[gentoo-dev] Solving OpenCL /dev/dri/card* sandbox issues w/ ImageMagick

[gentoo-dev] Solving OpenCL /dev/dri/card* sandbox issues w/ ImageMagick

[Samuli Suominen]

Problem 1:

https://bugs.gentoo.org/show_bug.cgi?id=472766#c21

I'm not sure if wildcards are supported by /etc/sandbox.d/ files

Problem 2:

I don't know if this bug is ImageMagick+OpenCL _or_ OpenCL alone
specific since emacs
is having similar issues? Assistance required from emacs maintainer to
figure out.

https://bugs.gentoo.org/show_bug.cgi?id=482976#c11

I can propably find out Problem 2 myself, but Problem 1 is harder since
I can't actually test
the solution to the bug as I don't have OpenCL hardware or
/dev/dri/card* for that matter

Thanks,
Samuli
** <https://bugs.gentoo.org/show_bug.cgi?id=472766>

Re: [gentoo-dev] Solving OpenCL /dev/dri/card* sandbox issues w/ ImageMagick

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 617 bytes --]

On Wed 02 Apr 2014 13:01:25 Samuli Suominen wrote:
> Problem 1:
> 
> https://bugs.gentoo.org/show_bug.cgi?id=472766#c21
> 
> I'm not sure if wildcards are supported by /etc/sandbox.d/ files

they are not.  however, path matching is based on prefixes, so there's always 
an implicit glob at the end.  would be reasonable to change the code to use 
fnmatch.

e.g. SANDBOX_PREDICT=/dev/dri/card probably works

however, i think we're relying on sandbox preventing bad code from doing bad 
things.  there really should be a way for the build to disable the logic in 
the first place from kicking in.
-mike

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [gentoo-dev] Solving OpenCL /dev/dri/card* sandbox issues w/ ImageMagick

[Samuli Suominen]

On 02/04/14 16:01, Mike Frysinger wrote:
> On Wed 02 Apr 2014 13:01:25 Samuli Suominen wrote:
>> Problem 1:
>>
>> https://bugs.gentoo.org/show_bug.cgi?id=472766#c21
>>
>> I'm not sure if wildcards are supported by /etc/sandbox.d/ files
> they are not.  however, path matching is based on prefixes, so there's always 
> an implicit glob at the end.  would be reasonable to change the code to use 
> fnmatch.
>
> e.g. SANDBOX_PREDICT=/dev/dri/card probably works

I hope SANDBOX_PREDICT="/dev/dri/card" with "" is OK too?

>
> however, i think we're relying on sandbox preventing bad code from doing bad 
> things.  there really should be a way for the build to disable the logic in 
> the first place from kicking in.
> -mike

You are right
I believe this started after a major mesa version bump, so I'd start
looking for the culprit
in Mesa's OpenCL code, but I have no idea howto go futher with the
debugging... yet

Meanwhile, =media-gfx/imagemagick-6.8.8.10[opencl] now installs the
sandbox.d file,
workaround is better here than nothing since this is affecting multiple
binaries,
packages :/

- Samuli

Re: [gentoo-dev] Solving OpenCL /dev/dri/card* sandbox issues w/ ImageMagick

[Chí-Thanh Christopher Nguyễn]

Samuli Suominen schrieb:
> You are right
> I believe this started after a major mesa version bump, so I'd start
> looking for the culprit
> in Mesa's OpenCL code, but I have no idea howto go futher with the
> debugging... yet

The problem is finding a general way for OpenCL to force it to run on
the CPU. For Mesa OpenGL there is LIBGL_ALWAYS_SOFTWARE, but for OpenCL
there is nothing similar.

> Meanwhile, =media-gfx/imagemagick-6.8.8.10[opencl] now installs the
> sandbox.d file,
> workaround is better here than nothing since this is affecting multiple
> binaries,
> packages :/
>
> - Samuli
>

For ImageMagick specifically, the MAGICK_OCL_DEVICE environment variable
could be set per[1].

Another option would be to hide the existence of the GPU OpenCL device
from the applications using the OCL_ICD_VENDORS variable.


Best regards,
Chí-Thanh Christopher Nguyễn


[1] http://www.imagemagick.org/script/opencl.php