Live data from Hacker News

Attacking the Windows Nvidia Driver

googleprojectzero.blogspot.com

51–60 of 77 posts

Re: Attacking the Windows Nvidia Driver

#51
post #9
post #6

Earlier quoted context omitted.

Yeah - that sounds like fun - recreating a driver install issue after you finally have it working on your system. Heck, even if you set up a system -just- to recreate this problem, it would still be one of those "nightmare inducing" trials of will. I'm not saying it shouldn't be done, I just can't imagine doing it (especially on my personal workstation).

Plus you paid for the computer, graphic card and OS. Why in hell would you spend hours of work on your free time for this ? Do people try to find defects in their car then send a report to Ferrari ?

> Why in hell would you spend hours of work on your free time for this ?

Sure, you can either return the items, or report the bug, or hope that you've managed to find a workaround.

There's no need to discourage people who want to spend their own time on getting the bug fixed so that others benefit. Not everybody thinks the same way you do.

Re: Attacking the Windows Nvidia Driver

#52
post #41

Can someone give me a layman's definition of an "escape" and why they would be legitimately needed? Are they needed so callbacks can "escape" and be exposed to other classes? (does that make any sense?)

It is pretty much just the name for their API.

Re: Attacking the Windows Nvidia Driver

#53
post #41

Can someone give me a layman's definition of an "escape" and why they would be legitimately needed? Are they needed so callbacks can "escape" and be exposed to other classes? (does that make any sense?)

It is very similar to an ioctl on Unix (DeviceIoControl on Windows), just specific to the Display/Video driver here. It is a way to send arbitrary data from usermode into kernelmode, for whatever reason.

You can imagine the usermode interface as:

    void escape(int command, void *param);
And then the kernelmode implementation would look something like:

    void escape(int command, void *param)
    {
        switch (command)
        {
            case COMMAND_FOO:
                do_foo((foo_param_t *)param);
                return;
            case COMMAND_BAR:
                do_bar((bar_param_t *)param);
                return;
        }
    }
The driver defines the params and what FOO and BAR are. This can be used to issue special commands that don't have an interface provided by MSFT. It is also used by any drivers that run in usermode (e.g. OpenGL, CUDA, etc) that communicate directly with the kernelmode ones. These interfaces are generally not public. The project zero researcher has disassembled the kernelmode driver and reverse engineered their format.

Does that help?

Re: Attacking the Windows Nvidia Driver

#54

Earlier quoted context omitted.

>fair bit of attack surface behind glReadPixels() and the like... >...you can start looking at parts of the system's memory I thought the whole point of using glReadPixels(), as opposed to just dereferencing a pointer in the system's address space, was that the framebuffer memory it accesses (whether backed by a texture or a surface or whatever) is GPU memory, and not system memory?

That's true on split-memory architectures(desktop) but most mobile GPUs(and a couple consoles) use a unified memory model. Also most browsers use the GPU to speed up rendering so you can pick out things from there too potentially.

I wonder, do you really have to write zero to all the memorycells? Or can you just stop the refresh cycle in hardware and let squares of memory drain and die in one or two cycles?

Re: Attacking the Windows Nvidia Driver

#55
post #41

Can someone give me a layman's definition of an "escape" and why they would be legitimately needed? Are they needed so callbacks can "escape" and be exposed to other classes? (does that make any sense?)

It is very similar to an ioctl on Unix (DeviceIoControl on Windows), just specific to the Display/Video driver here. It is a way to send arbitrary data from usermode into kernelmode, for whatever reason. You can imagine the usermode interface as: void escape(int command, void *param); And then the kernelmode implementation would look something like: void escape(int command, void *param) { switch (command) { case COMM…

Definitely, thank you for the psuedocode examples!

Re: Attacking the Windows Nvidia Driver

#56
post #41

Can someone give me a layman's definition of an "escape" and why they would be legitimately needed? Are they needed so callbacks can "escape" and be exposed to other classes? (does that make any sense?)

As the article indicates, they're similar to ioctl, which is a system call that, roughly speaking, allows arbitrary opaque blobs of data to be passed back and forth between a user-mode -process and a kernel-mode driver. This is intended as a generic mechanism allowing drivers to expose arbitrary functionality to user-space. This enables the implementation of functionality that would not otherwise be possible because…

Thanks, I know nothing about this level of programming but this gives me a lot of good stuff to google.

