Official NixOS Wiki

VR: Difference between revisions

← Older edit
VisualWikitext
→SteamVR: SteamVR: Added bubblewrap capabilities security restriction bypass guide as an alternative for patching the amdgpu driver
Tags: Mobile edit Mobile web edit
Ravoyax (talk | contribs)
2 edits
m Fix spelling mistakes
 
(5 intermediate revisions by 4 users not shown)
Line 77: Line 77:
<!--T:10-->
<!--T:10-->
For further information about available environment variables and tweaks, read the [https://lvra.gitlab.io/docs/fossvr/monado/ Linux VR Adventures wiki] and the [https://monado.freedesktop.org/getting-started.html#environment-variables Monado documentation about environment variables]
For further information about available environment variables and tweaks, read the [https://lvra.gitlab.io/docs/fossvr/monado/ Linux VR Adventures wiki] and the [https://monado.freedesktop.org/getting-started.html#environment-variables Monado documentation about environment variables]
</translate>
<translate>


== OpenComposite == <!--T:11-->
== OpenComposite == <!--T:11-->
Line 88: Line 85:
<!--T:13-->
<!--T:13-->
In order to run OpenVR games on anything other than SteamVR, you need to configure the OpenVR runtime path defined in <code>~/.config/openvr/openvrpaths.vrpath</code>. A reliable way to do this is to use [[Home Manager]] to create this file.
In order to run OpenVR games on anything other than SteamVR, you need to configure the OpenVR runtime path defined in <code>~/.config/openvr/openvrpaths.vrpath</code>. A reliable way to do this is to use [[Home Manager]] to create this file.
</translate>


<!--T:14-->
{{Warning|<translate><!--T:14--> Older versions of Proton will always query the current OpenVR and OpenXR runtime. If you use OpenComposite, and it fails to initialize an OpenXR context, Proton will fail to launch. A workaround is to delete the ~/.config/openvr/openvrpaths.vrpath file and then retry launching the game.</translate>}}
{{Warning|Older versions of Proton will always query the current OpenVR and OpenXR runtime. If you use OpenComposite, and it fails to initialize an OpenXR context, Proton will fail to launch. A workaround is to delete the ~/.config/openvr/openvrpaths.vrpath file and then retry launching the game.}}


<translate>
<!--T:15-->
<!--T:15-->
If this file is not set to read-only, SteamVR will add its runtime path back, hence the use for Home Manager.
If this file is not set to read-only, SteamVR will add its runtime path back, hence the use for Home Manager.
Line 128: Line 126:
<!--T:17-->
<!--T:17-->
If you are planning to play any OpenVR game on Steam or OpenXR games through Proton, you will have to use OpenComposite in this manner. In most cases you also have to allow access to the socket path of your OpenXR runtime to Steam's runtime, by using the following launch options for XR applications on Steam: <code>env PRESSURE_VESSEL_FILESYSTEMS_RW=$XDG_RUNTIME_DIR/monado_comp_ipc %command%</code>. This example is for Monado, while other XR runtimes might differ.
If you are planning to play any OpenVR game on Steam or OpenXR games through Proton, you will have to use OpenComposite in this manner. In most cases you also have to allow access to the socket path of your OpenXR runtime to Steam's runtime, by using the following launch options for XR applications on Steam: <code>env PRESSURE_VESSEL_FILESYSTEMS_RW=$XDG_RUNTIME_DIR/monado_comp_ipc %command%</code>. This example is for Monado, while other XR runtimes might differ.
</translate>


<translate>
== WiVRn == <!--T:18-->
== WiVRn == <!--T:18-->


Line 136: Line 132:
WiVRn is an OpenXR streaming application built around Monado. It wirelessly connects a standalone VR headset to a Linux computer. If your headset is not wireless, look at [[VR#Monado|Monado]] instead.
WiVRn is an OpenXR streaming application built around Monado. It wirelessly connects a standalone VR headset to a Linux computer. If your headset is not wireless, look at [[VR#Monado|Monado]] instead.
Example usage of the WiVRn module:
Example usage of the WiVRn module:
</translate>


<!--T:42-->
{{Warning|<translate><!--T:42--> As of WiVRn version 0.23, WiVRn now manages the opencomposite paths itself. Only use the above opencomposite configuration when using versions below v0.23.</translate>}}
{{Warning|As of WiVRn version 0.23, WiVRn now manages the opencomposite paths itself. Only use the above opencomposite configuration when using versions below v0.23.}}
</translate>


{{File|/etc/nixos/configuration.nix|nix|3=services.wivrn = {
{{File|/etc/nixos/configuration.nix|nix|3=services.wivrn = {
Line 153: Line 148:
   autoStart = true;
   autoStart = true;


