How To: Enable SLI on pre-i7/i5 hardware

[Mussels]

How would that work. Don't 750i boards only have 2 PCIe x16 slots?

some of them add in another lane via the southbridge.

Tri SLI couldnt happen without bridges at least, since there is no communication between the slots.


its like how my motherboard has 2x16 2.0 and 1x4 2.0 - only the first two are for crossfire, the last isnt designed for video cards.

 

[sveetsnelda]

Just letting everyone know that I'm still working on this...

Tonight I found the function call that disables SLI, the call that checks the motherboard ID, the call that gets the SLIC string from WMI, and the call that analyzes/decrypts the SLIC string.

I've traced through most of it except for the SLIC check. I'm pretty sure I could just patch the current driver now to enable SLI, but that would be a pain (we'd have to patch the driver each time a new one comes out). Instead, I'd like to make a generator (if possible) for the SLIC string. I'm trying to come up with something a little more permanant.

 

[Solaris17]

Just letting everyone know that I'm still working on this...

Tonight I found the function call that disables SLI, the call that checks the motherboard ID, the call that gets the SLIC string from WMI, and the call that analyzes/decrypts the SLIC string.

I've traced through most of it except for the SLIC check. I'm pretty sure I could just patch the current driver now to enable SLI, but that would be a pain (we'd have to patch the driver each time a new one comes out). Instead, I'd like to make a generator (if possible) for the SLIC string. I'm trying to come up with something a little more permanant.

damn good job man..honestly if i can be blunt without being offensive...i dont know were most of you guys came from but you have simply soared above and beyond the speed and progress of work i accomplished in meer weeks

 

[JrRacinFan]

How would that work. Don't 750i boards only have 2 PCIe x16 slots?

some of them add in another lane via the southbridge.

Tri SLI couldnt happen without bridges at least, since there is no communication between the slots.


its like how my motherboard has 2x16 2.0 and 1x4 2.0 - only the first two are for crossfire, the last isnt designed for video cards.

Mine has 1x 16x 2.0 and 2x 8x 1.1

 

[Solaris17]

some of them add in another lane via the southbridge.

Tri SLI couldnt happen without bridges at least, since there is no communication between the slots.


its like how my motherboard has 2x16 2.0 and 1x4 2.0 - only the first two are for crossfire, the last isnt designed for video cards.

SLI between the slots is possible. iv proved it you dont need a bridge to run it.

 

[TiN]

For info to keep work going: I've got Xeon 3470 and P55 motherboard (ASUS MAXIMUS III), so can get BIOS dumps and ACPI dumps from this platform, if it's needed. Just give me a word for it

 

[anatolymik]

I've traced through most of it except for the SLIC check. I'm pretty sure I could just patch the current driver now to enable SLI, but that would be a pain (we'd have to patch the driver each time a new one comes out). Instead, I'd like to make a generator (if possible) for the SLIC string. I'm trying to come up with something a little more permanant.

Maybe you should patch the driver for the sake of the experiment?

 

[e.v.o]

Maybe we should write an emulator that catches the call and returns the necessary code?

@sveetsnelda
Can you provide us with more information on where exactly the SLIC code and the other stuff is called?

 

[anatolymik]

Maybe we should write an emulator that catches the call and returns the necessary code?

it's great but it works until a new driver comes out...

 

[Mussels]

it's great but it works until a new driver comes out...

even if you only get it on one driver, who cares? one driver is enough to get you 20,000 downloads and just as many lawyers after you

 

[anatolymik]

any news?

 

[TiN]

BTW found that ASUS Maximus III Formula wasn't supported SLI with two GeForce 6600's . Tried in WinXP and Win7, with 81.xx and 190.62 forceware drivers, but "Enable SLI" in driver control panel won't appear. GPU-Z reports SLI disabled.

 

[sveetsnelda]

Well, here's some more info on how things work and where I'm at on this "project". Sorry I haven't posted much... I just wanted to make sure I understood the code very well before posting so I didn't mislead anyone. Keep in mind I hardly knew assembly at all when I started this. Now I'm starting to get the hang of it.

Here's how the SLIC verification works... A call is passed to WMI that checks for the existance of the string in the BIOS. If the key is there, the driver looks up the motherboard chipset's manufacturer and device ID. In the X58's case, this is 8086 (intel) and 3400 (X58). Then, the driver looks through a table of device/manufacturer IDs (which are encrypted) until it finds a match. If a match isn't found, obviously SLI isn't enabled. If a match is found, the table contains a couple memory addresses for each device/manufacturer ID combo. One of these memory addresses is a matching SLIC string (also encrypted) which is compared to the one in the board's bios.

