make fun of you for the evil conspiracy business, the NSA's actual shenanigans have made that impossible. When the utterly improbable has turned out to be true, the completely ridiculous now becomes only highly unlikely...)

        • by JustNiz ( 692889 )

          >> it's not on Nvidia to stop fake cards, its on law enforcement.

          Its no surprise to me that nVidia feel the need to cover their own asses. Waiting for Law Enforcement to step up is a lame joke in most countries.

          I am disappointed that nVidia (at least so far) apparently haven't given the nouveau project the ability to sign or at least proxy-load their own drivers, but on the other hand even after all this time nouveau is (still) a turd that sucks enough to not even just not crash on some nVidia hardwar

          • In fairness there's something about it in the release notes, and a workaround that seems farily easy (no dicking around in the command line)

            http://www.linuxmint.com/rel_q... [linuxmint.com]

            • by JustNiz ( 692889 )

              Thanks for this useful info. I wasn't actually aware that it was a common enough problem that they needed to make a section for it in the release notes, however that just underlines my comments and that it is a singularly inapproriate choice to use nouveau rather than the nVidia blob as the default in a mainstream environment.
              I'm sure that most normal people would easily prioritise robustness, performance and functionality over some purist's anal sense of political correctness.

    • So, they're locking out things that can brick the card (flash ROM/fuses, screw up thermal sensors) and apparently a hint of OS security (the Falcons that respond to userspace commands can no longer access physical memory, only virtual memory). The latter sounds somewhat bizarre, considering the firmware should be fully under the control of the driver, not userspace (I guess/hope?), but not unreasonable. Maybe there are software security reasons for this.

      Nouveau is free to continue using its own free blobs or to switch to nvidia's. If they start adding restrictions that actively cripple useful features or are DRM nonsense, then I would start complaining, but so far it sounds like an attempt at protecting the hardware while maintaining manufacturing flexibility for nvidia. This isn't much different from devices which are fused at the factory with thermal parameters and with some units disabled; the only difference is that here firmware is involved.

      NV seem to be turning friendlier towards nouveau, so I'd give them the benefit of the doubt. If they wanted to be evil, they would've just required signed firmware for the card to function at all. The fact that they're bothering to have non-secure modes and are only locking out very specific features suggests they're actively trying to play nicely with open source software.

  • Fuck That Shit! (Score:2, Insightful)

    by Anonymous Coward

    That's the god damn fucking last straw. All these years I thought Nividia was slowly being dragged into the open by Nouveau. Digging their heals in but still an inexorable movement in the direction of the inevitable. But jesus fucking christ this move is such bullshit, 2 steps forward and 5 steps back. No more nvidia for me. They've just made AMD the only choice for graphics cards.

    • Re: (Score:3, Insightful)

      by smash ( 1351 )
      You know WHY people implement code signing, right?
    • Why not Intel? The latest Intel lines are pretty good (I game a lot on one of those), and have their drivers in the upstream linux kernel.
      AMD is simply so awful in terms of drivers, that it doesn't really matter if the hardware is slightly better.

  • by Anonymous Coward on Saturday September 27, 2014 @11:53AM (#48009177)

    Surely it is impossible to have an opensource software if it needs a key to build it into a runnable program?

    I mean you have the binary but you cannot recreate it from the source without that key to sign it with. The key is part of the source and you don't have it.

    • Surely it is impossible to have an opensource software if it needs a key to build it into a runnable program?

      Of course you can under TiVo's interpretation of GPLv2, so long as the key is not an executable part of the program. The publisher can apply the signature key as part of linking the executable.

      I mean you have the binary but you cannot recreate it from the source without that key to sign it with.

      You're referring "Installation Information" in GPLv3. GPLv2 refers to something similar in "scripts to control compilation and installation", but it's not nearly as explicit as in GPLv3.

    • by mx+b ( 2078162 )

      Surely it is impossible to have an opensource software if it needs a key to build it into a runnable program?

      I mean you have the binary but you cannot recreate it from the source without that key to sign it with. The key is part of the source and you don't have it.

