Merge branch 'intel:sycl' into gromacs-bench

Author: mateuszpn

.github/workflows/bandit.yml

@@ -11,6 +11,7 @@ permissions:
 
 jobs:
   bandit:
+    if: github.repository == 'intel/llvm'
     name: Bandit
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sycl-docs.yml

@@ -49,7 +49,13 @@ jobs:
         mkdir clang
         mv $GITHUB_WORKSPACE/build/tools/sycl/doc/html/* .
         mv $GITHUB_WORKSPACE/build/tools/clang/docs/html/* clang/
+        cp -r $GITHUB_WORKSPACE/repo/devops/scripts/benchmarks/html benchmarks
         touch .nojekyll
+        # Update benchmarking dashboard configuration
+        cat << EOF > benchmarks/config.js
+        remoteDataUrl = 'https://raw.githubusercontent.com/intel/llvm-ci-perf-results/refs/heads/unify-ci/data.json';
+        defaultCompareNames = ["Baseline_PVC_L0"];
+        EOF
     # Upload the generated docs as an artifact and deploy to GitHub Pages.
     - name: Upload artifact
       uses: actions/upload-pages-artifact@v3

.github/workflows/sycl-hardening-check.yml

@@ -0,0 +1,90 @@
+name: SYCL hardening check
+
+permissions: read-all
+
+on:
+  workflow_call:
+    inputs:
+      sycl_linux_artifact:
+        type: string
+      sycl_linux_archive:
+        type: string
+      sycl_linux_decompress_command:
+        type: string
+
+      sycl_windows_artifact:
+        type: string
+      sycl_windows_archive:
+        type: string
+
+jobs:
+  hardening_check:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Install hardening-check
+      run: |
+        sudo apt update
+        sudo apt install -y devscripts
+
+    - name: Download SYCL toolchain
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.sycl_linux_artifact }}
+
+    - name: Extract SYCL toolchain
+      run: |
+        mkdir toolchain
+        tar -I '${{ inputs.sycl_linux_decompress_command }}' -xf ${{ inputs.sycl_linux_archive }} -C toolchain
+
+    - name: Perform checks
+      run: |
+        for file in ./toolchain/bin/*; do
+            hardening-check "$file" | tee -a "./hardening-check.txt"
+        done
+
+        for file in $(find ./toolchain/lib/ -type f -name "*.so*"); do
+            hardening-check "$file" | tee -a "./hardening-check.txt"
+        done
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: hardening-check
+        path: hardening-check.txt
+
+  winchecksec:
+    runs-on: windows-latest
+
+    steps:
+    - name: Install winchecksec
+      run: |
+        curl -LO https://github.com/trailofbits/winchecksec/releases/download/v3.1.0/windows.x64.Release.zip
+        mkdir winchecksec
+        unzip "windows.x64.Release.zip" -d winchecksec
+
+    - name: Download SYCL toolchain
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.sycl_windows_artifact }}
+
+    - name: Extract SYCL toolchain
+      shell: bash
+      run: |
+        mkdir toolchain
+        tar -xf ${{ inputs.sycl_windows_archive }} -C toolchain
+
+    - name: Download and check Windows artifacts
+      shell: bash
+      run: |
+        for file in $(find ./toolchain/bin/ -type f -name "*.exe"); do
+            ./winchecksec/build/Release/winchecksec.exe "$file" | tee -a "./winchecksec.txt"
+        done
+
+        for file in $(find ./toolchain/bin/ -type f -name "*.dll"); do
+            ./winchecksec/build/Release/winchecksec.exe "$file" | tee -a "./winchecksec.txt"
+        done
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: winchecksec
+        path: winchecksec.txt

.github/workflows/sycl-issues-ping-assignee.yml

@@ -18,6 +18,7 @@ permissions: read-all
 
 jobs:
   run:
+    if: github.repository == 'intel/llvm'
     permissions:
       issues: write 
     runs-on: ubuntu-latest

.github/workflows/sycl-linux-run-tests.yml

@@ -25,7 +25,7 @@ on:
         required: False
       tests_selector:
         description: |
-          Three possible options: "e2e", "cts", and "compute-benchmarks".
+          Three possible options: "e2e", "cts", and "benchmarks".
         type: string
         default: "e2e"
 