   # Config for WiVRn (https://github.com/WiVRn/WiVRn/blob/master/docs/configuration.md)
   # If you're running this with an nVidia GPU and want to use GPU Encoding (and don't otherwise have CUDA enabled system wide), you need to override the cudaSupport variable.
  config = {
  package = (pkgs.wivrn.override { cudaSupport = true; });
    enable = true;
 
    json = {
  # You should use the default configuration (which is no configuration), as that works the best out of the box.
      # 1.0x foveation scaling
  # However, if you need to configure something see https://github.com/WiVRn/WiVRn/blob/master/docs/configuration.md for configuration options and https://mynixos.com/nixpkgs/option/services.wivrn.config.json for an example configuration.
      scale = 1.0;
};|name=configuration.nix|lang=nix}}
      # 100 Mb/s
      bitrate = 100000000;
      encoders = [
        {
          encoder = "vaapi";
          codec = "h265";
          # 1.0 x 1.0 scaling
          width = 1.0;
          height = 1.0;
          offset_x = 0.0;
          offset_y = 0.0;
        }
      ];
    };
  };
};}}


<translate>
<translate>
<!--T:19-->
<!--T:19-->
Like Monado, you will also have to add the launch argument for WiVRn to allow access to the socket: <code>PRESSURE_VESSEL_FILESYSTEMS_RW=$XDG_RUNTIME_DIR/wivrn/comp_ipc %command%</code>
Like Monado, you will also have to add the launch argument for WiVRn to allow access to the socket: <code>PRESSURE_VESSEL_FILESYSTEMS_RW=$XDG_RUNTIME_DIR/wivrn/comp_ipc %command%</code>
</translate>


<translate>
== Envision == <!--T:20-->
== Envision == <!--T:20-->


Line 204: Line 181:
<!--T:23-->
<!--T:23-->
On initial setup, SteamVR will ask for elevated permissions, to set up a file capability for one of its binaries. This is needed to allow asynchronous reprojection to work. Clients need the <code>CAP_SYS_NICE</code> capability to acquire a high-priority context, which is a requirement for asynchronous reprojection.
On initial setup, SteamVR will ask for elevated permissions, to set up a file capability for one of its binaries. This is needed to allow asynchronous reprojection to work. Clients need the <code>CAP_SYS_NICE</code> capability to acquire a high-priority context, which is a requirement for asynchronous reprojection.
</translate>


<!--T:24-->
{{Note|<translate><!--T:24--> Steam is run in a bubblewrap-based FHS environment. This environment runs Steam in a user namespace, which prevents it from using any capabilities or setuid binaries. This means that asynchronous reprojection can not be used on NixOS, without patching the kernel to remove these restrictions completely, or modifying the bubblewrap binary used for running Steam to remove these capability protections. Both of these workarounds come with their own security tradeoffs. See this [https://github.com/NixOS/nixpkgs/issues/217119 Nixpkgs issue]</translate>}}
{{Note|Steam is run in a bubblewrap-based FHS environment. This environment runs Steam in a user namespace, which prevents it from using any capabilities or setuid binaries. This means that asynchronous reprojection can not be used on NixOS, without patching the kernel to remove these restrictions completely, or modifying the bubblewrap binary used for running Steam to remove these capability protections. Both of these workarounds come with their own security tradeoffs. See this [https://github.com/NixOS/nixpkgs/issues/217119 Nixpkgs issue]}}
</translate>


<translate>
<translate>
Line 214: Line 190:
<!--T:26-->
<!--T:26-->
By applying [https://github.com/Frogging-Family/community-patches/blob/a6a468420c0df18d51342ac6864ecd3f99f7011e/linux61-tkg/cap_sys_nice_begone.mypatch this patch], the AMDGPU kernel driver will ignore process privileges and allow any application to create high priority contexts.
By applying [https://github.com/Frogging-Family/community-patches/blob/a6a468420c0df18d51342ac6864ecd3f99f7011e/linux61-tkg/cap_sys_nice_begone.mypatch this patch], the AMDGPU kernel driver will ignore process privileges and allow any application to create high priority contexts.
</translate>


<!--T:27-->
{{Warning|<translate><!--T:27--> This removes intentional restrictions from the kernel, and it could cause scheduling issues. While it has not been reported that it does cause issues, this should be considered an unsupported configuration.</translate>}}
{{Warning|This removes intentional restrictions from the kernel, and it could cause scheduling issues. While it has not been reported that it does cause issues, this should be considered an unsupported configuration.}}
</translate>


<translate>
<translate>
Line 241: Line 216:
<!--T:30-->
<!--T:30-->
It is also possible to just patch amdgpu and build it as an out-of-tree module, as described in [[Linux_kernel#Patching_a_single_In-tree_kernel_module]]
It is also possible to just patch amdgpu and build it as an out-of-tree module, as described in [[Linux_kernel#Patching_a_single_In-tree_kernel_module]]
</translate>


<translate>
=== Patching bubblewrap to allow capabilities === <!--T:43-->
=== Patching bubblewrap to allow capabilities ===


