2 Commits

Author	SHA1	Message	Date
Douglas Teles	a631e9b3c5	Fix audit-build.sh: use /boot/config-* as primary kernel config source ... With CONFIG_IKCONFIG=n (correct for production), /proc/config.gz is not available. The script now reads /boot/config-$(uname -r) as primary source and falls back to /proc/config.gz only if IKCONFIG is enabled. Also removed FRAME_POINTER check (ARM64 forces it via Kconfig select, checking if it's disabled always fails) — now shown as informational. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-18 15:32:41 -03:00
Douglas Teles	85325f88a3	FASE 0+1+2: Production build audit fixes and infrastructure ... Kernel config hardening: - FRAME_POINTER=n: Saves 3-5% CPU overhead on ARM64 (wastes registers) - DEBUG_FS=n: Remove debugfs mount (memory + attack surface) - IKCONFIG=n: Save 100-300KB (kernel config in /proc not needed in production) Mesa/Panfrost: - Add persistent shader cache (MESA_SHADER_CACHE_DIR + 128MB max) Avoids shader recompilation on every emulator launch I/O scheduler: - Enhanced BFQ udev rule: low_latency=1, read_ahead=2048KB, nr_requests=128 Reduces ROM loading stutter on microSD Sysctl: - Add vm.dirty_expire_centisecs=3000 (dirty pages expire after 30s) - Add vm.page-cluster=0 (single-page swap for ZRAM, instant swap-in) Infrastructure: - Create tools/audit-build.sh: comprehensive production build audit script Checks kernel debug flags, Mesa env vars, binary stripping, emulator build types, system state, active services Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-18 14:29:06 -03:00