mirror of
https://github.com/archr-linux/Arch-R.git
synced 2026-07-12 18:19:42 -07:00
FASE 0+1+2: Production build audit fixes and infrastructure
Kernel config hardening: - FRAME_POINTER=n: Saves 3-5% CPU overhead on ARM64 (wastes registers) - DEBUG_FS=n: Remove debugfs mount (memory + attack surface) - IKCONFIG=n: Save 100-300KB (kernel config in /proc not needed in production) Mesa/Panfrost: - Add persistent shader cache (MESA_SHADER_CACHE_DIR + 128MB max) Avoids shader recompilation on every emulator launch I/O scheduler: - Enhanced BFQ udev rule: low_latency=1, read_ahead=2048KB, nr_requests=128 Reduces ROM loading stutter on microSD Sysctl: - Add vm.dirty_expire_centisecs=3000 (dirty pages expire after 30s) - Add vm.page-cluster=0 (single-page swap for ZRAM, instant swap-in) Infrastructure: - Create tools/audit-build.sh: comprehensive production build audit script Checks kernel debug flags, Mesa env vars, binary stripping, emulator build types, system state, active services Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Douglas Teles
@@ -146,8 +146,7 @@ CONFIG_RCU_STALL_COMMON=y
|
||||
CONFIG_RCU_NEED_SEGCBLIST=y
|
||||
# end of RCU Subsystem
|
||||
|
||||
CONFIG_IKCONFIG=y
|
||||
CONFIG_IKCONFIG_PROC=y
|
||||
# CONFIG_IKCONFIG is not set
|
||||
# CONFIG_IKHEADERS is not set
|
||||
CONFIG_LOG_BUF_SHIFT=17
|
||||
CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
|
||||
@@ -6722,8 +6721,7 @@ CONFIG_FRAME_WARN=2048
|
||||
# CONFIG_DEBUG_SECTION_MISMATCH is not set
|
||||
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
|
||||
# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
|
||||
CONFIG_ARCH_WANT_FRAME_POINTERS=y
|
||||
CONFIG_FRAME_POINTER=y
|
||||
# CONFIG_FRAME_POINTER is not set
|
||||
# CONFIG_VMLINUX_MAP is not set
|
||||
# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
|
||||
# end of Compile-time checks and compiler options
|
||||
@@ -6732,10 +6730,7 @@ CONFIG_FRAME_POINTER=y
|
||||
# Generic Kernel Debugging Instruments
|
||||
#
|
||||
# CONFIG_MAGIC_SYSRQ is not set
|
||||
CONFIG_DEBUG_FS=y
|
||||
CONFIG_DEBUG_FS_ALLOW_ALL=y
|
||||
# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set
|
||||
# CONFIG_DEBUG_FS_ALLOW_NONE is not set
|
||||
# CONFIG_DEBUG_FS is not set
|
||||
CONFIG_HAVE_ARCH_KGDB=y
|
||||
# CONFIG_KGDB is not set
|
||||
CONFIG_ARCH_HAS_UBSAN=y
|
||||
|
||||
@@ -8,3 +8,7 @@ export PAN_MESA_DEBUG=forcepack
|
||||
|
||||
# Skip GL error checking for better performance in emulators
|
||||
export MESA_NO_ERROR=1
|
||||
|
||||
# Persistent shader cache - avoids recompilation on every launch
|
||||
export MESA_SHADER_CACHE_DIR=/storage/.cache/mesa_shader_cache
|
||||
export MESA_SHADER_CACHE_MAX_SIZE=128MB
|
||||
|
||||
@@ -1 +1,4 @@
|
||||
ACTION=="add|change", KERNEL=="mmcbl*", ATTR{queue/scheduler}="bfq"
|
||||
ACTION=="add|change", KERNEL=="mmcblk[0-9]*", ATTR{queue/scheduler}="bfq"
|
||||
ACTION=="add|change", KERNEL=="mmcblk[0-9]*", ATTR{queue/iosched/low_latency}="1"
|
||||
ACTION=="add|change", KERNEL=="mmcblk[0-9]*", ATTR{queue/read_ahead_kb}="2048"
|
||||
ACTION=="add|change", KERNEL=="mmcblk[0-9]*", ATTR{queue/nr_requests}="128"
|
||||
|
||||
@@ -2,6 +2,8 @@ kernel.nmi_watchdog=0
|
||||
vm.swappiness=1
|
||||
