RandomX sustained-hash performance authority

.gitattributes

@@ -10,10 +10,13 @@
 *.conf text eol=lf
 *.ps1 text eol=crlf
 
+build/usb/version.env text eol=lf
 build/usb/hooks/* text eol=lf
 build/usb/package-lists/rigos.list.chroot text eol=lf
 build/usb/includes.chroot/usr/local/bin/* text eol=lf
 build/usb/includes.chroot/usr/local/sbin/rigos-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-randomx-msr text eol=lf
 build/usb/includes.chroot/usr/lib/rigos/rigos-runtime-* text eol=lf
 build/usb/includes.chroot/usr/lib/rigos/rigos-miner-* text eol=lf
 build/usb/includes.chroot/usr/lib/rigos/rigos-remote-* text eol=lf
+build/usb/includes.chroot/usr/lib/rigos/rigos-lifecycle-* text eol=lf

.gitignore

@@ -12,3 +12,5 @@
 *.age.partial
 *.pem
 *.key
+__pycache__/
+*.py[cod]

build/usb/Dockerfile

@@ -14,4 +14,4 @@ RUN command -v cargo \
  && rustc --version
 
 WORKDIR /source
-ENTRYPOINT ["/bin/bash", "-c", "python3 ./scripts/check-alpha8-ssh-hotfix.py && exec ./scripts/build-usb-image.sh"]
+ENTRYPOINT ["/bin/bash", "-c", "exec /bin/bash ./scripts/build-usb-image-entrypoint.sh"]

build/usb/hooks/010-rigos.chroot

@@ -4,12 +4,13 @@ set -eu
 useradd --system --home-dir /var/lib/rigos --shell /usr/sbin/nologin --user-group rigos
 useradd --create-home --shell /bin/bash --groups sudo rigosadmin
 passwd --lock rigosadmin
-install -d -o rigos -g rigos -m 0750 /var/lib/rigos
+install -d -o root -g rigos -m 0750 /var/lib/rigos
 install -d -m 0755 /usr/lib/rigos /usr/local/bin
 systemd-tmpfiles --create /usr/lib/tmpfiles.d/rigos.conf
 
-chmod 0755 /usr/local/bin/rigosd /usr/local/bin/rigosctl /usr/local/sbin/rigos-firstboot /usr/local/sbin/rigos-recovery-access /usr/local/sbin/rigos-state-orchestrate /usr/lib/rigos/rigos-miner-gate /usr/lib/rigos/rigos-miner-health /usr/lib/rigos/rigos-runtime-render /usr/lib/rigos/rigos-runtime-publish /usr/lib/rigos/rigos-runtime-gate /usr/lib/rigos/rigos-state-init /usr/lib/rigos/rigos-state-ready /usr/lib/rigos/rigos-config /usr/lib/rigos/rigos-performance /usr/lib/rigos/rigos-lifecycle-cycles /usr/lib/rigos/rigos-identity-seed /usr/lib/rigos/xmrig
-systemctl enable NetworkManager.service ssh.service rigos-state.service rigos-recovery-access.service rigos-state-ready.service rigos-profile-apply.service rigos-runtime-render.service rigos-hugepages.service rigos-firstboot.service rigos-miner.service rigos-miner-health.timer tmp.mount
+rm -f /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub
+chmod 0755 /usr/local/bin/rigosd /usr/local/bin/rigosctl /usr/local/sbin/rigos-firstboot /usr/local/sbin/rigos-recovery-access /usr/local/sbin/rigos-state-orchestrate /usr/lib/rigos/rigos-miner-gate /usr/lib/rigos/rigos-miner-health /usr/lib/rigos/rigos-runtime-render /usr/lib/rigos/rigos-runtime-publish /usr/lib/rigos/rigos-runtime-gate /usr/lib/rigos/rigos-randomx-msr /usr/lib/rigos/rigos-ssh-hostkeys /usr/lib/rigos/rigos-state-init /usr/lib/rigos/rigos-state-ready /usr/lib/rigos/rigos-config /usr/lib/rigos/rigos-performance /usr/lib/rigos/rigos-lifecycle-cycles /usr/lib/rigos/rigos-identity-seed /usr/lib/rigos/xmrig
+systemctl enable NetworkManager.service ssh.service rigos-state.service rigos-recovery-access.service rigos-state-ready.service rigos-ssh-hostkeys.service rigos-profile-apply.service rigos-runtime-render.service rigos-hugepages.service rigos-firstboot.service rigos-randomx-msr.service rigos-miner.service rigos-miner-health.timer tmp.mount
 systemctl disable ssh.socket 2>/dev/null || true
 systemctl disable apt-daily.timer apt-daily-upgrade.timer logrotate.timer fstrim.timer 2>/dev/null || true
 systemctl disable systemd-journald-audit.socket 2>/dev/null || true

