mirror of
https://github.com/wirenboard/agent-vm.git
synced 2026-07-09 16:00:54 +00:00
6513050a31
Profiling (LAUNCH-PROFILE.md) found the launch was dominated by PRE-BOOT host work, not the VM boot. Three fixes, ~2.5s -> ~1.8s on a warm launch: - secrets.rs: cache the host git identity (24h TTL, validated strings only). `gh api user` was an uncached ~1.29s HTTPS round-trip on every launch's critical path (added in v0.1.14) — the main 1.3s->2.5s regression. - run.rs: spawn the ghcr.io update-banner check instead of awaiting it (~0.9s off the hot path; banner still fires, just doesn't block boot). - run.rs + images/Dockerfile: move the chrome-MCP MITM-CA `certutil` import out of the per-launch in-guest prelude into the agent-vm-chrome-mcp wrapper. It now runs once at MCP startup (as the chrome user that owns the NSS DB), off the launch path and skipped when chrome is unused (~270ms). Verified end-to-end: the proxy serves a `microsandbox CA`-signed cert that validates against the CA the wrapper imports. Also: kernel A/B showed the nested-virt libkrunfw rebuild adds only ~190ms (KVM ~100, conntrack ~62); DEFERRED_STRUCT_PAGE_INIT and split_irqchip have no wall-clock effect. Build/measure scripts under profiling/. NOTE: the Dockerfile (wrapper) and binary (prelude removal) must ship together — the image must be rebuilt to :latest with the new wrapper before this binary is published, or chrome MCP loses its CA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
45 lines
2.2 KiB
Bash
Executable file
45 lines
2.2 KiB
Bash
Executable file
#!/bin/bash
|
|
# Build libkrunfw .so variants for a boot-time A/B. One shared tree, serial
|
|
# incremental builds. Each .so saved to /tmp/variants/.
|
|
set -u
|
|
cd "$(dirname "$0")"
|
|
SRC=linux-6.12.68
|
|
OUT=/tmp/variants
|
|
mkdir -p "$OUT"
|
|
JOBS=14
|
|
KFLAGS=(KBUILD_BUILD_TIMESTAMP="Tue Feb 17 16:15:12 CET 2026" KBUILD_BUILD_USER=root KBUILD_BUILD_HOST=libkrunfw)
|
|
|
|
build_one() {
|
|
local name="$1" seed="$2"
|
|
echo "===================================================================="
|
|
echo "### BUILD $name ($(date +%T))"
|
|
cp "$seed" "$SRC/.config" || return 1
|
|
( cd "$SRC" && make olddefconfig >/dev/null 2>&1 ) || { echo "olddefconfig FAILED"; return 1; }
|
|
# report effective symbols
|
|
printf " effective: KVM=%s KVM_INTEL=%s KVM_AMD=%s NETFILTER=%s NF_CONNTRACK=%s NF_TABLES=%s BRIDGE=%s POSIX_MQUEUE=%s DEFERRED=%s\n" \
|
|
"$(grep -c '^CONFIG_KVM=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_KVM_INTEL=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_KVM_AMD=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_NETFILTER=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_NF_CONNTRACK=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_NF_TABLES=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_BRIDGE=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_POSIX_MQUEUE=y' $SRC/.config)" \
|
|
"$(grep -c '^CONFIG_DEFERRED_STRUCT_PAGE_INIT=y' $SRC/.config)"
|
|
local t0=$(date +%s)
|
|
( cd "$SRC" && rm -f .version && make -j$JOBS "${KFLAGS[@]}" vmlinux ) >"$OUT/build-$name.log" 2>&1
|
|
local rc=$?
|
|
local t1=$(date +%s)
|
|
if [ $rc -ne 0 ]; then echo " BUILD FAILED rc=$rc (see $OUT/build-$name.log)"; tail -5 "$OUT/build-$name.log"; return 1; fi
|
|
echo " vmlinux built in $((t1-t0))s"
|
|
python3 bin2cbundle.py -t vmlinux "$SRC/vmlinux" kernel.c || { echo "bin2cbundle FAILED"; return 1; }
|
|
cc -fPIC -DABI_VERSION=5 -shared -Wl,-soname,libkrunfw.so.5 -o "$OUT/libkrunfw-$name.so.5.2.1" kernel.c || { echo "link FAILED"; return 1; }
|
|
strip "$OUT/libkrunfw-$name.so.5.2.1"
|
|
echo " -> $OUT/libkrunfw-$name.so.5.2.1 ($(du -h "$OUT/libkrunfw-$name.so.5.2.1" | cut -f1)) total $((t1-t0))s+bundle"
|
|
}
|
|
|
|
for v in stock stock_kvm heavy_nonf heavy heavy_deferred; do
|
|
build_one "$v" "/tmp/cfg_$v" || { echo "ABORTING at $v"; exit 1; }
|
|
done
|
|
echo "### ALL VARIANTS BUILT ($(date +%T))"
|
|
ls -la "$OUT"/*.so.5.2.1
|