4 ms·

NVIDIA GPU RISC-V root of trust is analogous to Apple T2 secure enclave, AMD PSP, or Intel ME, which all perform security-critical functions. > What exactly is

NVIDIA GPU RISC-V root of trust is analogous to Apple T2 secure enclave, AMD PSP, or Intel ME, which all perform security-critical functions. > What exactly is the threat model here It probably varies by product, but one commercial possibility is protection of price premiums, e.g. enforce feature segmentation for different products or customers, while using common silicon. NVIDIA operating margin reached 50%, unusually high for a hardware company, https://www.macrotrends.net/stocks/charts/NVDA/nvidia/operating-margin https://www.macrotrends.net/stocks/charts/NVDA/nvidia/operat.... AMD margin is below 20%. 2021, https://www.youtube.com/watch?v=l7i1kfHvWNI https://www.youtube.com/watch?v=l7i1kfHvWNI 2024, https://static.sched.com/hosted_files/riscvsummit2024/fe/Keynote_2024.pdf https://static.sched.com/hosted_files/riscvsummit2024/fe/Key... ~1 Billion RISC-V cores shipping in 2024 NVIDIA chips Unified embedded HW and SW across all NVIDIA products • Eliminates replication in basic primitives (isolation, crypto etc.) • Maximizes SW/HW leverage across NVIDIA Configuration: pay only for what is needed Custom extensions: additional functionality, security, and performance Our HW and SW architecture enable differentiation There are upcoming open hardware/firmware RoT building blocks like OpenTitan (RISC-V), OCP Caliptra and TockOS (Rust) that could be used by competing device and platform vendors. > don't really perceive much of a security imperative for NVIDIA When countries start budgeting hundreds of billions of dollars for national investment in LLM-based AI based on GPUs, they may introduce new security requirements for the underlying infrastructure.

tonyarkles 2y ago
Yeah, there's a whole bunch of places where NVIDIA kit is used outside of "graphics cards and slop generators". I work on a drone system based around the Orin AGX and we definitely have "leverage the root of trust functionality to lock down the code that can run on the Orin" on the roadmap before we ever let the hardware end up directly in customers' hands. Root of trust -> Signed Bootloader -> Signed Kernel -> Signed Binaries. There's too much IP that we've spent too much money on to risk having end-users getting access to the raw TensorRT models involved.

tonyarkles 2y ago

Yeah, there's a whole bunch of places where NVIDIA kit is used outside of "graphics cards and slop generators". I work on a drone system based around the Orin AGX and we definitely have "leverage the root of trust functionality to lock down the code that can run on the Orin" on the roadmap before we ever let the hardware end up directly in customers' hands. Root of trust -> Signed Bootloader -> Signed Kernel -> Signed Binaries. There's too much IP that we've spent too much money on to risk having end-users getting access to the raw TensorRT models involved.