Windows Session 0 Isolation Impact on GPGPU Computing

1.0 Introduction With the introduction of Windows Vista, Windows Server 2008, and recently Windows 7, GPU applications that run as Windows Service are impacted by Session 0 Isolation (S0I). For the GPU applications the impact is severe. S0I prevents any and all GPU applications, via CUDA, OpenCL or in the future Direct Compute/C++ AMP (?) from running as a Windows service. The S0I restrictions of a Windows Service are documented in a Microsoft document http://www.microsoft.com/whdc/system/sysinternals/Session0Changes.msp and Application Compatibility: Session 0 Isolation http://msdn.microsoft.com/en-us/library/bb756986.aspx

2.0 Session 0 Isolation Session 0 Isolation is Windows security feature that is designed to prevent inappropriate and unauthorized access, from service and drivers to O/S resources including the graphics sub-system.

3.0 Use Cases Are there valid use cases for running GPU code as a service? Yes, there are many use cases where GPU code is best run as Service. Running as a Service serves several purposes. It allows for a background always present resource and it provides a single process that can be shared by multiple users or applications. These include Folding At Home Render Farms GPU Accelerated databases GPU Accelerated AI and Neural Network Systems, that background process. GPU Accelerated middleware include Web Servers and Application Servers.

4.0 Microsoft Proposed Work Around Microsoft has proposed several alternatives Services to access to the UI. They are

Tim Child

June 20, 2011

Windows Session 0 Isolation Impact on GPGPU Computing

Use a client/server mechanism such as remote procedure call (RPC) or named pipes rather than window messages to communicate with applications. Implement any necessary user interface for the service as follows: Use the WTSSendMessage function to create a simple message box on the users desktop. This allows the service to give the user a notification and request a simple response.

For more complex interactions, developers should move their UI code into an agent that runs in the users session and handles all UI requirements. The agent communicates with the service through RPC or named pipes. If the user initiates the UI interaction by using Control Panel, Internet Explorer, or a similar UI experience, that UI experience should start the agent. The agent then handles all UI interactions. If UI is required but is not initiated by the user, the service must request the agent to start any required UI, instead of attempting to launch that UI by itself. In the rare situation where the service must initiate a user interaction and the agent is not already running, the service should call the CreateProcessAsUser API to start the agent. The agent can then initiate all UI interactions. It is important for developers to carefully review all possible usage scenarios and consider moving all UI code into an agent that runs in the user session ..

These work-arounds are not satisfactory as they dont provide access to the GPU. 5.0 User Work Arounds There are a couple of work-arounds, the first is to create a batch script that runs at start-up time. This starts a process that isnt service which can use GPU code running in a process. This is not very satisfactory as it creates a system administration burden. Restarting a user process cannot be done from the Service Manager console or via an API call. The industry has another very simple but unfortunate remedy, its not to run on Windows, and run on Linux systems. 6.0 GPU Vendor Work-Arounds I understand that for non-graphics GPUs such as the Nvidias Tesla, its possible to use a special driver or a driver patch that allows a Windows Service to access a GPU. This is a special case. Most GPGPU arent Telsas they are dual usage devices for graphics and compute. 7.0 Forum and Blog Posts Below are links to blog and forum posts discussing the issue http://foldingforum.org/viewtopic.php?f=50&t=12742

Tim Child

June 20, 2011

Windows Session 0 Isolation Impact on GPGPU Computing

http://stackoverflow.com/questions/2464182/windows-2008-renderfarm-service-createprocessasusersession-0-isolation-and-op http://forums.nvidia.com/index.php?showtopic=93450 http://www.khronos.org/message_boards/viewtopic.php?f=28&t=2451 http://forums.nvidia.com/index.php?showtopic=153313 http://forums.amd.com/forum/messageview.cfm?catid=390&threadid=144379

Tim Child

June 20, 2011