Expand description
Multi-GPU NVENC device filtering via kernel ioctl.
Multi-GPU NVENC GET_ATTACHED_IDS / GET_PROBED_IDS ioctl filter — it exists so a container
handed only a subset of the host’s GPUs can still open an NVENC session.
The problem: on NVIDIA driver 570-595, libnvidia-encode / libcuda / libnvcuvid enumerate
every host GPU via the RM GET_ATTACHED_IDS ioctl and try to peer-init each one — including
GPUs the container never exposed. A GPU whose /dev/nvidiaX node is absent then makes
nvEncOpenEncodeSessionEx fail with UNSUPPORTED_DEVICE, so the session cannot open at all even
though a perfectly usable GPU is right there in the container.
The fix is to strip the unreachable GPUs out of that enumeration response before the libraries
act on it. It GOT-patches ioctl in those NVIDIA libraries only — deliberately not an
LD_PRELOAD object, which would shadow every ioctl in the process and need its own recursion
guard. Because this crate’s own GOT is left untouched, the wrapper’s inner ioctl still resolves
to the real libc instead of re-entering itself.
Everything hinges on at least one host GPU being hidden from the container, since that is the only situation the bug arises in: on 565-or-before / 610-or-later drivers (enumeration already correct) and whenever the container can see every host GPU, the strict-subset rule downstream makes the whole filter a no-op.
Functions§
- install
- Install the
GET_ATTACHED_IDS/GET_PROBED_IDSGOT filter, at most once and only when a host GPU is hidden from the container. Idempotent and safe to call before every NVENC session open (guarded by aOnce).