build/usb/includes.chroot/etc/ssh/sshd_config.d/01-rigos-hostkeys.conf

@@ -0,0 +1 @@
+HostKey /var/lib/rigos/system/ssh-hostkeys/ssh_host_ed25519_key

build/usb/includes.chroot/etc/systemd/system/rigos-miner-health.service

@@ -12,7 +12,9 @@ ProtectSystem=strict
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectControlGroups=yes
-RestrictAddressFamilies=AF_UNIX
+RestrictAddressFamilies=AF_UNIX AF_INET
+IPAddressDeny=any
+IPAddressAllow=127.0.0.0/8
 RestrictNamespaces=yes
 LockPersonality=yes
 ReadWritePaths=/run/rigos

build/usb/includes.chroot/etc/systemd/system/rigos-miner.service.d/randomx-msr.conf

@@ -0,0 +1,3 @@
+[Unit]
+Wants=rigos-randomx-msr.service
+After=rigos-randomx-msr.service

build/usb/includes.chroot/etc/systemd/system/rigos-randomx-msr.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=Apply reversible RIGOS RandomX MSR optimization
+After=rigos-state-ready.service rigos-profile-apply.service
+Requires=rigos-state-ready.service rigos-profile-apply.service
+Before=rigos-miner.service
+ConditionArchitecture=x86-64
+ConditionPathExists=/var/lib/rigos/current
+
+[Service]
+Type=oneshot
+ExecStartPre=-/usr/sbin/modprobe msr
+ExecStart=/usr/bin/python3 /usr/lib/rigos/rigos-randomx-msr apply
+ExecStop=/usr/bin/python3 /usr/lib/rigos/rigos-randomx-msr restore
+RemainAfterExit=yes
+TimeoutStartSec=20s
+TimeoutStopSec=20s
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ProtectKernelTunables=yes
+ProtectKernelModules=no
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+CapabilityBoundingSet=CAP_SYS_MODULE CAP_SYS_RAWIO
+AmbientCapabilities=CAP_SYS_MODULE CAP_SYS_RAWIO
+ReadWritePaths=/run/rigos -/dev/cpu
+
+[Install]
+WantedBy=multi-user.target

build/usb/includes.chroot/etc/systemd/system/rigos-ssh-hostkeys.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Establish persistent RIGOS SSH host identity
+After=rigos-state-ready.service
+Requires=rigos-state-ready.service
+Before=ssh.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/rigos/rigos-ssh-hostkeys
+RemainAfterExit=yes
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+ReadWritePaths=/var/lib/rigos /run/rigos
+
+[Install]
+WantedBy=multi-user.target

build/usb/includes.chroot/etc/systemd/system/rigos-state-ready.service

@@ -2,7 +2,7 @@
 Description=Verify RIGOS persistent state readiness
 After=rigos-state.service rigos-recovery-access.service
 Requires=rigos-state.service
-Before=rigos-profile-apply.service rigos-firstboot.service rigos-hugepages.service rigos-miner.service
+Before=rigos-ssh-hostkeys.service rigos-profile-apply.service rigos-firstboot.service rigos-hugepages.service rigos-miner.service
 