@@ -111,6 +111,33 @@ on:
         default: ''
         required: False
 
+      benchmark_upload_results:
+        description: |
+          Set to true to upload results to git repository storing benchmarking
+          results.
+        type: string
+        default: 'false'
+        required: False
+      benchmark_save_name:
+        description: |
+          Save name to use for benchmark results: Save names are stored in
+          metadata of result file, and are used to identify benchmark results in
+          the same series (e.g. same configuration, same device, etc.).
+
+          Note: Currently, benchmark result filenames are in the format of
+          <benchmark_save_name>_<Device>_<Backend>_YYYYMMDD_HHMMSS.json
+        type: string
+        default: ''
+        required: False
+      benchmark_preset:
+        description: |
+          Name of benchmark preset to run.
+
+          See /devops/scripts/benchmarks/presets.py for all presets available.
+        type: string
+        default: 'Minimal'
+        required: False
+
   workflow_dispatch:
     inputs:
       runner:
@@ -150,7 +177,7 @@ on:
         options:
           - e2e
           - cts
-          - compute-benchmarks
+          - benchmarks
 
       env:
         description: |
@@ -303,11 +330,14 @@ jobs:
         target_devices: ${{ inputs.target_devices }}
         retention-days: ${{ inputs.retention-days }}
 
-    - name: Run compute-benchmarks on SYCL
-      if: inputs.tests_selector == 'compute-benchmarks'
+    - name: Run benchmarks
+      if: inputs.tests_selector == 'benchmarks'
       uses: ./devops/actions/run-tests/benchmark
       with:
         target_devices: ${{ inputs.target_devices }}
+        upload_results: ${{ inputs.benchmark_upload_results }}
+        save_name: ${{ inputs.benchmark_save_name }}
+        preset: ${{ inputs.benchmark_preset }}
       env:
         RUNNER_TAG: ${{ inputs.runner }}
         GITHUB_TOKEN: ${{ secrets.LLVM_SYCL_BENCHMARK_TOKEN }}

.github/workflows/sycl-nightly.yml

@@ -23,6 +23,7 @@ jobs:
       # prefer widespread gzip compression.
       artifact_archive_name: sycl_linux.tar.gz
 
+  # Build used for performance testing only: not intended for testing
   linux_shared_build:
     if: github.repository == 'intel/llvm'
     uses: ./.github/workflows/sycl-linux-build.yml
@@ -31,7 +32,7 @@ jobs:
       build_cache_root: "/__w/"
       build_cache_suffix: sprod_shared
       build_artifact_suffix: sprod_shared
-      build_configure_extra_args: '--shared-libs --hip --cuda --native_cpu'
+      build_configure_extra_args: '--shared-libs --hip --cuda --native_cpu --no-assertions'
 
       artifact_archive_name: sycl_linux_shared.tar.zst
 
@@ -148,6 +149,8 @@ jobs:
       # We upload both Linux/Windows build via Github's "Releases"
       # functionality, make sure Linux/Windows names follow the same pattern.
       artifact_archive_name: sycl_windows.tar.gz
+      # Disable the spirv-dis requirement as to not require SPIR-V Tools.
+      build_configure_extra_args: -DLLVM_SPIRV_ENABLE_LIBSPIRV_DIS=off
 
   e2e-win:
     needs: build-win
@@ -274,35 +277,30 @@ jobs:
       sycl_toolchain_archive: ${{ needs.build-win.outputs.artifact_archive_name }}
       sycl_cts_artifact: sycl_cts_bin_win
 