vm.laptop_mode=0
|
||||
vm.dirty_writeback_centisecs=500
|
||||
vm.dirty_expire_centisecs=3000
|
||||
vm.vfs_cache_pressure=50
|
||||
vm.dirty_ratio=10
|
||||
vm.dirty_background_ratio=5
|
||||
vm.page-cluster=0
|
||||
|
||||
Executable
+124
@@ -0,0 +1,124 @@
|
||||
#!/bin/bash
|
||||
# ArchR Build Audit Script
|
||||
# Checks for debug flags, sanitizers, and misconfigurations in production builds
|
||||
# Run on the R36S device: bash /flash/audit-build.sh (copy to boot partition)
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
PASS=0; WARN=0; FAIL=0
|
||||
|
||||
check() {
|
||||
local label="$1" expected="$2" actual="$3"
|
||||
if [ "$actual" = "$expected" ]; then
|
||||
echo -e " ${GREEN}[PASS]${NC} $label = $actual"
|
||||
PASS=$((PASS+1))
|
||||
else
|
||||
echo -e " ${RED}[FAIL]${NC} $label = $actual (expected: $expected)"
|
||||
FAIL=$((FAIL+1))
|
||||
fi
|
||||
}
|
||||
|
||||
warn() {
|
||||
echo -e " ${YELLOW}[WARN]${NC} $1"
|
||||
WARN=$((WARN+1))
|
||||
}
|
||||
|
||||
echo "========================================"
|
||||
echo " ArchR Production Build Audit"
|
||||
echo " $(date)"
|
||||
echo " $(uname -r) on $(cat /etc/os-release | grep ^NAME= | cut -d= -f2)"
|
||||
echo "========================================"
|
||||
|
||||
echo ""
|
||||
echo "=== 1. KERNEL DEBUG FLAGS ==="
|
||||
if [ -f /proc/config.gz ]; then
|
||||
KCONF=$(zcat /proc/config.gz)
|
||||
check "DEBUG_KERNEL" "not set" "$(echo "$KCONF" | grep -c CONFIG_DEBUG_KERNEL=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "LOCKDEP" "not set" "$(echo "$KCONF" | grep -c CONFIG_LOCKDEP=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "KASAN" "not set" "$(echo "$KCONF" | grep -c CONFIG_KASAN=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "KMEMLEAK" "not set" "$(echo "$KCONF" | grep -c CONFIG_KMEMLEAK=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "FTRACE" "not set" "$(echo "$KCONF" | grep -c CONFIG_FTRACE=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "SCHEDSTATS" "not set" "$(echo "$KCONF" | grep -c CONFIG_SCHEDSTATS=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "FRAME_POINTER" "not set" "$(echo "$KCONF" | grep -c CONFIG_FRAME_POINTER=y | sed 's/1/SET/;s/0/not set/')"
|
||||
check "PROFILING" "not set" "$(echo "$KCONF" | grep -c CONFIG_PROFILING=y | sed 's/1/SET/;s/0/not set/')"
|
||||
|
||||
echo ""
|
||||
echo " Kernel Timer: $(echo "$KCONF" | grep CONFIG_HZ= | head -1)"
|
||||
echo " Preempt: $(echo "$KCONF" | grep CONFIG_PREEMPT= | head -1)"
|
||||
echo " Optimize: $(echo "$KCONF" | grep CONFIG_CC_OPTIMIZE | head -1)"
|
||||
else
|
||||
warn "/proc/config.gz not available (CONFIG_IKCONFIG disabled - OK for production)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== 2. MESA / GPU ==="
|
||||
MESA_VER=$(glxinfo -B 2>/dev/null | grep "OpenGL version" || echo "glxinfo not available")
|
||||
echo " Mesa: $MESA_VER"
|
||||
echo " PAN_MESA_DEBUG=${PAN_MESA_DEBUG:-unset}"
|
||||
echo " MESA_NO_ERROR=${MESA_NO_ERROR:-unset}"
|
||||
echo " MESA_SHADER_CACHE_DIR=${MESA_SHADER_CACHE_DIR:-unset}"
|
||||
for BAD in MESA_DEBUG MESA_VERBOSE GALLIUM_DUMP LIBGL_DEBUG; do
|
||||
VAL=$(printenv $BAD 2>/dev/null)
|
||||
[ -n "$VAL" ] && warn "$BAD=$VAL should NOT be set in production"