 [Service]
 Type=oneshot

build/usb/includes.chroot/etc/systemd/system/ssh.service.d/rigos-observe.conf

@@ -1,3 +1,4 @@
 [Unit]
-After=rigos-recovery-access.service
+After=rigos-recovery-access.service rigos-ssh-hostkeys.service
+Requires=rigos-ssh-hostkeys.service
 Wants=rigos-remote-access-observe.service

build/usb/includes.chroot/usr/lib/rigos/rigos-lifecycle-cycles

@@ -1,4 +1,5 @@
 #!/bin/sh
+# Repository contract: LF line endings are required for appliance execution.
 set -eu
 
 cycles="${1:-20}"

build/usb/includes.chroot/usr/lib/rigos/rigos-miner-gate

@@ -5,6 +5,12 @@ import sys
 from pathlib import Path
 
 MAX_JSON_BYTES = 2 * 1024 * 1024
+PRODUCTION_STATE = Path("/var/lib/rigos")
+DEFAULT_MSR_STATUS = Path("/run/rigos/randomx-msr-status.json")
+DEFAULT_MSR_STATE = Path("/run/rigos/randomx-msr-state.json")
+DEFAULT_BOOT_ID = Path("/proc/sys/kernel/random/boot_id")
+MSR_REGISTER = "0x00000000000001a4"
+MSR_TARGET = "0x000000000000000f"
 
 
 def emit(outcome: str, reason: str | None = None) -> None:
@@ -32,10 +38,71 @@ def deny(reason: str) -> int:
     return 2
 
 
+def validate_msr_authority(
+    status_path: Path,
+    state_path: Path,
+    boot_id_path: Path,
+) -> str | None:
+    try:
+        status = read_object(status_path)
+        boot_id = boot_id_path.read_text(encoding="ascii").strip()
+    except (OSError, UnicodeError, ValueError, json.JSONDecodeError):
+        return "randomx_msr_status_unreadable"
+
+    if not boot_id:
+        return "randomx_msr_boot_id_unreadable"
+    if status.get("schema") != "rigos.randomx-msr-status/v1":
+        return "randomx_msr_status_schema_invalid"
+    if status.get("boot_id") != boot_id:
+        return "randomx_msr_status_stale"
+    if status.get("register") != MSR_REGISTER:
+        return "randomx_msr_register_invalid"
+    if status.get("target_value") != MSR_TARGET:
+        return "randomx_msr_target_invalid"
+
+    outcome = status.get("outcome")
+    if outcome == "ready":
+        if not state_path.exists():
+            return "randomx_msr_restore_state_missing"
+        return None
+
+    if outcome in {"unsupported", "unavailable"}:
+        if state_path.exists():
+            return "randomx_msr_baseline_has_mutation_state"
+        return None
+
+    if (
+        outcome == "degraded"
+        and status.get("reason") == "apply_failed_rolled_back"
+        and status.get("rollback") == {"attempted": True, "complete": True}
+    ):
+        if state_path.exists():
+            return "randomx_msr_rollback_state_present"
+        return None
+
+    return "randomx_msr_authority_unsafe"
+
+
+def resolve_msr_paths(args: argparse.Namespace) -> tuple[Path, Path, Path] | None:
+    supplied = (args.msr_status, args.msr_state, args.boot_id)
+    if any(value is not None for value in supplied):
+        if not all(value is not None for value in supplied):
+            raise ValueError("MSR fixture paths must be supplied together")
+        return args.msr_status, args.msr_state, args.boot_id
+
+    if args.state == PRODUCTION_STATE:
+        return DEFAULT_MSR_STATUS, DEFAULT_MSR_STATE, DEFAULT_BOOT_ID
+
+    return None
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
-    parser.add_argument("--state", type=Path, default=Path("/var/lib/rigos"))
+    parser.add_argument("--state", type=Path, default=PRODUCTION_STATE)
     parser.add_argument("--cmdline", type=Path, default=Path("/proc/cmdline"))
+    parser.add_argument("--msr-status", type=Path)
+    parser.add_argument("--msr-state", type=Path)
+    parser.add_argument("--boot-id", type=Path)
     args = parser.parse_args()
 
     policy_path = args.state / "current" / "policy.json"
@@ -65,6 +132,16 @@ def main() -> int:
     except (OSError, ValueError, json.JSONDecodeError):
         return deny("xmrig_config_unreadable")
 
+    try:
+        msr_paths = resolve_msr_paths(args)
+    except ValueError:
+        return deny("randomx_msr_fixture_paths_incomplete")
+
+    if msr_paths is not None:
+        msr_reason = validate_msr_authority(*msr_paths)
+        if msr_reason is not None:
+            return deny(msr_reason)
+
     emit("allowed")
     return 0