interfaces: Add more kernel fusion driver files to opengl #15068
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #15068 +/- ##
=========================================
Coverage ? 78.06%
=========================================
Files ? 1180
Lines ? 157753
Branches ? 0
=========================================
Hits ? 123153
Misses ? 26949
Partials ? 7651
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
Tue Feb 18 18:34:48 UTC 2025 Failures:Preparing:
Executing:
Restoring:
|
Meulengracht
added
the
Needs security review
interfaces/builtin/opengl.go
Outdated
| @@ -198,6 +198,11 @@ unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"), | |||
| # Kernel Fusion Driver for AMD GPUs | |||
| /dev/kfd rw, | |||
| /sys/module/amdgpu/initstate r, | |||
| /sys/devices/virtual/kfd/kfd/dev r, | |||
| /sys/devices/virtual/kfd/kfd/uevent rw, | |||
There was a problem hiding this comment.
Is write access definitely needed here?
There was a problem hiding this comment.
IIRC write is useful if you want to synthesize events from userspace. With how crazy the drivers are I wouldn't be surprised it's actually used for something. In any case, getting a conformation for needing write access would be nice.
There was a problem hiding this comment.
I added them as the rocminfo utility seemed to access them. I added these all based on the app armor allows when using it in devmode.
I am off today and Monday, but if I get a chance tonight, I can re run it and capture the logs if you'd like.
There was a problem hiding this comment.
Hm, actually I don't see it in the logs when I run rocm-validation-suite or rocminfo, perhaps this isn't needed (at least in the usecase of rvs or rocminfo). I can bump that to read-only for now.
I've attached logs from a full run of rocminfo and a full run of rocm-validation-suite (which runs various different test programs that the Certification team uses for GPGPU testing).
alexmurray
removed
the
Needs security review
This is a follow-up of #14685.
I am trying to create a snap of
rocminfo, and I noticed thatrocminfois accessing the Kernel Fusion Driver via the/sys/devices/virtual/kfdpath to retrieve the GPUs' properties. I've added the files thatrocminfowas specifically accessing, but there are other subdirectories/files that are not included here.These denials seem to also be blocking
rocm-validation-suitefrom querying these properties when running some of its tests.I also noticed that the Mir team is also interested in including
rocminfoin their graphics-test-tools, so I'm sure they'd run into these issues eventually.Let me know if you need anything or if I missed anything.