Re: Linux Graphics Architecture

Albert D. Cahalan (acahalan@cs.uml.edu)
Sun, 7 Feb 1999 20:18:51 -0500 (EST)


>> Read it yourself.
>
> I have
>
>> : A context-switchable graphics engine. The state of the
>> : graphics hardware must be context-switchable and the
>> : context switch must be able to be performed preemptively,
>> : including in the middle of a command.
>>
>> There are several other serious problems, including the implicit
>> assumption that graphics hardware will enforce security.
>
> You don't need hardware contexts.

Read that again. Here:
"must be context-switchable"
"must be able to be performed preemptively"
"in the middle of a command"

Without that, you can crash the card when two apps send interleaved
commands to the server. Do you intend to disable context switching
and prohibit SMP hardware?

> You also dont need hardware clipping

Agreed, but direct access is somewhat useless without it.
My "enforce security" comment had little to do with this.

>> On a PC or Mac, everybody with graphics access can get root.
>> I suppose that isn't any worse than Windows 98...
>
> Garbage. Almost all modern video cards don't have magic oh look Im
> root features.

Consider the common Matrox Millennium:

1. write 0x00000000 (commonly a black pixel) to video memory
2. tell the card to DMA that into the kernel
3. have fun as root

You could transfer exploit code too, but why bother?
You can just give yourself UID 0 instead.

For cards that can only read, you might steal unencrypted passwords,
network packets, file contents, whatever... Just use them as 8-bit
texture memory, then look at the screen. I'll guess that using the
network card or SCSI card as a source of texture memory could be fun.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/