1 |
On Wednesday, 9 May 2018 09:34:43 CEST Michał Górny wrote: |
2 |
> W dniu śro, 09.05.2018 o godzinie 08∶51 +0200, użytkownik Dennis |
3 |
> |
4 |
> Schridde napisał: |
5 |
> > I see sandbox violations similar to "ACCESS DENIED: open_wr: /dev/dri/ |
6 |
> > renderD128" pop up for more and more packages, probably since OpenCL |
7 |
> > becomes used more widely. Hence I would like to ask: Could we in Gentoo |
8 |
> > treat GPUs just like CPUs and allow any process to access render nodes |
9 |
> > (i.e. the GPUs compute capabilities via the specific interface the Linux |
10 |
> > kernel's DRM offers for that purpose) without sandbox restrictions? |
11 |
> > |
12 |
> > See-Also: https://bugs.gentoo.org/654216 |
13 |
> |
14 |
> Doesn't accessing those nodes involve a risk of programs being able to |
15 |
> crash your system (or xorg)? Or cause on-screen artifacts? |
16 |
|
17 |
Well, in the presence of Linux kernel bugs, programs could crash the whole |
18 |
system. But I believe this is also true for all other drivers and compute |
19 |
devices, including CPUs. |
20 |
|
21 |
I assume an application using render nodes could crash X by e.g. consuming all |
22 |
memory. But then this is also true for all applications using the CPU and its |
23 |
attached memory for computations. |
24 |
|
25 |
On-screen artifacts as in resolution switching and other KMS operations is |
26 |
explicitly prohibited. Insecure access (using GEM FLINK) to the memory of |
27 |
other applications (which could cause broken textures / windows with broken |
28 |
content) is also explicitly prohibited. So my understanding is that the |
29 |
answer is: No, using render nodes cannot cause on-screen artifacts (modulo the |
30 |
presence of Linux kernel bugs, s.a.). |
31 |
|
32 |
DRM render nodes were specifically introduced to allow GPGPU applications to |
33 |
run without impacting the security of the system (and without X). |
34 |
|
35 |
The Linux kernel documentation contains some information on the concept: |
36 |
* https://www.kernel.org/doc/html/v4.16/gpu/drm-uapi.html#render-nodes |
37 |
|
38 |
As well as an older blog post by David Herrmann: |
39 |
* https://dvdhrm.wordpress.com/2013/09/01/splitting-drm-and-kms-device-nodes/ |
40 |
|
41 |
And the Wikipedia article on DRM: |
42 |
* https://en.wikipedia.org/wiki/Direct_Rendering_Manager#Render_nodes |
43 |
|
44 |
--Dennis |