Hacker News Reader

Comment by viraptor | Hacker News Reader

I don't think the comment was wrong. The driver is limiting the rate and the card validates you're using a signed driver. It's still the whole protection system, not just the driver.

I.e. you couldn't update the driver yourself. That relevant "hack" seems to be the official beta/development driver without the restriction. (The other solutions don't modify anything)

View on HN

How would the card validate you're using a signed driver? The card only sees what the driver sends it, so presumably the input could be spoofed. Also the card is not the root on the system's TPM.

Usually it's the reverse - normally drivers validate that the card's firmware is signed.

As an example, people would hack AMD Polaris card firmware memory timings for better mining performance.

To do so you needed to disable the firmware signature check in the AMD driver, and to do this you needed to disable the driver signature check in Windows.

Yeah, people seem to forget those mining GPUs that were released specifically to prevent their resale in the aftermaket gaming community that people still managed to get to output video _despite the cards lacking physical ports_. They did it with a modded driver.

For those looking for details, I remember watching a Linus Tech Tips video on it a while ago. Just managed to dig it up: https://www.youtube.com/watch?v=TY4s35uULg4

Forum thread has more: https://linustechtips.com/topic/1021372-nvidia-said-we-could...

well somebody could sign the driver with an authenticode cert. just costs some bucks and need to rewrite the publisher.

Is it some Looking Glass [1] kind of thing, or did they add physical ports to some unused traces or something?

[1]: https://looking-glass.io/

Sort of. It's the exact same thing as Nvidia optimus. Linux calls it DRI-PRIME or PRIME offload. Get it =P ?

Big, display-less GPU renders frame, image is copied into VRAM of smaller GPU with a display. Smaller GPU draws image to screen.

Most of the gamer laptops do this. There's no physical link between the display and the big GPU. I believe the mobile cards enable a second DMA engine that is usually soft locked on GeForce to handle the transfer.

Same as first PowerVR gaming chips.

Midas3 (1996) https://vintage3d.org/midas3.php

PCX1 (1996) https://vintage3d.org/pcx1.php

and PCX2 (1997) https://vintage3d.org/pcx2.php

Tomb Raider running 1024x768 30FPS on a card half the cost of 3Dfx Voodoo1 https://www.youtube.com/watch?v=5GMesT4WKzI It could even run up to 60FPS at 640x480, the best hardware platform running Tomb Raider, and only one allowing over 30FPS.

They basically render frames on the video port-less GPU, and then pass them over to a second GPU for actual output. So probably quite similar to what Looking Glass is doing.

Sounds interesting. Any link for info about this?

I did rely on the assumption that some check exists. Of course it could be spoofed, but that could be hard enough to require reverse engineering the whole driver to figure out. Or the limit could rely on the identification done on the card itself and sent back.

Either way - my point is, we don't have enough details to say the original description from nvidia was wrong.

The way it most likely works is there is a Falcon microprocessor with a cryptographic coprocessor built into everything post-Maxwell. Nvidia burns in keys during manufacture that the cryptographic coprocessor will use to calculate a signature of the firmware loaded in by the driver against. Since Nvidia/the manufacturer have that key, they can sign firmware that can access the most important, impactful API calls on the card. Likely, the hashrate limiter was intended to be implemented in the firmware.

This is the same thing that has thwarted Nouveau all these years, and if you don't screw up your driver releaselike they did, it is quite effective. You could write your own firmware and load it onto the card, but you can't access the Hi-Security API's like power management, reclocking.

There's no network connection, so if the OEM's key was ever leaked, there's nothing they could do prevent anyone from writing whatever firmware they wished. Just as they can't take back the driver they done goofed releasing.

Reply on news.ycombinator.com