|
||||
done
|
||||
[ "$PAN_MESA_DEBUG" = "sync" ] && warn "PAN_MESA_DEBUG=sync kills ~30% FPS"
|
||||
[ "$PAN_MESA_DEBUG" = "trace" ] && warn "PAN_MESA_DEBUG=trace captures every draw call"
|
||||
|
||||
echo ""
|
||||
echo "=== 3. RETROARCH ==="
|
||||
RA_CFG="/storage/.config/retroarch/retroarch.cfg"
|
||||
if [ -f "$RA_CFG" ]; then
|
||||
echo " log_verbosity = $(grep ^log_verbosity "$RA_CFG" | cut -d'"' -f2)"
|
||||
echo " perfcnt_enable = $(grep ^perfcnt_enable "$RA_CFG" | cut -d'"' -f2)"
|
||||
echo " video_driver = $(grep ^video_driver "$RA_CFG" | cut -d'"' -f2)"
|
||||
echo " menu_driver = $(grep ^menu_driver "$RA_CFG" | cut -d'"' -f2)"
|
||||
echo " autosave_interval = $(grep ^autosave_interval "$RA_CFG" | cut -d'"' -f2)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== 4. EMULATOR BINARIES ==="
|
||||
for bin in /usr/bin/retroarch /usr/bin/ppsspp /usr/bin/flycast /usr/bin/melonDS /usr/bin/mupen64plus; do
|
||||
[ -x "$bin" ] || continue
|
||||
STRIPPED=$(file "$bin" | grep -o "not stripped\|stripped")
|
||||
SIZE=$(du -h "$bin" | cut -f1)
|
||||
echo " $bin: $STRIPPED ($SIZE)"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "=== 5. LIBRETRO CORES ==="
|
||||
TOTAL=0; UNSTRIPPED=0
|
||||
for core in /tmp/cores/*.so /usr/lib/libretro/*.so; do
|
||||
[ -f "$core" ] || continue
|
||||
TOTAL=$((TOTAL+1))
|
||||
file "$core" | grep -q "not stripped" && UNSTRIPPED=$((UNSTRIPPED+1))
|
||||
done
|
||||
echo " Total cores: $TOTAL"
|
||||
echo " Unstripped: $UNSTRIPPED"
|
||||
[ "$UNSTRIPPED" -gt 0 ] && warn "$UNSTRIPPED cores not stripped"
|
||||
|
||||
echo ""
|
||||
echo "=== 6. SYSTEM STATE ==="
|
||||
echo " CPU governor: $(cat /sys/devices/system/cpu/cpufreq/policy0/scaling_governor 2>/dev/null)"
|
||||
echo " CPU freq: $(cat /sys/devices/system/cpu/cpufreq/policy0/scaling_cur_freq 2>/dev/null) kHz"
|
||||
echo " GPU governor: $(cat /sys/class/devfreq/ff400000.gpu/governor 2>/dev/null)"
|
||||
echo " GPU freq: $(cat /sys/class/devfreq/ff400000.gpu/cur_freq 2>/dev/null) Hz"
|
||||
echo " DMC governor: $(cat /sys/class/devfreq/dmc/governor 2>/dev/null)"
|
||||
echo " Temperature: $(cat /sys/class/thermal/thermal_zone0/temp 2>/dev/null)m°C"
|
||||
echo " MemAvailable: $(grep MemAvailable /proc/meminfo | awk '{print $2}') kB"
|
||||
echo " CmaTotal: $(grep CmaTotal /proc/meminfo | awk '{print $2}') kB"
|
||||
echo " CmaFree: $(grep CmaFree /proc/meminfo | awk '{print $2}') kB"
|
||||
echo " Swap: $(swapon --show --noheadings 2>/dev/null | head -1 || echo 'none')"
|
||||
echo " ZRAM: $(cat /sys/block/zram0/comp_algorithm 2>/dev/null || echo 'not configured')"
|
||||
echo " vm.swappiness: $(sysctl -n vm.swappiness 2>/dev/null)"
|
||||
echo " vm.vfs_cache_pressure: $(sysctl -n vm.vfs_cache_pressure 2>/dev/null)"
|
||||
|
||||
echo ""
|
||||
echo "=== 7. ACTIVE SERVICES ==="
|
||||
systemctl list-units --state=running --type=service --no-pager --no-legend 2>/dev/null | awk '{print " " $1}'
|
||||
|
||||
echo ""
|
||||
echo "========================================"
|
||||
echo -e " Results: ${GREEN}$PASS PASS${NC} ${YELLOW}$WARN WARN${NC} ${RED}$FAIL FAIL${NC}"
|
||||
echo "========================================"
|
||||
Reference in New Issue
Block a user