What does this mean? This means that we can't just write our own SLIC into a bios on a non-certified board and expect it to work (unless the board's chipset is supported). The board's chipset ID has to be written into the driver for it to function.

I have no idea what encryption algorithm was used on the PNP ID table/SLIC keys/etc, but I *do* know how to decrypt them. In other words, I don't know what the function did in C, but I understand the function in ASM and know I could write a program to mimic it. I'd assume we could just check our board's northbridge device ID and patch it into those tables.

That's the theory, anyways...

I'm going to try and get this going on my Maximus II and post how it goes.

 

[TiN]

sveetsnelda

Awesome! I have some expirience with C and embedded hardware, PM me code, i'll see how I can help.

Is there another way, for example return our own vendor ID and device ID of chipset to driver, just from BIOS, rather that returning real ones?

 

[sveetsnelda]

I don't think there is a way to do that, but I'm not 100 percent sure. I think the driver is getting the hardware ID by querying the hardware itself, not from ACPI.

It'll be a bit before I can send you anything or post much, I need to trace through a few more subroutines and collect my thoughts. This code is very confusing.

 

[anatolymik]

I don't think there is a way to do that, but I'm not 100 percent sure. I think the driver is getting the hardware ID by querying the hardware itself, not from ACPI.

Can we hook the querying the hardware?

 

[sveetsnelda]

If something like that could be done, that'd be awesome (and be an easy solution). I have no idea how to code such a thing, though.

 

[anatolymik]

Maybe we should try mod the driver? I also examine the driver to hack it, but i didn't that you do yet. Can you post you found out? I mean parts of code or something else. A place in the code you showed (push 'AILS'), there is some pushes onto the stack. Last one is push ebp, and called procedure is using it as pointer to either structure or simply array of pointers. Anyway, called procedure is using it to call other procedures. I didn't find out what procedures it calls, but for example:

there is :

push eax
push esi
call dword ptr[ebx+a8h]

when i got know what exactly called function contains, first my thought was they're fooling us.

called function:

xor eax,eax
retn 4

And there are many functions like that. Tell me what address into memory this pointer (push ebp i mean) points to?

 

[anatolymik]

i think an easy solution will be if we'll patch HalGetBusDataByOffset of hal.dll. Simply put there if statement for bus = 0 , device = 0, function = 0. Can we identify nvidia driver is calling this function?

 

[Tynecider]

@sveetsnelda

I also have MF2 (dual BIOS) board but am still trying to find a deal on a second VGA card.
I could help test for chipset compatibility for now, making sure the Intel drivers will play dice with the patching process.

A few questions:

Would it be possible to patch the BIOS with a DSDT call, similar to OSX86 patching?

If we could clone the X58/P55 SLI string (DSDT call) on our MF2 BIOS before windows loads would'nt that be more efficient?
This could however lead to problems with getting the intel drivers to load, assuming that windows will pass on the patched data to assign drivers for the north/southbridge functions.
Memory addressing could be a problem here too, the differences between X58/P55 and the P45 could be big, Memory controllers etc.

I think if you could find someone who has a a single PCB SLi card, this could help somewhat.
After all, its the only way right now that SLi can be enabled on X48/P45/X38/P35.
some code and functions could prove usefull from one of these setups.


Ill try and do some educational reading when i get some time to try and understand the process a bit better.

DAMMIT Why doesnt nVidia just reach out to people who are on the green team side, but prefer intel boards/CPU.

Fingers crossed

 

[TiN]

I have 9800GX2 here, if it's needed for test.

 

[TheWolf]

I need some people for testing:

- If you have a ASUS, ECS, Foxconn or MSI Board with the following Chipset: P35, X38, X48, P45
- If you have two Geforce Series 8/9/200
- If you are willing to help me

--- EDIT
Also 41 49 4C 53 reads SLIA, cause rw-everything reads it big endian which is false i think.

I'd be glad to help if this is still in the works.

I have Abit IX38 QuadGT I also have 3x 260GTX video cards.
Also have IP35ProXE & 3x 8800 videocards. 1x 8600
I do a lot of fold@home why I have so much hardware.

 

[sveetsnelda]

Got SLI up on my P45. Screenshots and details to follow.

 

[sveetsnelda]

can someone get me the manufacturer/hardware ID's of the chipsets that need implimented? For example:

8086 3400 = X58
8086 2E20 = P45

 

[sveetsnelda]

http://i758.photobucket.com/albums/xx227/sveetsnelda/P45SLIScreenshot.png

This was accomplished by changing a couple things with the kernel debugger while booting, and with having a valid X58 SLIC in the ACPI table. It wont take much to patch the driver though.

This is running in "normal" windows mode, not directory services restore mode (like what Firewings did).