engineering/arborist
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#000057): make rapl-access — installs CPU-energy read perm for watt_bench

Browse source 
fox's call: capture the RAPL permission as a Makefile target run with
sudo, not an ad-hoc chmod. `sudo make rapl-access` on each GPU box
installs a udev rule (/etc/udev/rules.d/99-rapl-readable.rules) that
makes intel-rapl energy_uj world-readable on every powercap add event
(survives reboot), and applies chmod immediately so no reboot is
needed. Idempotent; reversible via `sudo make rapl-access-revoke`.

energy_uj is root-only by default (PLATYPUS side-channel mitigation,
CVE-2020-8694) — that's why bench/watt_bench.py's CpuSampler read null
CPU watts as fox during recon. After this target runs, watt_bench
reads CPU package energy directly (no --cpu-energy-cmd needed). GPU
watts via nvidia-smi never needed special perm.

Non-root guard + help entries verified; Makefile parses clean.
This commit is contained in:
russell@unturf.com 2026-05-20 15:19:24 -04:00
parent ab8df76792
commit 1506062ab2
No known key found for this signature in database
1 changed files with 34 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

35
Makefile
View file

@ -37,7 +37,7 @@ SEARCH_Q ?= computer
prometheus-trigger-probe bench-5f-threshold-calibration \
bench-5f-selfmodel-snapshot bench-5f-finetuning-shardchain \
bench-5f-falsification-hard bench-fork-baseline-hard bench-5f-formulate-hard \
bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep clean clean-db clean-data help \
bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep rapl-access rapl-access-revoke clean clean-db clean-data help \
textbooks-summary textbooks-urls fetch-textbooks textbooks-stats textbooks-verify \
crawl-textbooks crawl-textbooks-stats textbook textbook-list
@ -1215,6 +1215,39 @@ BENCH_DIR := /tmp/arborist-bench
bench: bootstrap fetch-cur ## benchmark serial vs parallel-shared vs attached at $(BENCH_DOCS) docs
@bash bench/run.sh $(BENCH_DOCS)
# --- GPU/CPU wattage benchmark (#000057 cost axis) ---------------------------
# RAPL CPU-energy counters (/sys/class/powercap/intel-rapl:*/energy_uj) are
# root-only by default (the PLATYPUS side-channel mitigation, CVE-2020-8694),
# so bench/watt_bench.py reads null CPU watts without this. GPU watts via
# nvidia-smi need no special perm. Run ONCE per GPU box AS ROOT:
# sudo make rapl-access
# Installs a udev rule that makes energy_uj world-readable on every powercap
# add event (survives reboot), and applies it immediately so no reboot is
# needed. Idempotent. Reverse with `sudo make rapl-access-revoke`.
RAPL_UDEV_RULE := /etc/udev/rules.d/99-rapl-readable.rules
rapl-access: ## [root] make Intel RAPL energy_uj readable for watt_bench CPU power
@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access"; exit 1; }
@printf '%s\n' \
'# arborist #000057 — let bench/watt_bench.py read CPU package energy.' \
'# RAPL energy_uj is root-only by default (PLATYPUS/CVE-2020-8694).' \
'SUBSYSTEM=="powercap", ACTION=="add", RUN+="/bin/sh -c '\''chmod a+r /sys/class/powercap/%k/energy_uj 2>/dev/null || true'\''"' \
> $(RAPL_UDEV_RULE)
udevadm control --reload-rules
@# apply now so a reboot isn't required
@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
[ -e "$$f" ] && chmod a+r "$$f" && echo "readable: $$f"; \
done
@echo "RAPL access installed. Verify: cat /sys/class/powercap/intel-rapl:0/energy_uj"
rapl-access-revoke: ## [root] remove the RAPL read-access udev rule
@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access-revoke"; exit 1; }
rm -f $(RAPL_UDEV_RULE)
udevadm control --reload-rules
@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
[ -e "$$f" ] && chmod 400 "$$f"; \
done
@echo "RAPL access revoked (energy_uj back to root-only on next add; reset to 400 now)."
clean: ## remove venv + caches (keeps fetched data and db)
rm -rf $(VENV) .pytest_cache **/__pycache__ arborist.egg-info
find . -type d -name __pycache__ -prune -exec rm -rf {} +