Hacker News Reader

Comment by paulddraper | Hacker News Reader

GPU is a security nightmare, IDK how we've gotten by for so long

It is for speed.

With our central processor units we developed a process model where each process was isolated memory wise from each other. And then went on to destroy that model with threads... but I digress. This process isolation culture was probably born from shared systems where each user needs to be isolated from each other. but has served us well with in providing robust single user systems. and has proved critical with the move back to shared cloud computing.

Graphical processing units hove no concept of memory isolation. and have no culture of wanting it. They were high performance units for a single user only. At this point trying to introduce isolation levels would probably be a lost cause. Many people would be very unhappy at the performance hit that would be required.

But yeah a GPU in a shared environment spooks me as well.

All modern GPUs have isolated memory contexts and full CPU-like virtual memory address space and page tables for each user context. It's not possible to (directly) read data from another context. As far as I can tell from what you're trying to say, your comment is completely incorrect about GPUs not supporting that.

From the description given, I assume this is using timing differences to tell the size of each compressed tile, which gives you info on it's contents. This is certainly not helped by the ability for an apparently untrusted iframe to apply a transform to a target that the security model would normally disallow reading pixels from, amplifying the data from this side channel. Without that it's "just" another sidechannel attack.

Ah, consider myself corrected then. I have not done much gpu programing(i guess it shows). I was under the impression there was no virtual memory and any illusion of an isolated process was solely due to driver trickery.

So you wrote something completely wrong with no experience in it as if it were a fact?

Yeah, I had to check if it's one of those bots. It's fascinating to me that a person has the urge to spit out two paragraphs devoid of any correct information or value for that matter, as an answer to a question online -- as if it can't be looked up or researched easily!

It happens all the time. The only difference is the admission.

All of us are walking around with bullshit information in our heads 24/7/365.

That doesn't mean we spit out 2 paragraphs of dense opinion about something we have no clue about

No problem - though virtual memory was required by the DX10 spec, so it's not like it's a new thing. And even before that, many GPUs had (more limited) memory management units/memory protection.

Citation? Are we talking consumer GPUs or enterprise class?

All of them, GPU memory is fully virtualized in order if nothing else to easily support multiple applications running natively on it since GPUs aren’t used for display & rendering only anymore where multiple clients could be simply handled solely by the composer.

Most of the driver has also been moved into user space at least on Windows and MacOS I’m not fully versed in the state of the user vs kernel space display drivers on Linux these days.

https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

For clarity applications that don’t know how to use virtual memory will still operate under segmented mode where they’ll access the physical memory directly however under Windows at least these days and for a while now even the segmented mode is emulated you’ll need to run your engine on bare metal completely to access physical memory directly via segment addressing.

Reply on news.ycombinator.com