<!--T:44-->
By modifying the bubblewrap binary used for running Steam, you can allow processes in that FHS environment to acquire capabilities. This removes the need for patching the kernel directly.
By modifying the bubblewrap binary used for running Steam, you can allow processes in that FHS environment to acquire capabilities. This removes the need for patching the kernel directly.
</translate>
{{Warning|<translate><!--T:45--> This circumvents an intended security mechanism in bubblewrap, and allows all other software launched by steam, or running via steam-run to acquire these capabilities as well.</translate>}}


{{Warning|This circumvents an intended security mechanism in bubblewrap, and allows all other software launched by steam, or running via steam-run to acquire these capabilities as well.}}
{{file|/etc/nixos/configuration.nix|nix|3=programs.steam = let
{{file|/etc/nixos/configuration.nix|nix|3=programs.steam = let
   patchedBwrap = pkgs.bubblewrap.overrideAttrs (o: {
   patchedBwrap = pkgs.bubblewrap.overrideAttrs (o: {
Line 256: Line 232:
   });
   });
in {
in {
    enable = true;
  enable = true;
    package = pkgs.steam.override {
  package = pkgs.steam.override {
      buildFHSEnv = (args: ((pkgs.buildFHSEnv.override {
    buildFHSEnv = (args: ((pkgs.buildFHSEnv.override {
        bubblewrap = patchedBwrap;
      bubblewrap = patchedBwrap;
      }) (args // {
    }) (args // {
        extraBwrapArgs = (args.extraBwrapArgs or []) ++ [ "--cap-add ALL" ];
      extraBwrapArgs = (args.extraBwrapArgs or []) ++ [ "--cap-add ALL" ];
      })));
    })));
    };
   };
   };
}
};
}}
}}
{{file|/etc/nixos/bwrap.patch|diff|3=diff --git a/bubblewrap.c b/bubblewrap.c
{{file|/etc/nixos/bwrap.patch|diff|3=diff --git a/bubblewrap.c b/bubblewrap.c
Line 286: Line 261:
       /* If our uid is 0, default to inheriting all caps; the caller
       /* If our uid is 0, default to inheriting all caps; the caller
}}
}}
<translate>
<!--T:46-->
as an additional change, you may also need to replace Steam's own bwrap binary with a symbolic link to this modified bwrap binary, found at <code>~/.local/share/Steam/ubuntu12_32/steam-runtime/usr/libexec/steam-runtime-tools-0/srt-bwrap</code>.
as an additional change, you may also need to replace Steam's own bwrap binary with a symbolic link to this modified bwrap binary, found at <code>~/.local/share/Steam/ubuntu12_32/steam-runtime/usr/libexec/steam-runtime-tools-0/srt-bwrap</code>.
<!--T:47-->
Steam will periodically replace this modification with its own binary when steam-runtime updates, so you may need to re-apply this change if it breaks.
Steam will periodically replace this modification with its own binary when steam-runtime updates, so you may need to re-apply this change if it breaks.
</translate>
<translate>


== wlx-overlay-s == <!--T:31-->
== wlx-overlay-s == <!--T:31-->
Line 296: Line 273:
<!--T:38-->
<!--T:38-->
[https://github.com/galister/wlx-overlay-s wlx-overlay-s] is a lightweight OpenXR/OpenVR overlay for Wayland and X11 desktops. It works with SteamVR as well as Monado/WiVRn natively.
[https://github.com/galister/wlx-overlay-s wlx-overlay-s] is a lightweight OpenXR/OpenVR overlay for Wayland and X11 desktops. It works with SteamVR as well as Monado/WiVRn natively.
</translate>


<translate>
==== SteamVR autostart ==== <!--T:32-->
==== SteamVR autostart ==== <!--T:32-->


<!--T:39-->
<!--T:39-->
When launching wlx-overlay-s in SteamVR (or any OpenVR compositor) it will register an autostart manifest. Currently, this manifest will reference a Nix store path of wlx-overlay-s, which might get garbage collected after rebuilds of your NixOS/Nix profile. A workaround is to regularly run the following command to update the manifest's store path:{{Commands|
When launching wlx-overlay-s in SteamVR (or any OpenVR compositor) it will register an autostart manifest. Currently, this manifest will reference a Nix store path of wlx-overlay-s, which might get garbage collected after rebuilds of your NixOS/Nix profile. A workaround is to regularly run the following command to update the manifest's store path:
# Run wlx-overlay-s and replace any running instance
</translate>
 
{{Commands|
# <translate><!--T:48--> Run wlx-overlay-s and replace any running instance</translate>
$ wlx-overlay-s --replace}}
$ wlx-overlay-s --replace}}
</translate>


<translate>
<translate>
Line 312: Line 289:
<!--T:34-->
<!--T:34-->
* [https://lvra.gitlab.io Linux VR Adventures Wiki]
* [https://lvra.gitlab.io Linux VR Adventures Wiki]
<!--T:49-->
[[Category:Video]]
[[Category:Video]]
[[Category:Hardware]]
[[Category:Hardware]]
Retrieved from "https://wiki.nixos.org/wiki/VR"