      This is pretty much the reason the GPLv3 was written, to take care of this loophole in other licenses. If there are other parts of the GPLv3 that people don't like, perhaps we can update it and make a nice GPLv4, but many people throw the baby out with the bathwater with their hatred of GPLv3. I think having the ability of signing the keys yourself is an important topic.

  • Well that's just it (Score:4, Interesting)

    by Anonymous Coward on Saturday September 27, 2014 @12:27PM (#48009397)

    I've had it. I don't understand why they don't just release all of the specs of the cards. Why don't they give them away for free? Or provide a 3D-printable download at the very least. Fuck nVidia!

    • I've had it. I don't understand why they don't just release all of the specs of the cards. Why don't they give them away for free?

      This is actually a good question. As I understand it, the answer is that:

      • 1) They don't want to reveal the intimate details of their architectures and/or drivers that they've invested in

      • 2) They don't want to be sued for infringing patents (either by rival GPU companies or, more likely, by patent-trolls)

      Or provide a 3D-printable download at the very least.

      ....what?

  • Torvalds was right.

  • With all this hassle nowadays - I remember the times when nVidia was the only company supporting Linux and was something like the darly child of the FOSS community - which company actually *is* the most FOSS friendly today? Intel? AMD/ATI? Some other company?

    Educated opinions on this needed.

    • Probably whatever GPU is in a Respects Your Freedom certified [fsf.org] laptop such as the Gluglug X60 [fsf.org].
    • Intel has I believe all their Linux drivers fully open sourced. However, they're not really fast compared to AMD or NVidia. AMD has two driver versions, their closed source catalyst driver and the open source one. The catalyst driver is much faster, energy efficient and can do more tricks than the open source one. NVidia is sort-of supporting Nouveau and has their own binary driver as well. The "sort of supporting" is much limited compared to the amount of AMD is pouring in the open source version of their

  • the FOSS community wont stand for it, they will just abandon Nvidia and focus on just maintaining drivers for old cards, and put their efforts in to either hacking driver signatures or ignoring the new nvidia cards and focusing on other cards like ATI and Intel
    • Which is fine, most people will just use the binary driver. At the end of the day I care about stability and performance.
    • by _merlin ( 160982 )

      "The FOSS community" is tiny. The vast majority of the time Linux is selected for practical or pragmatice reasons. Most people using Linux aren't using it for ideological reasons. There aren't enough people prepared to boycott NVIDIA over this to make a difference. Also, it's firmware that needs to be signed, not drivers.

  • Not a big deal... (Score:5, Informative)

    by JumboMessiah ( 316083 ) on Saturday September 27, 2014 @01:44PM (#48009881)

    Andy Ritger at Nvidia is already in talks with Ben Skeggs and Martin Peres with Nouveau. They're are going to hash out the details at XDC2014 [x.org]. The impact for Nouveau is in the packaging and distribution parts of the cycle, not development. Also, it was Nvidia who reached out to Nouveau, not the other way around. Nvidia has their reasons for doing this, but it's not an anti FOSS thing. It's more likely one of the more sane reasons posted above.

    So everyone just relax their sphincters a bit....

  • Once upon a time, there was this stuff called "Read Only Memory". Not EPROM or EEPROM, but ROM. Once it was created you couldn't change the contents of it.

    If I was worried that scammers were going to take a board that I was selling as a Whizzo rather than a Whizzo Plus because it didn't meet Whizzo Plus specs, and flash it as a Whizzo Plus anyway to rip off customers, I'd put "Hi there I'm Whizzo serial number 987654321 born 2014-09-24-18:58:56 GMT at the Utopia Planitia assembly line, signed <digital

  • After all its artificially limiting what you can do with the hardware. Plus it'll mean you'll have to run closed source firmware from the manufacturer on the device, which means that it'll probably contain malware. Why else would you distribute software in object code only? (No, competitors probably have reverse engineered it years ago.)

BLISS is ignorance.

Working...