accel-support: add a package for render device handling

The DRM render and compute nodes, /dev/dri/renderD*, /dev/accel/accel*
and /dev/kfd, come out 0600 root:root, so anything using a GPU for
compute or for accelerated rendering runs as root. They also share the
video group with the modesetting nodes wherever a distribution grants it,
which hands scanout control to every process allowed to compute.

Add an accel-support package which allocates the render group and puts
those nodes into it. No kernel module carries a dependency on it: whether
a device offers a render node is a property of the driver, not of the
module, so userspace that wants the group depends on the package.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

package/system/hardware-support/Makefile

@@ -62,6 +62,22 @@ define Package/video-support/install
 	$(call InstallFragment,$(1),30-video.json)
 endef
 
+define Package/accel-support
+  $(call Package/hardware-support/Default)
+  TITLE:=Render and compute device support
+  USERID:=:render=43
+endef
+
+define Package/accel-support/description
+ Feature gate for GPU render and compute devices. Allocates the render
+ group and installs the hotplug rules which put the DRM render, accel and
+ kfd character devices into it.
+endef
+
+define Package/accel-support/install
+	$(call InstallFragment,$(1),35-accel.json)
+endef
+
 define Build/Prepare
 endef
 
@@ -73,3 +89,4 @@ endef
 
 $(eval $(call BuildPackage,audio-support))
 $(eval $(call BuildPackage,video-support))
+$(eval $(call BuildPackage,accel-support))

package/system/hardware-support/files/35-accel.json

@@ -0,0 +1,19 @@
+[
+	[ "if",
+		[ "eq", "SUBSYSTEM", "drm" ],
+		[
+			[ "if",
+				[ "regex", "DEVNAME", "^dri/renderD" ],
+				[
+					[ "makedev", "/dev/%DEVNAME%", "0660", "render" ],
+					[ "return" ]
+				]
+			],
+			[ "return" ]
+		]
+	],
+	[ "if",
+		[ "eq", "SUBSYSTEM", [ "accel", "kfd" ] ],
+		[ "makedev", "/dev/%DEVNAME%", "0660", "render" ]
+	]
+]