amdgpu: add kernelModule.patches option #321663
Conversation
github-actions
bot
added
6.topic: nixos
ofborg
bot
added
10.rebuild-darwin: 0
| @@ -0,0 +1,42 @@ | |||
| # TODO there should probably be a generic mechanism to patch any in-kernel module like this | |||
There was a problem hiding this comment.
I am not really keen on the idea, which problems would it solve specifically for amdgpu module?
If anything like this to be introduced, I think it should be standardised and available for all modules. Perhaps @K900 wants to take a look here as well.
There was a problem hiding this comment.
I had two issues that I needed to patch the amdgpu module for so far:
- SteamVR needs to be able to create a high-priority queue but you can't give it CAP_SYS_NICE because we run Steam inside of a userns. I must patch the amdgpu kernel module to allow any process to create such a queue (and potentially DOS the system but idc).
- The Framework 16 Laptop has a quirk and the display brightness does not go as low as it should and the lowest is too bright for dim environments. Until FW releases a firmware fix for this (which would be the proper fix), the module must be patched to add the quirk.
I'd also like this to be a standard option but I think that can come later. No need to perfect it in the V1.
There was a problem hiding this comment.
I really, really don't want to be setting this precedent.
There was a problem hiding this comment.
While I could certainly see this being a footgun, I don't really see any great danger here; could you elaborate?
I was also planning on making the unprivileged high-priority queue patch into a stand-alone option and providing some hacks in the Steam module to make the SteamVR setup experience smoother.
There was a problem hiding this comment.
I think a generic mechanism would be nice, is there any way to unstall this?
There was a problem hiding this comment.
+1 on the generic mechanism.
I think a challenge here could be to make it easy to configure for users (i.e. boot.kernelModules."amdgpu".patches = [...]), as we would somehow need to map module names to module paths within the kernel source tree.
There was a problem hiding this comment.
Building a good interface here would be hard as some modules that are conceptually one unit may be constituted of multiple individual module files.
That's at least part of the reason why I limited my work to AMDGPU first. I'd prefer if we just merged this as iteration 1 and came up with a good design for a generic mechanism in iteration 2.
I know it's hard but we need to put a limit on our perfectionism sometimes ;)
@K900 could you share your doubts about "setting this precedent"?
There was a problem hiding this comment.
Mostly my concern is that we're giving users a tool that's very sharp and very easy to hold wrong, and the failure mode is not great.
There was a problem hiding this comment.
Also, the initial goal of this, that being the capability issues, should really be fixed somewhere at a higher level (possibly in bwrap itself even?)
There was a problem hiding this comment.
Also, the initial goal of this, that being the capability issues, should really be fixed somewhere at a higher level (possibly in bwrap itself even?)
See #217119
In short:
Applications inside of user namespaces can never have effective file capabilities. This is just a design decision of the kernel. There have been numerous attempts to move away from capabilities specifically for high priority DRM contexts (which is what SteamVR needs) but none of them have made it into the kernel yet.
|
Agreed. This could be some sort of a generic mechanism if we really want it to exist. |
Port of NixOS/nixpkgs#321663 because I need this NOW.
wegank
added
the
2.status: stale
stale
bot
removed
the
2.status: stale
Description of changes
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.