Re: Attacking the Windows Nvidia Driver

#57

Earlier quoted context omitted.

That's true on split-memory architectures(desktop) but most mobile GPUs(and a couple consoles) use a unified memory model. Also most browsers use the GPU to speed up rendering so you can pick out things from there too potentially.

I wonder, do you really have to write zero to all the memorycells? Or can you just stop the refresh cycle in hardware and let squares of memory drain and die in one or two cycles?

The latter would take far longer, even if it were reliable. So not really; it'd need hardware support to be reliable, and if chipmakers are willing to do that, then they could implement hardware zeroing rather than require the OS to wait several seconds for charges to fully dissipate.

Re: Attacking the Windows Nvidia Driver

#58
post #51
post #9

Earlier quoted context omitted.

Plus you paid for the computer, graphic card and OS. Why in hell would you spend hours of work on your free time for this ? Do people try to find defects in their car then send a report to Ferrari ?

> Why in hell would you spend hours of work on your free time for this ? Sure, you can either return the items, or report the bug, or hope that you've managed to find a workaround. There's no need to discourage people who want to spend their own time on getting the bug fixed so that others benefit. Not everybody thinks the same way you do.

Oh I report bugs all the time. For open source projects. When I pay hundreds of euros for a product I expect it to work. Strangely it something we don't expect for anything related to computing.

We have such double standard.

If you buy a washing machine and it doesn't work, the brand sucks.

If you buy a graphic card that makes you OS crash, it's just nvidia needs a little help. Replace nvidia with any gadget or software.

Windows uses to crash all the time, and people found that normal. The same problem with a microwave would have issued a massive recall but microsoft got away with it.

Well, no sorry. You just sold me a non working product, wasting my money, my time, and preventing me from doing the task I was going to do with my computer.

I'm a dev, I understand perfectly WHY it happens. Complexity VS expectations VS cost. I get it. But the consumer is cheated here.

Re: Attacking the Windows Nvidia Driver

#59
post #37
post #32

Earlier quoted context omitted.

Yeah, Nvidia rather sucks at cleaning up after themselves, for whatever reason. The main reason I'm not buying another card from them is their stance towards Linux in general and their stance towards PCI virtualization in particular. I'm currently not upgrading drivers due to the latter; they're trying to disable the capabilities (dedicating a card to a VM) that are the reason I bought a second card in the first plac…

If you're talking about GPU pass-through, they're just trying to make it hard, but they're not making it impossible. If you're talking about virtual GPUs, where one card is split across multiple VMs, however, unfortunately that's Tesla only. That said, I worked (as the maintainer of KVM) with the nVidia driver people working on vGPU, and I was very impressed. They were very knowledgeable and professional, and they ma…

I know it is not currently impossible, but I don't trust that the current "policy" will continue.

Personally, not talking about virtual GPUs. (I mean, that's cool stuff, but that's not my use case.) I'm glad you found the driver engineers to be solid. I doubt, however, the engineers are driving the decisions on what passthrough functionality Nvidia feels like allowing consumers to have this week.

Or driving decisions like this: https://devtalk.nvidia.com/default/topic/579449/linux/basemo...

I personally consider removing functionality after I purchase something to be a form of fraud. And Nvidia doesn't seem very shy about doing it. Thus, I don't trust them, and don't do business with untrustworthy vendors.

Re: Attacking the Windows Nvidia Driver

#60

I cant prove this but my computer blue screened after a Nvidia driver update. It took my several hours to get everything working again because it wouldnt even launch in safe mode. Very frustrating. I wish they had a little more quality control on their drivers.

Have you tried using Display Driver Uninstaller ? This is something I do every time I update the driver. Run the program, tell it to start in safe mode, run the program again, tell it to uninstall the driver. Reboot. Install new driver package, run DDU again to re-enable automatic driver install (because you need it for other devices) and done. Works like a champ and always fixes any odd driver behaviors.

Link to DDU: http://www.guru3d.com/files-details/display-driver-uninstall...

Post reply on HN