-  aggregate_benchmark_results:
-    if: github.repository == 'intel/llvm' && !cancelled()
-    name: Aggregate benchmark results and produce historical averages
-    uses: ./.github/workflows/sycl-benchmark-aggregate.yml
-    secrets:
-      LLVM_SYCL_BENCHMARK_TOKEN: ${{ secrets.LLVM_SYCL_BENCHMARK_TOKEN }}
-    with:
-      lookback_days: 100
-      
   run-sycl-benchmarks:
-    needs: [ubuntu2204_build, aggregate_benchmark_results]
+    needs: [ubuntu2204_build]
     if: ${{ always() && !cancelled() && needs.ubuntu2204_build.outputs.build_conclusion == 'success' }}
     strategy:
-      fail-fast: false
       matrix:
         include:
-          - name: Run compute-benchmarks on L0 PVC
+          - ref: ${{ github.sha }}
+            save_name: Baseline
             runner: '["PVC_PERF"]'
-            image_options: -u 1001 --device=/dev/dri -v /dev/dri/by-path:/dev/dri/by-path --privileged --cap-add SYS_ADMIN
-            target_devices: level_zero:gpu
+            backend: 'level_zero:gpu'
+            preset: Minimal
     uses: ./.github/workflows/sycl-linux-run-tests.yml
     secrets: inherit
     with:
-      name: ${{ matrix.name }}
+      name: Run compute-benchmarks (${{ matrix.runner }}, ${{ matrix.backend }})
       runner: ${{ matrix.runner }}
-      image_options: ${{ matrix.image_options }}
-      target_devices: ${{ matrix.target_devices }}
-      tests_selector: compute-benchmarks
-      repo_ref: ${{ github.sha }}
+      image: ghcr.io/intel/llvm/sycl_ubuntu2404_nightly:latest
+      image_options: -u 1001 --device=/dev/dri -v /dev/dri/by-path:/dev/dri/by-path --privileged --cap-add SYS_ADMIN
+      target_devices: ${{ matrix.backend }}
+      tests_selector: benchmarks
+      benchmark_upload_results: true
+      benchmark_save_name: ${{ matrix.save_name }}
+      benchmark_preset: ${{ matrix.preset }}
+      repo_ref: ${{ matrix.ref }}
       sycl_toolchain_artifact: sycl_linux_default
       sycl_toolchain_archive: ${{ needs.ubuntu2204_build.outputs.artifact_archive_name }}
       sycl_toolchain_decompress_command: ${{ needs.ubuntu2204_build.outputs.artifact_decompress_command }}

.github/workflows/sycl-rel-nightly.yml

@@ -44,9 +44,10 @@ jobs:
     with:
       build_cache_root: "/__w/"
       build_artifact_suffix: default
-      build_configure_extra_args: '--no-assertions --add_security_flags=sanitize --hip --cuda'
+      build_configure_extra_args: '--disable-jit --no-assertions --add_security_flags=sanitize --hip --cuda'
       build_image: ghcr.io/intel/llvm/ubuntu2204_build:latest
       build_ref: ${{ inputs.testing_branch || 'sycl-rel-6_1_0'  }}
+      pack_release: 'true'
 
       # We upload the build for people to download/use, override its name and
       # prefer widespread gzip compression.
@@ -105,7 +106,8 @@ jobs:
     uses: ./.github/workflows/sycl-windows-build.yml
     with:
       ref: ${{ inputs.testing_branch || 'sycl-rel-6_1_0'  }}
-      build_configure_extra_args: '--no-assertions --add_security_flags=sanitize'
+      build_configure_extra_args: '--disable-jit --no-assertions --add_security_flags=sanitize'
+      pack_release: 'true'
 
       # We upload both Linux/Windows build via Github's "Releases"
       # functionality, make sure Linux/Windows names follow the same pattern.
@@ -165,7 +167,7 @@ jobs:
 
   cuda-aws-stop:
     needs: [cuda-aws-start, cuda-run-tests]
-    if: always()
+    if: always() && ${{ needs.cuda-aws-start.result != 'skipped' }}
     uses: ./.github/workflows/sycl-aws.yml
     secrets: inherit
     with:
@@ -220,3 +222,19 @@ jobs:
       sycl_toolchain_archive: ${{ needs.ubuntu2204_build.outputs.artifact_archive_name }}
       sycl_toolchain_decompress_command: ${{ needs.ubuntu2204_build.outputs.artifact_decompress_command }}
       sycl_cts_artifact: sycl_cts_bin_linux
+
+  hardening-check:
+    needs: [ubuntu2204_build, build-win]
+    if: |
+      always()
+      && !cancelled()
+      && needs.ubuntu2204_build.outputs.build_conclusion == 'success'
+      && needs.build-win.outputs.build_conclusion == 'success'
+    uses: ./.github/workflows/sycl-hardening-check.yml
+    with:
+      sycl_linux_artifact: sycl_linux_release
+      sycl_linux_archive: ${{ needs.ubuntu2204_build.outputs.artifact_archive_name }}
+      sycl_linux_decompress_command: ${{ needs.ubuntu2204_build.outputs.artifact_decompress_command }}
+
+      sycl_windows_artifact: sycl_windows_release
+      sycl_windows_archive: ${{ needs.build-win.outputs.artifact_archive_name }}

.github/workflows/sycl-stale-issues.yml

@@ -8,6 +8,7 @@ permissions: read-all
 
 jobs:
   close-issues:
+    if: github.repository == 'intel/llvm'
     permissions:
       issues: write  # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs