marfrit/marfrit-packages
0
0
Fork 2
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: marfrit/marfrit-packages:main
Branches Tags
marfrit/marfrit-packages:main
..
compare: marfrit/marfrit-packages:6047c04f7f9dc08f4670f81a0598ec954a0566f9
Branches Tags
marfrit/marfrit-packages:main

1 Commits
main .. 6047c04f7f

Author SHA1 Message Date
claude-noether 6047c04f7f ffmpeg-v4l2-request-fourier: flip libavcodec daedalus ctx no_qpu → qpu-capable (0013) 
Patches 0003 (IDCT 4x4) and 0007 (qpel mc20) created the libavcodec.so
process-global daedalus_ctx via daedalus_ctx_create_no_qpu().  Rationale
at the time: cycle 6/9 had only CPU NEON paths, so a QPU-capable ctx
would have meant pointless Vulkan init in every host process (firefox-
fourier, mpv-fourier, daedalus_v4l2_daemon, ...).

Two things changed since:

  1. Every H.264 hot-path primitive now has a V3D7 compute shader.
     IDCT 4x4/8x8 + 8 deblock variants (luma+chroma × V+H × inter+intra)
     + 30 qpel positions (15 put_ + 15 avg_).  See daedalus-fourier
     PRs #28-#35.

  2. Dispatch overhead has been hammered down — buffer pool in
     v3d_runner (#160) plus persistent command buffer (#161).
     daedalus-fourier PR #36 bench measures the 1080p worst-case
     sum on hertz (Pi 5 V3D 7.1, 30 iters x 5 warmup):

       1080p worst-case sum (IDCT4 + deblock luma + qpel mc22):
         CPU NEON only:  5.57 ms
         QPU only:       1.30 ms   (CPU/QPU sum ratio = 4.30x)

PR #10's CPU-4x-faster-than-QPU verdict (which justified the original
no_qpu ctx choice) is now reversed by ~17x.

This commit adds 0013-h264-ctx-qpu-capable.patch which flips both H.264
TUs (h264_idct_daedalus.c, h264_qpel_daedalus.c) from
daedalus_ctx_create_no_qpu() to daedalus_ctx_create().

daedalus_ctx_create() probes for a usable Vulkan device and falls back
to no_qpu mode if unavailable, so this is safe on hosts without V3D
(x86 build runners, Debian aarch64 builders without renderD, etc.).
Hosts WITH V3D (Pi 5 deployment targets) now route the H.264 hot-path
through V3D compute instead of CPU NEON.

Wired into both arch PKGBUILD (source[] + prepare()) and debian
build-deb.sh; both pkgrel bumped 10 → 11.

Refs reauktion/daedalus-fourier!36.
 2026-05-25 21:09:31 +02:00
40 changed files with 30 additions and 1890 deletions
Expand all files Collapse all files
.gitea/workflows/build.yml
-445
View File
@@ -1732,448 +1732,3 @@ jobs:
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
# ===========================================================================
# sic — quoting-proof remote command execution (git.reauktion.de/marfrit/sic).
# Two packages: sicd (daemon, target hosts) and sic-agent (client + skills).
# Go binaries -> arch-specific. Arch: aarch64 (the Arch fleet is aarch64).
# Debian: amd64 + arm64 (the Debian/Proxmox hosts span both). Cross-built with
# Go's GOARCH on the aarch64 runner.
# ===========================================================================
sicd-arch:
needs: reauktion-home-ca-debian
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: bootstrap runner (idempotent)
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go
- name: import signing key
env:
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
run: |
set -e
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
rm -rf /root/.gnupg /root/repo_pass
mkdir -m700 -p /root/.gnupg
printf '%s' "$PASS" > /root/repo_pass
chmod 600 /root/repo_pass
printf '%s\n' "$PRIV" | gpg --batch --import
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
- name: install deploy ssh key
env:
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
- name: makepkg sicd
run: |
set -e
rm -rf /tmp/build-sicd
cp -r arch/sicd /tmp/build-sicd
chown -R builder:builder /tmp/build-sicd
cd /tmp/build-sicd
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
ls -la *.pkg.tar.* | grep -v "\.sig$"
- name: sign sicd
run: |
set -e
cd /tmp/build-sicd
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
[ -f "$f" ] || continue
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
done
- name: update aarch64 repo db
run: |
set -e
mkdir -p /tmp/arch-stage-sicd
cd /tmp/arch-stage-sicd
rm -f *
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
done
for ext in xz zst gz; do
ls /tmp/build-sicd/*.pkg.tar.$ext 2>/dev/null && \
mv /tmp/build-sicd/*.pkg.tar.$ext /tmp/build-sicd/*.pkg.tar.$ext.sig .
done || true
export GNUPGHOME=/root/.gnupg
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
gpg-connect-agent reloadagent /bye
pkgs=()
for ext in xz zst gz; do
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
done
if [ -f marfrit.db.tar.gz ]; then
for f in "${pkgs[@]}"; do
name=$(echo "$f" | sed -E 's/-[0-9].*//')
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
marfrit.db.tar.gz "$name" 2>/dev/null || true
done
fi
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
--verify marfrit.db.tar.gz "${pkgs[@]}"
ln -sf marfrit.db.tar.gz marfrit.db
ln -sf marfrit.files.tar.gz marfrit.files
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
rm -f marfrit.files.sig
- name: publish to aarch64
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd /tmp/arch-stage-sicd
retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \
./ mfritsche@nc.reauktion.de:arch/aarch64/
- name: wipe secrets
if: always()
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
sic-agent-arch:
needs: sicd-arch
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: bootstrap runner (idempotent)
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go
- name: import signing key
env:
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
run: |
set -e
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
rm -rf /root/.gnupg /root/repo_pass
mkdir -m700 -p /root/.gnupg
printf '%s' "$PASS" > /root/repo_pass
chmod 600 /root/repo_pass
printf '%s\n' "$PRIV" | gpg --batch --import
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
- name: install deploy ssh key
env:
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
- name: makepkg sic-agent
run: |
set -e
rm -rf /tmp/build-sic-agent
cp -r arch/sic-agent /tmp/build-sic-agent
chown -R builder:builder /tmp/build-sic-agent
cd /tmp/build-sic-agent
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
ls -la *.pkg.tar.* | grep -v "\.sig$"
- name: sign sic-agent
run: |
set -e
cd /tmp/build-sic-agent
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
[ -f "$f" ] || continue
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
done
- name: update aarch64 repo db
run: |
set -e
mkdir -p /tmp/arch-stage-sic-agent
cd /tmp/arch-stage-sic-agent
rm -f *
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
done
for ext in xz zst gz; do
ls /tmp/build-sic-agent/*.pkg.tar.$ext 2>/dev/null && \
mv /tmp/build-sic-agent/*.pkg.tar.$ext /tmp/build-sic-agent/*.pkg.tar.$ext.sig .
done || true
export GNUPGHOME=/root/.gnupg
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
gpg-connect-agent reloadagent /bye
pkgs=()
for ext in xz zst gz; do
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
done
if [ -f marfrit.db.tar.gz ]; then
for f in "${pkgs[@]}"; do
name=$(echo "$f" | sed -E 's/-[0-9].*//')
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
marfrit.db.tar.gz "$name" 2>/dev/null || true
done
fi
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
--verify marfrit.db.tar.gz "${pkgs[@]}"
ln -sf marfrit.db.tar.gz marfrit.db
ln -sf marfrit.files.tar.gz marfrit.files
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
rm -f marfrit.files.sig
- name: publish to aarch64
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd /tmp/arch-stage-sic-agent
retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \
./ mfritsche@nc.reauktion.de:arch/aarch64/
- name: wipe secrets
if: always()
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
sicd-debian:
needs: sic-agent-arch
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: install deps
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go
- name: install hertz deploy ssh key
env:
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
chmod 600 /root/.ssh/id_ed25519_hertz
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
- name: build + publish sicd .deb (amd64 + arm64)
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd debian/sicd
for arch in amd64 arm64; do
./build-deb.sh "$arch"
DEB=$(ls sicd_*_${arch}.deb | head -1)
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
marfritrepo@hertz.fritz.box:
for suite in bookworm trixie; do
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
"publish-deb $suite $DEB"
done
done
- name: wipe secrets
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
sic-agent-debian:
needs: sicd-debian
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: install deps
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go
- name: install hertz deploy ssh key
env:
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
chmod 600 /root/.ssh/id_ed25519_hertz
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
- name: build + publish sic-agent .deb (amd64 + arm64)
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd debian/sic-agent
for arch in amd64 arm64; do
./build-deb.sh "$arch"
DEB=$(ls sic-agent_*_${arch}.deb | head -1)
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
marfritrepo@hertz.fritz.box:
for suite in bookworm trixie; do
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
"publish-deb $suite $DEB"
done
done
- name: wipe secrets
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
# -------------------------------------------------------------------------
# reauktion-home-ca — trust anchor for the private reauktion.de Home CA
# (internal *.fritz.box HTTPS; PKI material lives on hertz:/opt/herding/pki/,
# see reference_fritzbox_ca memory). No upstream project: the cert is
# committed alongside the packaging in this repo instead of fetched.
# arch=any / Architecture: all — one build serves every target.
# -------------------------------------------------------------------------
reauktion-home-ca-any:
needs: aish-debian
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: skip if already published
id: skip-check
run: |
set -e
result=$(./.gitea/scripts/check-already-published.sh arch/reauktion-home-ca)
echo "$result" >> "$GITHUB_OUTPUT"
echo "decision: $result"
- name: bootstrap runner (idempotent)
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
- name: import signing key
if: steps.skip-check.outputs.skip != '1'
env:
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
run: |
set -e
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
rm -rf /root/.gnupg /root/repo_pass
mkdir -m700 -p /root/.gnupg
printf '%s' "$PASS" > /root/repo_pass
chmod 600 /root/repo_pass
printf '%s\n' "$PRIV" | gpg --batch --import
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
- name: install deploy ssh key
if: steps.skip-check.outputs.skip != '1'
env:
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
- name: makepkg reauktion-home-ca
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
rm -rf /tmp/build-reauktion-home-ca
cp -r arch/reauktion-home-ca /tmp/build-reauktion-home-ca
chown -R builder:builder /tmp/build-reauktion-home-ca
cd /tmp/build-reauktion-home-ca
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
ls -la *.pkg.tar.* | grep -v "\.sig$"
- name: sign reauktion-home-ca
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
cd /tmp/build-reauktion-home-ca
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
[ -f "$f" ] || continue
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
done
- name: publish reauktion-home-ca to both arches
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
export GNUPGHOME=/root/.gnupg
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
gpg-connect-agent reloadagent /bye
for target in aarch64 x86_64; do
stage="/tmp/arch-stage-$target"
rm -rf "$stage"; mkdir -p "$stage"; cd "$stage"
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f"
done
cp /tmp/build-reauktion-home-ca/*.pkg.tar.* .
pkgs=()
for ext in xz zst gz; do
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
done
if [ -f marfrit.db.tar.gz ]; then
for f in "${pkgs[@]}"; do
name=$(echo "$f" | sed -E 's/-[0-9].*//')
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
marfrit.db.tar.gz "$name" 2>/dev/null || true
done
fi
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
--verify marfrit.db.tar.gz "${pkgs[@]}"
ln -sf marfrit.db.tar.gz marfrit.db
ln -sf marfrit.files.tar.gz marfrit.files
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
ln -sf marfrit.files.tar.gz.sig marfrit.files.sig
retry rsync -avL --copy-unsafe-links \
-e 'ssh -i /root/.ssh/id_ed25519' \
./ "mfritsche@nc.reauktion.de:arch/$target/"
done
- name: wipe secrets
if: always()
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
reauktion-home-ca-debian:
needs: reauktion-home-ca-any
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: skip if already published
id: skip-check
run: |
set -e
result=$(./.gitea/scripts/check-already-published.sh debian/reauktion-home-ca)
echo "$result" >> "$GITHUB_OUTPUT"
echo "decision: $result"
- name: install dpkg
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
- name: install hertz deploy ssh key
if: steps.skip-check.outputs.skip != '1'
env:
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
chmod 600 /root/.ssh/id_ed25519_hertz
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
- name: build reauktion-home-ca .deb
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
cd debian/reauktion-home-ca
./build-deb.sh
ls -la *.deb
- name: upload + publish to suites
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd debian/reauktion-home-ca
DEB=$(ls reauktion-home-ca_*.deb | head -1)
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
marfritrepo@hertz.fritz.box:
for suite in bookworm trixie; do
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
"publish-deb $suite $DEB"
done
- name: wipe secrets
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
.gitignore
-5
View File
@@ -1,5 +0,0 @@
arch/*/src/
arch/*/pkg/
arch/*/*.pkg.tar.*
debian/*/*.deb
arch/*/*.tar.gz
arch/ffmpeg-v4l2-request-fourier/0014-h264-ctx-qpu-capable.patch → arch/ffmpeg-v4l2-request-fourier/0013-h264-ctx-qpu-capable.patch
View File
arch/ffmpeg-v4l2-request-fourier/0013-h264-deblock-chroma-intra-daedalus-fourier.patch
-120
View File
@@ -1,120 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: claude-noether <claude-noether@noreply.localhost>
Date: Sun, 25 May 2026 14:30:00 +0200
Subject: [PATCH] avcodec/aarch64/h264dsp: route H.264 chroma intra deblock (4:2:0) through daedalus-fourier
Substitutes c->v_loop_filter_chroma_intra and c->h_loop_filter_chroma_intra
with daedalus wrappers in the bit_depth=8 / chroma_format_idc<=1 (4:2:0)
branch. 4:2:2 stays on the in-tree NEON path (the daedalus chroma intra
dispatch is 4:2:0-only).
The fourier dispatches were exposed in PR #11 (DEFINE_INTRA_DISPATCH
macro generates the public daedalus_dispatch_h264_deblock_chroma_*_intra
symbols + recipe wrappers).
Re-architects the chroma init: v_loop_filter_chroma_intra was previously
assigned unconditionally to the NEON variant (which works for both 4:2:0
and 4:2:2). We now assign it INSIDE both branches of the chroma_format_idc
conditional, with the 4:2:0 branch picking daedalus and the 4:2:2 branch
keeping NEON. No regression for 4:2:2 streams.
Same NEON-to-NEON via recipe shape as 0010 luma intra.
Refs reauktion/daedalus-v4l2#11 — substitution arc chroma intra.
---
diff --git a/libavcodec/aarch64/h264_idct_daedalus.c b/libavcodec/aarch64/h264_idct_daedalus.c
--- a/libavcodec/aarch64/h264_idct_daedalus.c 2026-05-25 14:21:08.267156263 +0200
+++ libavcodec/aarch64/h264_idct_daedalus.c 2026-05-25 14:21:08.287745931 +0200
@@ -1,5 +1,5 @@
/*
- * H.264 4x4 / 8x8 IDCT + luma v/h (inter+intra) + chroma v/h deblock + chroma DC Hadamard — daedalus-fourier substitution shims.
+ * H.264 4x4 / 8x8 IDCT + luma v/h (inter+intra) + chroma v/h (inter+intra) deblock + chroma DC Hadamard — daedalus-fourier substitution shims.
*
* Routes H264DSPContext.idct_add → daedalus_recipe_dispatch_h264_idct4
* H264DSPContext.idct8_add → daedalus_recipe_dispatch_h264_idct8
@@ -9,6 +9,8 @@
* H264DSPContext.h_loop_filter_chroma → daedalus_recipe_dispatch_h264_deblock_chroma_h
* H264DSPContext.v_loop_filter_luma_intra → daedalus_recipe_dispatch_h264_deblock_luma_v_intra
* H264DSPContext.h_loop_filter_luma_intra → daedalus_recipe_dispatch_h264_deblock_luma_h_intra
+ * H264DSPContext.v_loop_filter_chroma_intra → daedalus_recipe_dispatch_h264_deblock_chroma_v_intra
+ * H264DSPContext.h_loop_filter_chroma_intra → daedalus_recipe_dispatch_h264_deblock_chroma_h_intra
* H264DSPContext.chroma_dc_dequant_idct → daedalus_h264_chroma_dc_hadamard_2x2 + caller-side qmul
* instead of the in-tree ff_h264_*_neon assembly. The recipe layer
* picks the substrate (CPU NEON for cycles 6 + 7 by default; cycle 8
@@ -61,6 +63,10 @@
int alpha, int beta);
void ff_h264_h_loop_filter_luma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
int alpha, int beta);
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
void ff_h264_chroma_dc_dequant_idct_daedalus(int16_t *block, int qmul);
void ff_h264_idct_add_daedalus(uint8_t *dst, int16_t *block, int stride)
@@ -218,3 +224,30 @@
block[stride*1 + xStride*0] = (int16_t)((int)dc[2] * qmul >> 7);
block[stride*1 + xStride*1] = (int16_t)((int)dc[3] * qmul >> 7);
}
+
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta)
+{
+ daedalus_h264_deblock_meta meta = {
+ .dst_off = 0,
+ .alpha = alpha,
+ .beta = beta,
+ };
+ /* tc0[] unused for intra (bS=4 hardcodes the strength). */
+ pthread_once(&g_dctx_once, daedalus_ctx_init_once);
+ daedalus_recipe_dispatch_h264_deblock_chroma_v_intra(g_dctx, pix, (size_t)stride,
+ 1, &meta);
+}
+
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta)
+{
+ daedalus_h264_deblock_meta meta = {
+ .dst_off = 0,
+ .alpha = alpha,
+ .beta = beta,
+ };
+ pthread_once(&g_dctx_once, daedalus_ctx_init_once);
+ daedalus_recipe_dispatch_h264_deblock_chroma_h_intra(g_dctx, pix, (size_t)stride,
+ 1, &meta);
+}
diff --git a/libavcodec/aarch64/h264dsp_init_aarch64.c b/libavcodec/aarch64/h264dsp_init_aarch64.c
--- a/libavcodec/aarch64/h264dsp_init_aarch64.c 2026-05-25 14:21:08.268311057 +0200
+++ libavcodec/aarch64/h264dsp_init_aarch64.c 2026-05-25 14:21:08.287886563 +0200
@@ -42,6 +42,10 @@
void ff_h264_h_loop_filter_luma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
int alpha, int beta);
void ff_h264_chroma_dc_dequant_idct_daedalus(int16_t *block, int qmul);
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
void ff_h264_v_loop_filter_chroma_neon(uint8_t *pix, ptrdiff_t stride, int alpha,
int beta, int8_t *tc0);
void ff_h264_v_loop_filter_chroma_daedalus(uint8_t *pix, ptrdiff_t stride,
@@ -133,14 +137,15 @@
c->h_loop_filter_luma_intra= ff_h264_h_loop_filter_luma_intra_daedalus;
c->v_loop_filter_chroma = ff_h264_v_loop_filter_chroma_daedalus;
- c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_neon;
if (chroma_format_idc <= 1) {
c->chroma_dc_dequant_idct = ff_h264_chroma_dc_dequant_idct_daedalus;
+ c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_daedalus;
c->h_loop_filter_chroma = ff_h264_h_loop_filter_chroma_daedalus;
- c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma_intra_neon;
+ c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma_intra_daedalus;
c->h_loop_filter_chroma_mbaff_intra = ff_h264_h_loop_filter_chroma_mbaff_intra_neon;
} else {
+ c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_neon;
c->h_loop_filter_chroma = ff_h264_h_loop_filter_chroma422_neon;
c->h_loop_filter_chroma_mbaff = ff_h264_h_loop_filter_chroma_neon;
c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma422_intra_neon;
--
2.47.3
arch/ffmpeg-v4l2-request-fourier/0015-h264-ctx-revert-to-no-qpu.patch
-73
View File
@@ -1,73 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Mon, 25 May 2026 22:00:00 +0200
Subject: [PATCH] avcodec/aarch64/h264: revert ctx flip — daedalus-fourier PR
#36 was a measurement artifact
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reverts the daedalus_ctx_create_no_qpu() → daedalus_ctx_create() flip
that landed in 0014-h264-ctx-qpu-capable.patch (marfrit-packages PR
#104). The flip was justified by daedalus-fourier PR #36 which
reported a 4.30x QPU-over-CPU win on the 1080p H.264 hot-path sum.
That number was a measurement artifact. The bench tool's
v3d_runner.read_spv() did a bare fopen() that resolved relative to
cwd; when run from the source directory (as in PR #36), the SPVs at
$builddir/v3d_*.spv were not found, every QPU dispatch returned -1
fast, and the loop timed the failure path. Daedalus-fourier PR #37
fixes the SPV search + bench preflight; corrected numbers from hertz
(Pi 5 V3D 7.1) show QPU is 12-77x SLOWER than CPU NEON at every
H.264 hot-path kernel:
kernel CPU ns/op QPU ns/op winner
IDCT 4x4 luma 10.75 217.63 CPU 20.24x
IDCT 8x8 luma 29.69 785.94 CPU 26.47x
Deblock luma_v 17.63 467.42 CPU 26.51x
Deblock luma_h 38.30 498.53 CPU 13.02x
qpel mc20 (8x8) 30.17 1300.44 CPU 43.10x
qpel mc02 (8x8) 17.69 1363.40 CPU 77.08x
qpel mc22 (8x8) 71.60 1948.37 CPU 27.21x
1080p sum: CPU 5.57 ms vs QPU 123.54 ms — QPU 22x slower.
Until the daedalus QPU dispatch overhead is actually competitive (a
multi-task effort tracked on the daedalus-fourier side), the
libavcodec.so substitution must stay on daedalus_ctx_create_no_qpu()
to avoid pessimizing every host process that loads it
(firefox-fourier RDD, mpv-fourier, daedalus_v4l2_daemon).
Both H.264 TUs (h264_idct_daedalus.c, h264_qpel_daedalus.c) are
reverted; the change is a 2-line revert of patch 0014.
Refs reauktion/daedalus-fourier!37 (the retraction PR).
---
libavcodec/aarch64/h264_idct_daedalus.c | 2 +-
libavcodec/aarch64/h264_qpel_daedalus.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/aarch64/h264_idct_daedalus.c b/libavcodec/aarch64/h264_idct_daedalus.c
--- a/libavcodec/aarch64/h264_idct_daedalus.c
+++ b/libavcodec/aarch64/h264_idct_daedalus.c
@@ -32,7 +32,7 @@ static pthread_once_t g_dctx_once = PTHREAD_ONCE_INIT;
static void daedalus_ctx_init_once(void)
{
- g_dctx = daedalus_ctx_create();
+ g_dctx = daedalus_ctx_create_no_qpu();
}
void ff_h264_idct_add_daedalus(uint8_t *dst, int16_t *block, int stride);
diff --git a/libavcodec/aarch64/h264_qpel_daedalus.c b/libavcodec/aarch64/h264_qpel_daedalus.c
--- a/libavcodec/aarch64/h264_qpel_daedalus.c
+++ b/libavcodec/aarch64/h264_qpel_daedalus.c
@@ -38,7 +38,7 @@ static pthread_once_t g_dctx_once = PTHREAD_ONCE_INIT;
static void daedalus_ctx_init_once(void)
{
- g_dctx = daedalus_ctx_create();
+ g_dctx = daedalus_ctx_create_no_qpu();
}
void ff_put_h264_qpel8_mc20_daedalus(uint8_t *dst, const uint8_t *src, ptrdiff_t stride);
arch/ffmpeg-v4l2-request-fourier/0016-h264-mb-inspect-callback.patch
-132
View File
@@ -1,132 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Tue, 26 May 2026 06:00:00 +0200
Subject: [PATCH] avcodec/h264: per-MB inspection callback (daedalus-decoder
hook)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Adds an opt-in callback fired in ff_h264_hl_decode_mb after the
existing pixel work, used by tools that need per-MB visibility into
the H.264 decode. Initially driven by daedalus-decoder's CLI test
harness (tools/daedalus_decode_h264) which shadows libavcodec's
decode with a frame-major daedalus-decoder run for byte-exact diff
on real H.264 streams; later target is a daedalus-v4l2 daemon
refactor that drives daedalus_decoder_append_mb directly from the
callback instead of letting libavcodec do per-MB pixel work.
Shape: ONE inspection point per MB. Distinct from the per-kernel
function-pointer-hijack pattern that used to live in 0003-0014
patches (now reverted via 0015 for ctx, and architecturally retired
per daedalus-fourier PR #37's measurement-correction). Per-block
synchronous Vulkan dispatch from libavcodec was structurally non-
competitive; per-MB CPU-side observation feeding a per-frame batch
submit is the right shape.
Two new fields in H264Context (appended at end of struct; no ABI
surface visible to non-libavcodec callers since H264Context is
internal — declared in h264dec.h, not h264.h). One new exported
function ff_h264_set_mb_inspect_cb to set them.
Zero behaviour change when cb == NULL (the default): one load +
one branch per MB in the decoder hot path, both branch-predicted
to fall through.
Used by:
- daedalus-decoder/tools/daedalus_decode_h264 (PR-A1b)
- daedalus-v4l2 daemon shadow-mode path (PR-Q3a.1+)
The CLI static-links libavcodec.a so symbol visibility doesn't matter
there. The daemon dlopens libavcodec.so.62 and resolves the callback
via dlsym, so the symbol MUST be exported — added to libavcodec.v
explicitly (FFmpeg's default version script hides every `ff_*` symbol
as LOCAL behind a glob).
Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
---
libavcodec/h264_mb.c | 20 ++++++++++++++++++++
libavcodec/h264dec.h | 26 ++++++++++++++++++++++++++
libavcodec/libavcodec.v | 1 +
3 files changed, 47 insertions(+)
--- a/libavcodec/h264dec.h
+++ b/libavcodec/h264dec.h
@@ -334,6 +334,16 @@
int pic_order_cnt_bit_size;
} H264SliceContext;
+/* Per-MB inspection callback type — see ff_h264_set_mb_inspect_cb()
+ * below. Fired by ff_h264_hl_decode_mb after the existing pixel work
+ * for every macroblock in coded order. Receives a const H264Context*
+ * so the callback can inspect any slice/picture state (h->slice_ctx
+ * for current slice, h->cur_pic.f->data[plane] for reconstructed
+ * samples, etc.). */
+typedef void (*ff_h264_mb_inspect_cb)(void *opaque,
+ const struct H264Context *h,
+ int mb_x, int mb_y);
+
/**
* H264Context
*/
@@ -579,6 +589,10 @@
int non_gray; ///< Did we encounter a intra frame after a gray gap frame
int noref_gray;
int skip_gray;
+
+ /* Per-MB inspection hook — set via ff_h264_set_mb_inspect_cb. */
+ ff_h264_mb_inspect_cb mb_inspect_cb;
+ void *mb_inspect_opaque;
} H264Context;
extern const uint16_t ff_h264_mb_sizes[4];
@@ -607,6 +621,16 @@
const H2645NAL *nal, void *logctx);
void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl);
+
+/**
+ * Install an opt-in per-MB inspection callback that fires from
+ * ff_h264_hl_decode_mb after each macroblock's pixel work. Default
+ * is NULL (no callback installed); the check is a single branch on
+ * the decoder hot path. See ff_h264_mb_inspect_cb for signature.
+ */
+void ff_h264_set_mb_inspect_cb(AVCodecContext *avctx,
+ ff_h264_mb_inspect_cb cb, void *opaque);
+
void ff_h264_decode_init_vlc(void);
/**
--- a/libavcodec/h264_mb.c
+++ b/libavcodec/h264_mb.c
@@ -815,4 +815,20 @@
hl_decode_mb_simple_16(h, sl);
} else
hl_decode_mb_simple_8(h, sl);
+
+ /* Per-MB inspection callback (opt-in via ff_h264_set_mb_inspect_cb).
+ * Fired AFTER pixel work — reconstructed samples are in
+ * h->cur_pic.f->data[plane] at the MB's raster position by the
+ * time this runs. Callback may inspect slice context via
+ * h->slice_ctx + sl->mb_xy, coeffs via sl->mb, etc. */
+ if (h->mb_inspect_cb)
+ h->mb_inspect_cb(h->mb_inspect_opaque, h, sl->mb_x, sl->mb_y);
+}
+
+void ff_h264_set_mb_inspect_cb(AVCodecContext *avctx,
+ ff_h264_mb_inspect_cb cb, void *opaque)
+{
+ H264Context *h = avctx->priv_data;
+ h->mb_inspect_cb = cb;
+ h->mb_inspect_opaque = opaque;
}
--- a/libavcodec/libavcodec.v
+++ b/libavcodec/libavcodec.v
@@ -3,6 +3,7 @@
av_*;
avcodec_*;
avpriv_*;
+ ff_h264_set_mb_inspect_cb;
avsubtitle_free;
local:
*;
arch/ffmpeg-v4l2-request-fourier/0017-h264-mb-coeffs-side-buffer.patch
-88
View File
@@ -1,88 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Tue, 26 May 2026 07:30:00 +0200
Subject: [PATCH] avcodec/h264: preserve sl->mb coefficients for the inspection
callback (companion to 0016)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Patch 0016 adds a per-MB inspection callback fired at the end of
ff_h264_hl_decode_mb. By that time the IDCT-add path has already
zeroed sl->mb (FFmpeg's convention — see ff_h264_idct_add_neon and
friends), so consumers reading coefficients from the callback get
zeros.
Add a coefficient side buffer in H264Context, populated at the
START of ff_h264_hl_decode_mb (before any IDCT runs) with a single
memcpy from sl->mb. The post-pixel-work callback (still in 0016)
can then read both:
- the side-buffer coefficients (= just-entropy-decoded, pre-IDCT)
- the reconstructed pixels in h->cur_pic.f->data (= P + IDCT(C),
pre-deblock for this MB)
and the consumer can derive P = pixels − IDCT(C) for daedalus-
decoder's frame-major dispatch.
Memcpy is gated on (h->mb_inspect_cb != NULL) — zero overhead when
no consumer is registered. Buffer size = sizeof(int16_t) * 16 * 48
= 1536 bytes per H264Context (fits in one cache line family;
allocated once at H264Context lifetime, reused per MB).
8-bit path only. High-bit-depth H.264 uses the upper half of
sl->mb (int16_t[16 * 48 * 2] declared; the * 2 reserves space for
the high-depth case); preserving the high-depth coefficients
correctly would need a wider side buffer. Punted for now — the
daedalus-decoder consumer is 8-bit-only.
Single-threaded decode assumed at the consumer side (avctx->
thread_count = 1). Multi-slice / multi-threaded streams would
race on the single side buffer — that's an explicit limitation of
the inspection mechanism, documented in 0016's comment block.
Future extension: per-H264SliceContext side buffers.
Used by:
- daedalus-decoder/tools/daedalus_decode_h264 PR-A3+ (CLI test
harness extracts coefficients here for daedalus-decoder
IDCT validation on real H.264 streams).
Refs reauktion/daedalus-decoder!14 (PR-A2 callback wiring).
---
libavcodec/h264_mb.c | 9 +++++++++
libavcodec/h264dec.h | 8 ++++++++
2 files changed, 17 insertions(+)
--- a/libavcodec/h264dec.h
+++ b/libavcodec/h264dec.h
@@ -593,6 +593,14 @@
/* Per-MB inspection hook — set via ff_h264_set_mb_inspect_cb. */
ff_h264_mb_inspect_cb mb_inspect_cb;
void *mb_inspect_opaque;
+
+ /* Per-MB coefficient side buffer — populated at the start of
+ * ff_h264_hl_decode_mb so the post-pixel-work inspection callback
+ * can read the just-entropy-decoded coefficients before IDCT-add
+ * zeros sl->mb. 16 blocks × 48 int16 = libavcodec sl->mb size
+ * (matches DECLARE_ALIGNED(16, int16_t, mb)[16 * 48 * 2] for the
+ * 8-bit half; high-bit-depth paths skip this — see h264_mb.c). */
+ DECLARE_ALIGNED(16, int16_t, mb_inspect_coeffs)[16 * 48];
} H264Context;
extern const uint16_t ff_h264_mb_sizes[4];
--- a/libavcodec/h264_mb.c
+++ b/libavcodec/h264_mb.c
@@ -801,6 +801,15 @@
{
const int mb_xy = sl->mb_xy;
const int mb_type = h->cur_pic.mb_type[mb_xy];
+
+ /* Snapshot just-entropy-decoded coefficients before IDCT-add
+ * destroys them. Only when an inspection callback is registered
+ * — zero cost otherwise. 8-bit path only (high-bit-depth uses
+ * the upper half of sl->mb which we don't preserve here). */
+ if (h->mb_inspect_cb && !h->pixel_shift)
+ memcpy((int16_t *) (uintptr_t) h->mb_inspect_coeffs, sl->mb,
+ sizeof(((H264Context *) NULL)->mb_inspect_coeffs));
+
int is_complex = CONFIG_SMALL || sl->is_complex ||
IS_INTRA_PCM(mb_type) || sl->qscale == 0;
arch/ffmpeg-v4l2-request-fourier/PKGBUILD
+4 -12
View File
@@ -24,7 +24,7 @@ _srcname=FFmpeg
_version='8.1'
_commit='b57fbbe50c9b2656fad86a1a7eeabfd2b2a50935' # v4l2-request-n8.1 tip 2026-04-24
pkgver=8.1.r123329.b57fbbe
pkgrel=16 # pkgrel=16 — rebuild against libx265.so=216 (system upgrade broke SO name dep)
pkgrel=11 # pkgrel=11 — libavcodec.so daedalus ctx flipped no_qpu → qpu-capable (PR #36 bench: QPU 4.30x, 2026-05-25)
epoch=2
# daedalus-fourier pin. 209a421 = PR #2 merge (Phase 8c — public API
@@ -100,12 +100,8 @@ source=("git+https://github.com/Kwiboo/FFmpeg.git#commit=${_commit}"
'0010-h264-deblock-luma-intra-daedalus-fourier.patch'
'0011-h264-chroma-dc-hadamard-daedalus-fourier.patch'
'0012-h264-qpel-rest-daedalus-fourier.patch'
'0013-h264-deblock-chroma-intra-daedalus-fourier.patch'
'0014-h264-ctx-qpu-capable.patch'
'0015-h264-ctx-revert-to-no-qpu.patch'
'0016-h264-mb-inspect-callback.patch'
'0017-h264-mb-coeffs-side-buffer.patch')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
'0013-h264-ctx-qpu-capable.patch')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
pkgver() {
cd "${_srcname}"
@@ -128,11 +124,7 @@ prepare() {
patch -Np1 -i "${srcdir}/0010-h264-deblock-luma-intra-daedalus-fourier.patch"
patch -Np1 -i "${srcdir}/0011-h264-chroma-dc-hadamard-daedalus-fourier.patch"
patch -Np1 -i "${srcdir}/0012-h264-qpel-rest-daedalus-fourier.patch"
patch -Np1 -i "${srcdir}/0013-h264-deblock-chroma-intra-daedalus-fourier.patch"
patch -Np1 -i "${srcdir}/0014-h264-ctx-qpu-capable.patch"
patch -Np1 -i "${srcdir}/0015-h264-ctx-revert-to-no-qpu.patch"
patch -Np1 -i "${srcdir}/0016-h264-mb-inspect-callback.patch"
patch -Np1 -i "${srcdir}/0017-h264-mb-coeffs-side-buffer.patch"
patch -Np1 -i "${srcdir}/0013-h264-ctx-qpu-capable.patch"
}
build() {
arch/linux-pinetab2-danctnix-besser/PKGBUILD
+2 -2
View File
@@ -29,7 +29,7 @@
pkgbase=linux-pinetab2-danctnix-besser
pkgver=7.0.danctnix1
pkgrel=6
pkgrel=5
pkgdesc='PineTab2 (BESser bes2600 driver patchset, kernel-agent managed)'
_srcname=linux-pinetab2
_srctag=v${pkgver%.*}-${pkgver##*.}
@@ -69,7 +69,7 @@ b2sums=('3d9795083c8938f80f480de0d10bfd9c525640e59d5c7f22983de3f12ee42c84c31be90
'71fe98221e802b315e54b4b10d3e8c8f376695a36bae3541d876e5776a37f3fa33c8f8dfa6e51fcbd6f5396add02e5166634165f2351836a0ea0453c172fe56c'
'SKIP'
'50397711a6a3ba522283685a9e7397aeed6663f353f7cba214d4bb88bc98516065b2fca9a36ce13c52644617879f69f39c5305e86db5d9fb25c4dae5434eb9c4'
'19c35c69a4ed40635fb6ad108d2e0ed3d0edc682972255b4a9b719d09e377aa916e533b2e29f4aed256d3a393d77df9e11b661b690acd96edcf61eafe016f55b')
'656a998ab40cb85ee4c00f087b071a91632a6c091da2c84b0f74236b51d2dea6e9db6886625f80ad81dc249d8494ec47cd79d6dd9ea4f5e44f3cde857f861e10')
export KBUILD_BUILD_HOST=archlinux
export KBUILD_BUILD_USER=$pkgbase
arch/linux-pinetab2-danctnix-besser/README.md
+6 -2
View File
@@ -34,11 +34,15 @@ DanctNIX PineTab2 kernel + the BESser bes2600 driver patchset.
|--------|------------|-------------------------------------------------|
| 1–3 | 2026-05-08…05-18 | hand-managed in `marfrit/besser/danctnix-besser-pkgbuild/` (DEPRECATED) |
| 4 | 2026-05-18 | first kernel-agent-managed release; same source contents as the hand-managed pkgrel=3 (Patch I + SCS workaround folded into single cumulative); fixes pkgrel=3's duplicated `0003-arm64-...patch` source-array bug |
| 5 | 2026-05-18 | SCS workaround deployed, pkgrel bump for rebuild |
| 6 | 2026-07-10 | Re-enable `CONFIG_SHADOW_CALL_STACK=y` — GCC 16.1.1 fixed the `arm_neon.h` `#pragma target` + SCS interaction |
## Known caveats
- **`CONFIG_SHADOW_CALL_STACK=n`** in the config: GCC 15.2.1 fails to
build `arch/arm64/lib/xor-neon.c` with `arm_neon.h` `#pragma GCC
target()` blocks and `-fsanitize=shadow-call-stack`. See
`reference_arm64_scs_arm_neon_gcc15` memory and the Makefile
workaround patch included in the cumulative. Track upstream GCC
resolution before re-enabling.
- The `cumulative-c5x-danctnix` series-dir in kernel-agent is currently
a single-file interim (the working hand-curated cumulative) because
the per-series mirrors created in `kernel-agent#17` use DKMS-style
arch/linux-pinetab2-danctnix-besser/config
+1 -1
View File
@@ -791,7 +791,7 @@ CONFIG_HAVE_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_ARCH_SUPPORTS_SHADOW_CALL_STACK=y
CONFIG_SHADOW_CALL_STACK=y
# CONFIG_SHADOW_CALL_STACK is not set
CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
CONFIG_LTO_NONE=y
arch/lmcp/PKGBUILD
+2 -3
View File
@@ -3,7 +3,7 @@
# Source of truth: git.reauktion.de/marfrit/lmcp
pkgname=lmcp
pkgver=1.2.4
pkgver=1.2.1
pkgrel=1
pkgdesc="Lightweight MCP (Model Context Protocol) server in pure Lua"
arch=('any')
@@ -14,7 +14,7 @@ depends=('lua' 'lua-socket')
# pre-release pkgvers (e.g. 1.2.0_rc1 → v1.2.0-rc1).
_tag="v${pkgver//_/-}"
source=("${pkgname}-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/lmcp/archive/${_tag}.tar.gz")
sha256sums=('e8ede94e93f5f2bbc8bacbc795c17640772ecd62855e820394c00f2f3be5b42c')
sha256sums=('bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609')
package() {
cd "${pkgname}"
@@ -22,7 +22,6 @@ package() {
install -Dm644 json.lua "${pkgdir}/usr/share/lua/5.4/json.lua"
install -Dm644 server.lua "${pkgdir}/usr/share/lua/5.4/server.lua"
install -Dm644 hub.lua "${pkgdir}/usr/share/lua/5.4/hub.lua"
install -Dm644 tools.d/nash.lua "${pkgdir}/usr/share/lua/5.4/nash.lua"
install -Dm644 examples/lmcp-hub.service "${pkgdir}/usr/share/doc/${pkgname}/examples/lmcp-hub.service"
install -Dm644 examples/lmcp.service "${pkgdir}/usr/share/doc/${pkgname}/examples/lmcp.service"
install -Dm644 examples/hub-backends.conf.example "${pkgdir}/usr/share/doc/${pkgname}/examples/hub-backends.conf.example"
arch/reauktion-home-ca/PKGBUILD
-20
View File
@@ -1,20 +0,0 @@
# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
# Trust anchor for the private reauktion.de Home CA (internal *.fritz.box
# HTTPS). No upstream project — PKI material generated once on hertz
# (/opt/herding/pki/), the cert is committed alongside this PKGBUILD.
pkgname=reauktion-home-ca
pkgver=20260716
pkgrel=2
pkgdesc="reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS"
arch=('any')
url="https://git.reauktion.de/marfrit/marfrit-packages"
license=('custom')
depends=('ca-certificates-utils')
source=('reauktion-home-ca.crt')
sha256sums=('838fdb30d06ecbc95dabcb545920c03535527282e0e602598659e1de6de71f4c')
package() {
install -Dm644 "${srcdir}/reauktion-home-ca.crt" \
"${pkgdir}/etc/ca-certificates/trust-source/anchors/reauktion-home-ca.crt"
}
arch/reauktion-home-ca/reauktion-home-ca.crt
-33
View File
@@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL
BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u
ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy
MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0
aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY
AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA
A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+
lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M
l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP
6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS
rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU
4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7
rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu
gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq
CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB
o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB
/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb
o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv
bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj
yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9
p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9
2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02
BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q
J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n
uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr
vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG
R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52
oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7
GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V
PMS6m3J+HDRSK/22ACSisUhJIQNL
-----END CERTIFICATE-----
arch/sic-agent/PKGBUILD
-35
View File
@@ -1,35 +0,0 @@
# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
# sic client + agent skills. For agent hosts that drive remote commands.
# Source of truth: git.reauktion.de/marfrit/sic
pkgname=sic-agent
pkgver=0.2.1
pkgrel=1
pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)"
arch=('x86_64' 'aarch64')
url="https://git.reauktion.de/marfrit/sic"
license=('MIT')
makedepends=('go')
depends=('openssh')
source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
sha256sums=('0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6')
build() {
cd "${srcdir}/sic"
case "$CARCH" in
x86_64) export GOARCH=amd64 ;;
aarch64) export GOARCH=arm64 ;;
esac
export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath'
go build -ldflags='-s -w' -o sic ./cmd/sic
}
package() {
cd "${srcdir}/sic"
install -Dm755 sic "${pkgdir}/usr/bin/sic"
# Agent skills — link into the agent's skills dir (e.g. ~/.claude/skills/).
install -Dm644 SKILL.md "${pkgdir}/usr/share/sic-agent/skills/sic/SKILL.md"
install -Dm644 SKILL-bg.md "${pkgdir}/usr/share/sic-agent/skills/sic-bg/SKILL.md"
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}
arch/sicd/PKGBUILD
-33
View File
@@ -1,33 +0,0 @@
# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
# sic daemon — netstring-framed argv over stdin, execvp'd. Deploy on target hosts.
# Source of truth: git.reauktion.de/marfrit/sic
pkgname=sicd
pkgver=0.2.1
pkgrel=1
pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)"
arch=('x86_64' 'aarch64')
url="https://git.reauktion.de/marfrit/sic"
license=('MIT')
makedepends=('go')
optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command')
source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
sha256sums=('0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6')
build() {
cd "${srcdir}/sic"
case "$CARCH" in
x86_64) export GOARCH=amd64 ;;
aarch64) export GOARCH=arm64 ;;
esac
export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath'
go build -ldflags='-s -w' -o sicd ./cmd/sicd
}
package() {
cd "${srcdir}/sic"
install -Dm755 sicd "${pkgdir}/usr/bin/sicd"
install -Dm644 gateway/sicd "${pkgdir}/usr/share/doc/${pkgname}/sicd-reference.py"
install -Dm644 docs/design.md "${pkgdir}/usr/share/doc/${pkgname}/design.md"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}
debian/ffmpeg-v4l2-request-fourier/0014-h264-ctx-qpu-capable.patch → debian/ffmpeg-v4l2-request-fourier/0013-h264-ctx-qpu-capable.patch
Vendored
View File
debian/ffmpeg-v4l2-request-fourier/0013-h264-deblock-chroma-intra-daedalus-fourier.patch
Vendored
-120
View File
@@ -1,120 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: claude-noether <claude-noether@noreply.localhost>
Date: Sun, 25 May 2026 14:30:00 +0200
Subject: [PATCH] avcodec/aarch64/h264dsp: route H.264 chroma intra deblock (4:2:0) through daedalus-fourier
Substitutes c->v_loop_filter_chroma_intra and c->h_loop_filter_chroma_intra
with daedalus wrappers in the bit_depth=8 / chroma_format_idc<=1 (4:2:0)
branch. 4:2:2 stays on the in-tree NEON path (the daedalus chroma intra
dispatch is 4:2:0-only).
The fourier dispatches were exposed in PR #11 (DEFINE_INTRA_DISPATCH
macro generates the public daedalus_dispatch_h264_deblock_chroma_*_intra
symbols + recipe wrappers).
Re-architects the chroma init: v_loop_filter_chroma_intra was previously
assigned unconditionally to the NEON variant (which works for both 4:2:0
and 4:2:2). We now assign it INSIDE both branches of the chroma_format_idc
conditional, with the 4:2:0 branch picking daedalus and the 4:2:2 branch
keeping NEON. No regression for 4:2:2 streams.
Same NEON-to-NEON via recipe shape as 0010 luma intra.
Refs reauktion/daedalus-v4l2#11 — substitution arc chroma intra.
---
diff --git a/libavcodec/aarch64/h264_idct_daedalus.c b/libavcodec/aarch64/h264_idct_daedalus.c
--- a/libavcodec/aarch64/h264_idct_daedalus.c 2026-05-25 14:21:08.267156263 +0200
+++ libavcodec/aarch64/h264_idct_daedalus.c 2026-05-25 14:21:08.287745931 +0200
@@ -1,5 +1,5 @@
/*
- * H.264 4x4 / 8x8 IDCT + luma v/h (inter+intra) + chroma v/h deblock + chroma DC Hadamard — daedalus-fourier substitution shims.
+ * H.264 4x4 / 8x8 IDCT + luma v/h (inter+intra) + chroma v/h (inter+intra) deblock + chroma DC Hadamard — daedalus-fourier substitution shims.
*
* Routes H264DSPContext.idct_add → daedalus_recipe_dispatch_h264_idct4
* H264DSPContext.idct8_add → daedalus_recipe_dispatch_h264_idct8
@@ -9,6 +9,8 @@
* H264DSPContext.h_loop_filter_chroma → daedalus_recipe_dispatch_h264_deblock_chroma_h
* H264DSPContext.v_loop_filter_luma_intra → daedalus_recipe_dispatch_h264_deblock_luma_v_intra
* H264DSPContext.h_loop_filter_luma_intra → daedalus_recipe_dispatch_h264_deblock_luma_h_intra
+ * H264DSPContext.v_loop_filter_chroma_intra → daedalus_recipe_dispatch_h264_deblock_chroma_v_intra
+ * H264DSPContext.h_loop_filter_chroma_intra → daedalus_recipe_dispatch_h264_deblock_chroma_h_intra
* H264DSPContext.chroma_dc_dequant_idct → daedalus_h264_chroma_dc_hadamard_2x2 + caller-side qmul
* instead of the in-tree ff_h264_*_neon assembly. The recipe layer
* picks the substrate (CPU NEON for cycles 6 + 7 by default; cycle 8
@@ -61,6 +63,10 @@
int alpha, int beta);
void ff_h264_h_loop_filter_luma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
int alpha, int beta);
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
void ff_h264_chroma_dc_dequant_idct_daedalus(int16_t *block, int qmul);
void ff_h264_idct_add_daedalus(uint8_t *dst, int16_t *block, int stride)
@@ -218,3 +224,30 @@
block[stride*1 + xStride*0] = (int16_t)((int)dc[2] * qmul >> 7);
block[stride*1 + xStride*1] = (int16_t)((int)dc[3] * qmul >> 7);
}
+
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta)
+{
+ daedalus_h264_deblock_meta meta = {
+ .dst_off = 0,
+ .alpha = alpha,
+ .beta = beta,
+ };
+ /* tc0[] unused for intra (bS=4 hardcodes the strength). */
+ pthread_once(&g_dctx_once, daedalus_ctx_init_once);
+ daedalus_recipe_dispatch_h264_deblock_chroma_v_intra(g_dctx, pix, (size_t)stride,
+ 1, &meta);
+}
+
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta)
+{
+ daedalus_h264_deblock_meta meta = {
+ .dst_off = 0,
+ .alpha = alpha,
+ .beta = beta,
+ };
+ pthread_once(&g_dctx_once, daedalus_ctx_init_once);
+ daedalus_recipe_dispatch_h264_deblock_chroma_h_intra(g_dctx, pix, (size_t)stride,
+ 1, &meta);
+}
diff --git a/libavcodec/aarch64/h264dsp_init_aarch64.c b/libavcodec/aarch64/h264dsp_init_aarch64.c
--- a/libavcodec/aarch64/h264dsp_init_aarch64.c 2026-05-25 14:21:08.268311057 +0200
+++ libavcodec/aarch64/h264dsp_init_aarch64.c 2026-05-25 14:21:08.287886563 +0200
@@ -42,6 +42,10 @@
void ff_h264_h_loop_filter_luma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
int alpha, int beta);
void ff_h264_chroma_dc_dequant_idct_daedalus(int16_t *block, int qmul);
+void ff_h264_v_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
+void ff_h264_h_loop_filter_chroma_intra_daedalus(uint8_t *pix, ptrdiff_t stride,
+ int alpha, int beta);
void ff_h264_v_loop_filter_chroma_neon(uint8_t *pix, ptrdiff_t stride, int alpha,
int beta, int8_t *tc0);
void ff_h264_v_loop_filter_chroma_daedalus(uint8_t *pix, ptrdiff_t stride,
@@ -133,14 +137,15 @@
c->h_loop_filter_luma_intra= ff_h264_h_loop_filter_luma_intra_daedalus;
c->v_loop_filter_chroma = ff_h264_v_loop_filter_chroma_daedalus;
- c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_neon;
if (chroma_format_idc <= 1) {
c->chroma_dc_dequant_idct = ff_h264_chroma_dc_dequant_idct_daedalus;
+ c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_daedalus;
c->h_loop_filter_chroma = ff_h264_h_loop_filter_chroma_daedalus;
- c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma_intra_neon;
+ c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma_intra_daedalus;
c->h_loop_filter_chroma_mbaff_intra = ff_h264_h_loop_filter_chroma_mbaff_intra_neon;
} else {
+ c->v_loop_filter_chroma_intra = ff_h264_v_loop_filter_chroma_intra_neon;
c->h_loop_filter_chroma = ff_h264_h_loop_filter_chroma422_neon;
c->h_loop_filter_chroma_mbaff = ff_h264_h_loop_filter_chroma_neon;
c->h_loop_filter_chroma_intra = ff_h264_h_loop_filter_chroma422_intra_neon;
--
2.47.3
debian/ffmpeg-v4l2-request-fourier/0015-h264-ctx-revert-to-no-qpu.patch
Vendored
-73
View File
@@ -1,73 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Mon, 25 May 2026 22:00:00 +0200
Subject: [PATCH] avcodec/aarch64/h264: revert ctx flip — daedalus-fourier PR
#36 was a measurement artifact
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reverts the daedalus_ctx_create_no_qpu() → daedalus_ctx_create() flip
that landed in 0014-h264-ctx-qpu-capable.patch (marfrit-packages PR
#104). The flip was justified by daedalus-fourier PR #36 which
reported a 4.30x QPU-over-CPU win on the 1080p H.264 hot-path sum.
That number was a measurement artifact. The bench tool's
v3d_runner.read_spv() did a bare fopen() that resolved relative to
cwd; when run from the source directory (as in PR #36), the SPVs at
$builddir/v3d_*.spv were not found, every QPU dispatch returned -1
fast, and the loop timed the failure path. Daedalus-fourier PR #37
fixes the SPV search + bench preflight; corrected numbers from hertz
(Pi 5 V3D 7.1) show QPU is 12-77x SLOWER than CPU NEON at every
H.264 hot-path kernel:
kernel CPU ns/op QPU ns/op winner
IDCT 4x4 luma 10.75 217.63 CPU 20.24x
IDCT 8x8 luma 29.69 785.94 CPU 26.47x
Deblock luma_v 17.63 467.42 CPU 26.51x
Deblock luma_h 38.30 498.53 CPU 13.02x
qpel mc20 (8x8) 30.17 1300.44 CPU 43.10x
qpel mc02 (8x8) 17.69 1363.40 CPU 77.08x
qpel mc22 (8x8) 71.60 1948.37 CPU 27.21x
1080p sum: CPU 5.57 ms vs QPU 123.54 ms — QPU 22x slower.
Until the daedalus QPU dispatch overhead is actually competitive (a
multi-task effort tracked on the daedalus-fourier side), the
libavcodec.so substitution must stay on daedalus_ctx_create_no_qpu()
to avoid pessimizing every host process that loads it
(firefox-fourier RDD, mpv-fourier, daedalus_v4l2_daemon).
Both H.264 TUs (h264_idct_daedalus.c, h264_qpel_daedalus.c) are
reverted; the change is a 2-line revert of patch 0014.
Refs reauktion/daedalus-fourier!37 (the retraction PR).
---
libavcodec/aarch64/h264_idct_daedalus.c | 2 +-
libavcodec/aarch64/h264_qpel_daedalus.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/aarch64/h264_idct_daedalus.c b/libavcodec/aarch64/h264_idct_daedalus.c
--- a/libavcodec/aarch64/h264_idct_daedalus.c
+++ b/libavcodec/aarch64/h264_idct_daedalus.c
@@ -32,7 +32,7 @@ static pthread_once_t g_dctx_once = PTHREAD_ONCE_INIT;
static void daedalus_ctx_init_once(void)
{
- g_dctx = daedalus_ctx_create();
+ g_dctx = daedalus_ctx_create_no_qpu();
}
void ff_h264_idct_add_daedalus(uint8_t *dst, int16_t *block, int stride);
diff --git a/libavcodec/aarch64/h264_qpel_daedalus.c b/libavcodec/aarch64/h264_qpel_daedalus.c
--- a/libavcodec/aarch64/h264_qpel_daedalus.c
+++ b/libavcodec/aarch64/h264_qpel_daedalus.c
@@ -38,7 +38,7 @@ static pthread_once_t g_dctx_once = PTHREAD_ONCE_INIT;
static void daedalus_ctx_init_once(void)
{
- g_dctx = daedalus_ctx_create();
+ g_dctx = daedalus_ctx_create_no_qpu();
}
void ff_put_h264_qpel8_mc20_daedalus(uint8_t *dst, const uint8_t *src, ptrdiff_t stride);
debian/ffmpeg-v4l2-request-fourier/0016-h264-mb-inspect-callback.patch
Vendored
-132
View File
@@ -1,132 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Tue, 26 May 2026 06:00:00 +0200
Subject: [PATCH] avcodec/h264: per-MB inspection callback (daedalus-decoder
hook)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Adds an opt-in callback fired in ff_h264_hl_decode_mb after the
existing pixel work, used by tools that need per-MB visibility into
the H.264 decode. Initially driven by daedalus-decoder's CLI test
harness (tools/daedalus_decode_h264) which shadows libavcodec's
decode with a frame-major daedalus-decoder run for byte-exact diff
on real H.264 streams; later target is a daedalus-v4l2 daemon
refactor that drives daedalus_decoder_append_mb directly from the
callback instead of letting libavcodec do per-MB pixel work.
Shape: ONE inspection point per MB. Distinct from the per-kernel
function-pointer-hijack pattern that used to live in 0003-0014
patches (now reverted via 0015 for ctx, and architecturally retired
per daedalus-fourier PR #37's measurement-correction). Per-block
synchronous Vulkan dispatch from libavcodec was structurally non-
competitive; per-MB CPU-side observation feeding a per-frame batch
submit is the right shape.
Two new fields in H264Context (appended at end of struct; no ABI
surface visible to non-libavcodec callers since H264Context is
internal — declared in h264dec.h, not h264.h). One new exported
function ff_h264_set_mb_inspect_cb to set them.
Zero behaviour change when cb == NULL (the default): one load +
one branch per MB in the decoder hot path, both branch-predicted
to fall through.
Used by:
- daedalus-decoder/tools/daedalus_decode_h264 (PR-A1b)
- daedalus-v4l2 daemon shadow-mode path (PR-Q3a.1+)
The CLI static-links libavcodec.a so symbol visibility doesn't matter
there. The daemon dlopens libavcodec.so.62 and resolves the callback
via dlsym, so the symbol MUST be exported — added to libavcodec.v
explicitly (FFmpeg's default version script hides every `ff_*` symbol
as LOCAL behind a glob).
Refs reauktion/daedalus-decoder!12 (Stage 2 PR-b complete).
---
libavcodec/h264_mb.c | 20 ++++++++++++++++++++
libavcodec/h264dec.h | 26 ++++++++++++++++++++++++++
libavcodec/libavcodec.v | 1 +
3 files changed, 47 insertions(+)
--- a/libavcodec/h264dec.h
+++ b/libavcodec/h264dec.h
@@ -334,6 +334,16 @@
int pic_order_cnt_bit_size;
} H264SliceContext;
+/* Per-MB inspection callback type — see ff_h264_set_mb_inspect_cb()
+ * below. Fired by ff_h264_hl_decode_mb after the existing pixel work
+ * for every macroblock in coded order. Receives a const H264Context*
+ * so the callback can inspect any slice/picture state (h->slice_ctx
+ * for current slice, h->cur_pic.f->data[plane] for reconstructed
+ * samples, etc.). */
+typedef void (*ff_h264_mb_inspect_cb)(void *opaque,
+ const struct H264Context *h,
+ int mb_x, int mb_y);
+
/**
* H264Context
*/
@@ -579,6 +589,10 @@
int non_gray; ///< Did we encounter a intra frame after a gray gap frame
int noref_gray;
int skip_gray;
+
+ /* Per-MB inspection hook — set via ff_h264_set_mb_inspect_cb. */
+ ff_h264_mb_inspect_cb mb_inspect_cb;
+ void *mb_inspect_opaque;
} H264Context;
extern const uint16_t ff_h264_mb_sizes[4];
@@ -607,6 +621,16 @@
const H2645NAL *nal, void *logctx);
void ff_h264_hl_decode_mb(const H264Context *h, H264SliceContext *sl);
+
+/**
+ * Install an opt-in per-MB inspection callback that fires from
+ * ff_h264_hl_decode_mb after each macroblock's pixel work. Default
+ * is NULL (no callback installed); the check is a single branch on
+ * the decoder hot path. See ff_h264_mb_inspect_cb for signature.
+ */
+void ff_h264_set_mb_inspect_cb(AVCodecContext *avctx,
+ ff_h264_mb_inspect_cb cb, void *opaque);
+
void ff_h264_decode_init_vlc(void);
/**
--- a/libavcodec/h264_mb.c
+++ b/libavcodec/h264_mb.c
@@ -815,4 +815,20 @@
hl_decode_mb_simple_16(h, sl);
} else
hl_decode_mb_simple_8(h, sl);
+
+ /* Per-MB inspection callback (opt-in via ff_h264_set_mb_inspect_cb).
+ * Fired AFTER pixel work — reconstructed samples are in
+ * h->cur_pic.f->data[plane] at the MB's raster position by the
+ * time this runs. Callback may inspect slice context via
+ * h->slice_ctx + sl->mb_xy, coeffs via sl->mb, etc. */
+ if (h->mb_inspect_cb)
+ h->mb_inspect_cb(h->mb_inspect_opaque, h, sl->mb_x, sl->mb_y);
+}
+
+void ff_h264_set_mb_inspect_cb(AVCodecContext *avctx,
+ ff_h264_mb_inspect_cb cb, void *opaque)
+{
+ H264Context *h = avctx->priv_data;
+ h->mb_inspect_cb = cb;
+ h->mb_inspect_opaque = opaque;
}
--- a/libavcodec/libavcodec.v
+++ b/libavcodec/libavcodec.v
@@ -3,6 +3,7 @@
av_*;
avcodec_*;
avpriv_*;
+ ff_h264_set_mb_inspect_cb;
avsubtitle_free;
local:
*;
debian/ffmpeg-v4l2-request-fourier/0017-h264-mb-coeffs-side-buffer.patch
Vendored
-88
View File
@@ -1,88 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Tue, 26 May 2026 07:30:00 +0200
Subject: [PATCH] avcodec/h264: preserve sl->mb coefficients for the inspection
callback (companion to 0016)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Patch 0016 adds a per-MB inspection callback fired at the end of
ff_h264_hl_decode_mb. By that time the IDCT-add path has already
zeroed sl->mb (FFmpeg's convention — see ff_h264_idct_add_neon and
friends), so consumers reading coefficients from the callback get
zeros.
Add a coefficient side buffer in H264Context, populated at the
START of ff_h264_hl_decode_mb (before any IDCT runs) with a single
memcpy from sl->mb. The post-pixel-work callback (still in 0016)
can then read both:
- the side-buffer coefficients (= just-entropy-decoded, pre-IDCT)
- the reconstructed pixels in h->cur_pic.f->data (= P + IDCT(C),
pre-deblock for this MB)
and the consumer can derive P = pixels − IDCT(C) for daedalus-
decoder's frame-major dispatch.
Memcpy is gated on (h->mb_inspect_cb != NULL) — zero overhead when
no consumer is registered. Buffer size = sizeof(int16_t) * 16 * 48
= 1536 bytes per H264Context (fits in one cache line family;
allocated once at H264Context lifetime, reused per MB).
8-bit path only. High-bit-depth H.264 uses the upper half of
sl->mb (int16_t[16 * 48 * 2] declared; the * 2 reserves space for
the high-depth case); preserving the high-depth coefficients
correctly would need a wider side buffer. Punted for now — the
daedalus-decoder consumer is 8-bit-only.
Single-threaded decode assumed at the consumer side (avctx->
thread_count = 1). Multi-slice / multi-threaded streams would
race on the single side buffer — that's an explicit limitation of
the inspection mechanism, documented in 0016's comment block.
Future extension: per-H264SliceContext side buffers.
Used by:
- daedalus-decoder/tools/daedalus_decode_h264 PR-A3+ (CLI test
harness extracts coefficients here for daedalus-decoder
IDCT validation on real H.264 streams).
Refs reauktion/daedalus-decoder!14 (PR-A2 callback wiring).
---
libavcodec/h264_mb.c | 9 +++++++++
libavcodec/h264dec.h | 8 ++++++++
2 files changed, 17 insertions(+)
--- a/libavcodec/h264dec.h
+++ b/libavcodec/h264dec.h
@@ -593,6 +593,14 @@
/* Per-MB inspection hook — set via ff_h264_set_mb_inspect_cb. */
ff_h264_mb_inspect_cb mb_inspect_cb;
void *mb_inspect_opaque;
+
+ /* Per-MB coefficient side buffer — populated at the start of
+ * ff_h264_hl_decode_mb so the post-pixel-work inspection callback
+ * can read the just-entropy-decoded coefficients before IDCT-add
+ * zeros sl->mb. 16 blocks × 48 int16 = libavcodec sl->mb size
+ * (matches DECLARE_ALIGNED(16, int16_t, mb)[16 * 48 * 2] for the
+ * 8-bit half; high-bit-depth paths skip this — see h264_mb.c). */
+ DECLARE_ALIGNED(16, int16_t, mb_inspect_coeffs)[16 * 48];
} H264Context;
extern const uint16_t ff_h264_mb_sizes[4];
--- a/libavcodec/h264_mb.c
+++ b/libavcodec/h264_mb.c
@@ -801,6 +801,15 @@
{
const int mb_xy = sl->mb_xy;
const int mb_type = h->cur_pic.mb_type[mb_xy];
+
+ /* Snapshot just-entropy-decoded coefficients before IDCT-add
+ * destroys them. Only when an inspection callback is registered
+ * — zero cost otherwise. 8-bit path only (high-bit-depth uses
+ * the upper half of sl->mb which we don't preserve here). */
+ if (h->mb_inspect_cb && !h->pixel_shift)
+ memcpy((int16_t *) (uintptr_t) h->mb_inspect_coeffs, sl->mb,
+ sizeof(((H264Context *) NULL)->mb_inspect_coeffs));
+
int is_complex = CONFIG_SMALL || sl->is_complex ||
IS_INTRA_PCM(mb_type) || sl->qscale == 0;
debian/ffmpeg-v4l2-request-fourier/build-deb.sh
Vendored
+7 -9
View File
@@ -33,10 +33,12 @@ FFMPEG_VERSION=8.1
# epoch 2 matches Debian's stock ffmpeg (currently 7:7.1.x in trixie);
# +rfourier suffix to avoid colliding with upstream/Debian rebuilds.
PKGVER=2:${FFMPEG_VERSION}+rfourier+gb57fbbe
PKGREL=15 # pkgrel=15 — export ff_h264_set_mb_inspect_cb via libavcodec.v so
# dlsym consumers (daedalus-v4l2 daemon shadow_decoder, PR-Q3a.1)
# can resolve the symbol; static-link CLI was unaffected. No
# behaviour change to existing decode path. (2026-05-26)
PKGREL=11 # pkgrel=11 — libavcodec.so daedalus ctx flipped no_qpu → qpu-capable (PR #36 bench: QPU 4.30x)
# (cycle 9 of the daedalus-v4l2#11 step 2 substitution arc; closes
# the libavcodec.so substitution sequence 6 IDCT4 / 7 IDCT8 /
# 8 luma-v deblock / 9 qpel mc20). Pulls daedalus-fourier PR #2
# which extends the public API with
# daedalus_recipe_dispatch_h264_qpel_mc20. (2026-05-23)
# daedalus-fourier pin. 209a421 = daedalus-fourier PR #2 merge — public
# API now exposes daedalus_recipe_dispatch_h264_qpel_mc20 +
@@ -77,11 +79,7 @@ patch -Np1 -i "$HERE/0009-h264-deblock-chroma-daedalus-fourier.patch"
patch -Np1 -i "$HERE/0010-h264-deblock-luma-intra-daedalus-fourier.patch"
patch -Np1 -i "$HERE/0011-h264-chroma-dc-hadamard-daedalus-fourier.patch"
patch -Np1 -i "$HERE/0012-h264-qpel-rest-daedalus-fourier.patch"
patch -Np1 -i "$HERE/0013-h264-deblock-chroma-intra-daedalus-fourier.patch"
patch -Np1 -i "$HERE/0014-h264-ctx-qpu-capable.patch"
patch -Np1 -i "$HERE/0015-h264-ctx-revert-to-no-qpu.patch"
patch -Np1 -i "$HERE/0016-h264-mb-inspect-callback.patch"
patch -Np1 -i "$HERE/0017-h264-mb-coeffs-side-buffer.patch"
patch -Np1 -i "$HERE/0013-h264-ctx-qpu-capable.patch"
# --- daedalus-fourier: fetch + build static .a with PIC, install to a
# per-build prefix; libavcodec.so links it into the shared object so
debian/ffmpeg-v4l2-request-fourier/debian/changelog
Vendored
-18
View File
@@ -1,21 +1,3 @@
ffmpeg-v4l2-request-fourier (2:8.1+rfourier+gb57fbbe-15) bookworm trixie; urgency=medium
* Amend 0016-h264-mb-inspect-callback.patch to also add
ff_h264_set_mb_inspect_cb to libavcodec/libavcodec.v so the
symbol is exported (GLOBAL) on the shipped libavcodec.so.62.
Without this, FFmpeg's default version script hides every ff_*
symbol behind a glob → LOCAL → dlsym() returns NULL. The CLI
consumer (daedalus_decode_h264) was unaffected because it
static-links libavcodec.a; the daedalus-v4l2 daemon (PR-Q3a.1
shadow_decoder path) dlopens libavcodec.so.62 and needs the
symbol resolvable at runtime.
* No behaviour change to existing decode path. Callback is still
opt-in via the function pointer (NULL default), so paying the
one-load-one-branch cost only when a consumer has explicitly
installed an inspection callback.
-- Markus Fritsche <mfritsche@reauktion.de> Tue, 26 May 2026 15:00:00 +0200
ffmpeg-v4l2-request-fourier (2:8.1+rfourier+gb57fbbe-10) bookworm trixie; urgency=medium
* Add 0007-h264-qpel-mc20-daedalus-fourier.patch —
debian/lmcp/build-deb.sh
Vendored
+7 -5
View File
@@ -7,10 +7,10 @@
# package (Architecture: all, depends on lua + lua-socket).
set -euo pipefail
PKGVER=1.2.4
UPSTREAM_TAG=v1.2.4
PKGVER=1.2.1
UPSTREAM_TAG=v1.2.1
PKGREL=1
LMCP_TARBALL_SHA256=e8ede94e93f5f2bbc8bacbc795c17640772ecd62855e820394c00f2f3be5b42c
LMCP_TARBALL_SHA256=bf9cce1a84c66b1b74c5aec923c5960d60ae33c221afc8d47ce0d74b8f7ee609
HERE=$(dirname "$(readlink -f "$0")")
# Reproducible build: pin all file mtimes + ar member timestamps to a fixed
@@ -28,13 +28,15 @@ echo "$LMCP_TARBALL_SHA256 lmcp.tar.gz" | sha256sum -c
tar xzf lmcp.tar.gz
ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/share/lua/5.4" "$ROOT/usr/bin" "$ROOT/usr/share/doc/lmcp"
mkdir -p "$ROOT/DEBIAN" \
"$ROOT/usr/share/lua/5.4" \
"$ROOT/usr/bin" \
"$ROOT/usr/share/doc/lmcp"
cp lmcp/lmcp.lua "$ROOT/usr/share/lua/5.4/"
cp lmcp/json.lua "$ROOT/usr/share/lua/5.4/"
cp lmcp/server.lua "$ROOT/usr/share/lua/5.4/"
cp lmcp/hub.lua "$ROOT/usr/share/lua/5.4/"
cp lmcp/tools.d/nash.lua "$ROOT/usr/share/lua/5.4/nash.lua"
mkdir -p "$ROOT/usr/share/doc/lmcp/examples"
cp lmcp/examples/lmcp-hub.service "$ROOT/usr/share/doc/lmcp/examples/"
cp lmcp/examples/lmcp.service "$ROOT/usr/share/doc/lmcp/examples/"
debian/lmcp/debian/changelog
Vendored
-27
View File
@@ -1,30 +1,3 @@
lmcp (1.2.4-1) bookworm trixie; urgency=medium
* shell/shell_bg: kill the whole process group (setsid + SIGTERM/SIGKILL)
on timeout or client cancel, so a timed-out command leaves no orphan
process thrashing the host (fixes the shell->shell_bg relaunch pileup).
* Add kill_job and list_jobs tools to reap runaway background jobs
(registry at /tmp/lmcp-bg-jobs.tsv) without a reboot.
-- Markus Fritsche <mfritsche@reauktion.de> Sun, 12 Jul 2026 21:05:38 +0000
lmcp (1.2.3-1) bookworm trixie; urgency=medium
* Add nash memory tools plugin (tools.d/nash.lua): 4 tools
(nash_add, nash_search, nash_list, nash_delete) backed by
mem0 REST API at NASH_URL env var.
* Package installs nash.lua alongside the other lua libs at
/usr/share/lua/5.4/nash.lua.
-- Markus Fritsche <mfritsche@reauktion.de> Fri, 05 Jun 2026 16:00:00 +0000
lmcp (1.2.2-1) bookworm trixie; urgency=medium
* case-insensitive Bearer auth header (lmcp#25): regex ^Bearer → ^[Bb]earer
so clients sending lowercase 'bearer' don't get spurious 401s.
-- Markus Fritsche <mfritsche@reauktion.de> Sat, 30 May 2026 14:52:16 +0000
lmcp (1.2.1-1) bookworm trixie; urgency=medium
* tools.d/ plugin scan (closes lmcp#22): server.lua now scans
debian/reauktion-home-ca/build-deb.sh
Vendored
-60
View File
@@ -1,60 +0,0 @@
#!/bin/bash
# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
# directly. Run from inside the runner container, which has dpkg installed.
#
# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
# root cert), not software with its own release cadence. The .crt is
# committed alongside this script instead of being fetched.
set -euo pipefail
PKGVER=20260716
PKGREL=1
HERE=$(dirname "$(readlink -f "$0")")
# Reproducible build: pin all file mtimes + ar member timestamps so repeat
# builds produce identical bytes (reprepro refuses re-includes otherwise).
export SOURCE_DATE_EPOCH=1784505600
work=$(mktemp -d)
trap "rm -rf $work" EXIT
ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" \
"$ROOT/usr/local/share/ca-certificates" \
"$ROOT/usr/share/doc/reauktion-home-ca"
install -m 644 "$HERE/reauktion-home-ca.crt" \
"$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"
cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
install -m 755 "$HERE/debian/postrm" "$ROOT/DEBIAN/postrm"
cat > "$ROOT/DEBIAN/control" <<EOF
Package: reauktion-home-ca
Version: ${PKGVER}-${PKGREL}
Section: admin
Priority: optional
Architecture: all
Depends: ca-certificates
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
Installs the private, name-constrained root CA used to sign internal
*.fritz.box and reauktion.de HTTPS services, so clients don't need -k
or browser exceptions to reach them.
.
Name constraints permit only fritz.box, reauktion.de, and localhost —
a leaked key can forge certificates for no other domain.
.
SHA256 fingerprint:
A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
EOF
# Build the .deb. Output to current dir of the caller.
DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
echo "built: $HERE/$DEB_OUT"
debian/reauktion-home-ca/debian/changelog
Vendored
-9
View File
@@ -1,9 +0,0 @@
reauktion-home-ca (20260716-1) bookworm trixie; urgency=medium
* Initial release. Trust anchor for the reauktion.de Home CA (created
2026-07-16 on hertz:/opt/herding/pki/), a name-constrained root
permitted only for fritz.box, reauktion.de, and localhost. Installs
to /usr/local/share/ca-certificates/ and runs update-ca-certificates
on install/remove via maintainer scripts.
-- Markus Fritsche <mfritsche@reauktion.de> Mon, 20 Jul 2026 00:00:00 +0000
debian/reauktion-home-ca/debian/control
Vendored
-18
View File
@@ -1,18 +0,0 @@
Package: reauktion-home-ca
Version: 20260716-1
Section: admin
Priority: optional
Architecture: all
Depends: ca-certificates
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
Installs the private, name-constrained root CA used to sign internal
*.fritz.box and reauktion.de HTTPS services, so clients don't need -k
or browser exceptions to reach them.
.
Name constraints permit only fritz.box, reauktion.de, and localhost —
a leaked key can forge certificates for no other domain.
.
SHA256 fingerprint:
A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
debian/reauktion-home-ca/debian/copyright
Vendored
-9
View File
@@ -1,9 +0,0 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: reauktion-home-ca
Source: https://git.reauktion.de/marfrit/marfrit-packages
Files: *
Copyright: 2026 Markus Fritsche <mfritsche@reauktion.de>
License: proprietary
Private PKI trust material for the reauktion.de / fritz.box fleet.
Not for redistribution outside that fleet.
debian/reauktion-home-ca/debian/postinst
Vendored
-8
View File
@@ -1,8 +0,0 @@
#!/bin/sh
set -e
if [ "$1" = "configure" ]; then
update-ca-certificates
fi
exit 0
debian/reauktion-home-ca/debian/postrm
Vendored
-8
View File
@@ -1,8 +0,0 @@
#!/bin/sh
set -e
if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
update-ca-certificates
fi
exit 0
debian/reauktion-home-ca/reauktion-home-ca.crt
Vendored
-33
View File
@@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL
BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u
ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy
MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0
aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY
AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA
A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+
lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M
l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP
6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS
rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU
4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7
rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu
gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq
CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB
o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB
/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb
o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv
bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj
yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9
p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9
2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02
BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q
J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n
uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr
vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG
R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52
oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7
GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V
PMS6m3J+HDRSK/22ACSisUhJIQNL
-----END CERTIFICATE-----
debian/sic-agent/build-deb.sh
Vendored
-65
View File
@@ -1,65 +0,0 @@
#!/bin/bash
# Build sic-agent_<ver>_<arch>.deb using dpkg-deb (Go cross-build of the client
# plus the agent skills).
#
# Usage: ./build-deb.sh [amd64|arm64] (default: host dpkg architecture)
# Needs: go, dpkg-deb, curl.
set -euo pipefail
PKGVER=0.2.1
PKGREL=1
SIC_TARBALL_SHA256=0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6
HERE=$(dirname "$(readlink -f "$0")")
DEB_ARCH="${1:-$(dpkg --print-architecture)}"
case "$DEB_ARCH" in
amd64) GOARCH=amd64 ;;
arm64) GOARCH=arm64 ;;
*) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
esac
export SOURCE_DATE_EPOCH=1784829600
work=$(mktemp -d)
trap "rm -rf $work" EXIT
cd "$work"
curl -sSLfo sic.tar.gz \
"https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz"
echo "$SIC_TARBALL_SHA256 sic.tar.gz" | sha256sum -c
tar xzf sic.tar.gz
( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \
GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sic ./cmd/sic )
ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" \
"$ROOT/usr/share/sic-agent/skills/sic" \
"$ROOT/usr/share/sic-agent/skills/sic-bg" \
"$ROOT/usr/share/doc/sic-agent"
install -m755 sic/sic "$ROOT/usr/bin/sic"
install -m644 sic/SKILL.md "$ROOT/usr/share/sic-agent/skills/sic/SKILL.md"
install -m644 sic/SKILL-bg.md "$ROOT/usr/share/sic-agent/skills/sic-bg/SKILL.md"
install -m644 sic/README.md "$ROOT/usr/share/doc/sic-agent/README.md"
install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sic-agent/copyright"
{
echo "Package: sic-agent"
echo "Version: ${PKGVER}-${PKGREL}"
echo "Architecture: ${DEB_ARCH}"
echo "Maintainer: Markus Fritsche <mfritsche@reauktion.de>"
echo "Section: net"
echo "Priority: optional"
echo "Depends: openssh-client"
echo "Homepage: https://git.reauktion.de/marfrit/sic"
echo "Description: sic client and agent skills for remote command execution"
echo " The sic client frames argv as netstrings and pipes it over ssh to"
echo " sicd on a remote host. Installs /usr/bin/sic and foreground/background"
echo " agent skills under /usr/share/sic-agent/skills/; link them into the"
echo " agent's skills directory to activate. Targets need the sicd package."
} > "$ROOT/DEBIAN/control"
OUT="$HERE/sic-agent_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb"
rm -f "$OUT"
dpkg-deb --root-owner-group --build "$ROOT" "$OUT"
echo "built $OUT"
debian/sic-agent/debian/changelog
Vendored
-22
View File
@@ -1,22 +0,0 @@
sic-agent (0.2.1-1) unstable; urgency=low
* Version bump only (shares the sic v0.2.1 tag). No client changes; the fix is in sicd.
-- Markus Fritsche <mfritsche@reauktion.de> Thu, 23 Jul 2026 18:00:00 +0000
sic-agent (0.2.0-1) unstable; urgency=low
* Client rewritten onto the v2 wire: nested `host/hop1/hop2` targets resolved
via /etc/sic/hosts.toml, boundary-preserved argv ([][]byte, never space-
joined; --sh is the sole shell-line exception). Now forwards stdin AFTER the
frame — fixes the v0.1.0 trap where `sic host 'cat >f' <local` wrote a
zero-byte file and reported success. `ssh -T` (binary-safe frame), exit
status inherited. Reviewed (bullpen 964/970).
-- Markus Fritsche <mfritsche@reauktion.de> Thu, 23 Jul 2026 12:00:00 +0000
sic-agent (0.1.0-1) unstable; urgency=low
* Initial release: sic client plus foreground/background agent skills.
-- Markus Fritsche <mfritsche@reauktion.de> Sat, 19 Jul 2026 12:00:00 +0000
debian/sic-agent/debian/control
Vendored
-19
View File
@@ -1,19 +0,0 @@
Source: sic-agent
Section: net
Priority: optional
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Build-Depends: debhelper-compat (= 13), golang-go
Standards-Version: 4.6.2
Homepage: https://git.reauktion.de/marfrit/sic
Package: sic-agent
Architecture: any
Depends: ${misc:Depends}, openssh-client
Description: sic client and agent skills for remote command execution
The sic client frames argv as netstrings and pipes it over ssh to sicd on a
remote host, which runs it with execvp — no shell re-parses the arguments.
.
Installs /usr/bin/sic and two agent skills (foreground and background remote
exec) under /usr/share/sic-agent/skills/. Link the skills into the agent's
skills directory (for example ~/.claude/skills/) to activate them. The target
hosts need the sicd package.
debian/sic-agent/debian/copyright
Vendored
-26
View File
@@ -1,26 +0,0 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sic
Source: https://git.reauktion.de/marfrit/sic
Files: *
Copyright: 2026 marfrit
License: MIT
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
debian/sicd/build-deb.sh
Vendored
-61
View File
@@ -1,61 +0,0 @@
#!/bin/bash
# Build sicd_<ver>_<arch>.deb using dpkg-deb. Mirrors the lmcp/claude-his-agent
# pattern, plus a Go cross-build step (sicd is a compiled binary).
#
# Usage: ./build-deb.sh [amd64|arm64] (default: host dpkg architecture)
# Needs: go, dpkg-deb, curl.
set -euo pipefail
PKGVER=0.2.1
PKGREL=1
SIC_TARBALL_SHA256=0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6
HERE=$(dirname "$(readlink -f "$0")")
DEB_ARCH="${1:-$(dpkg --print-architecture)}"
case "$DEB_ARCH" in
amd64) GOARCH=amd64 ;;
arm64) GOARCH=arm64 ;;
*) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
esac
# Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC).
export SOURCE_DATE_EPOCH=1784829600
work=$(mktemp -d)
trap "rm -rf $work" EXIT
cd "$work"
curl -sSLfo sic.tar.gz \
"https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz"
echo "$SIC_TARBALL_SHA256 sic.tar.gz" | sha256sum -c
tar xzf sic.tar.gz
( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \
GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sicd ./cmd/sicd )
ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" "$ROOT/usr/share/doc/sicd"
install -m755 sic/sicd "$ROOT/usr/bin/sicd"
install -m644 sic/gateway/sicd "$ROOT/usr/share/doc/sicd/sicd-reference.py"
install -m644 sic/docs/design.md "$ROOT/usr/share/doc/sicd/design.md"
install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sicd/copyright"
{
echo "Package: sicd"
echo "Version: ${PKGVER}-${PKGREL}"
echo "Architecture: ${DEB_ARCH}"
echo "Maintainer: Markus Fritsche <mfritsche@reauktion.de>"
echo "Section: net"
echo "Priority: optional"
echo "Recommends: openssh-server"
echo "Homepage: https://git.reauktion.de/marfrit/sic"
echo "Description: sic daemon — netstring argv over stdin, execvp'd"
echo " sicd reads netstring-framed argv from stdin and runs it with execvp,"
echo " so no shell re-parses the arguments. Deploy on target hosts and run"
echo " it over ssh (as the remote command, or command=\"sicd\" on a key)."
} > "$ROOT/DEBIAN/control"
OUT="$HERE/sicd_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb"
rm -f "$OUT"
dpkg-deb --root-owner-group --build "$ROOT" "$OUT"
echo "built $OUT"
debian/sicd/debian/changelog
Vendored
-30
View File
@@ -1,30 +0,0 @@
sicd (0.2.1-1) unstable; urgency=medium
* Fix a hang: the daemon's stdin pump blocked on the ssh stdin channel long after the child
command had exited, when the v2 client forwarded a stdin that never EOFs (a caller holding
the pipe open). sicd now races the stdin copy against the child's exit and reaps on
child-exit (like ssh itself), so `sic host cmd` returns as soon as cmd finishes instead of
hanging until stdin close or a timeout. Piped/redirected stdin still forwards; a genuine
truncation to a still-reading child is still a non-zero failure. Daemon-only; client
unchanged; v1/v2 dual-read unaffected.
-- Markus Fritsche <mfritsche@reauktion.de> Thu, 23 Jul 2026 18:00:00 +0000
sicd (0.2.0-1) unstable; urgency=low
* Nested targets + v2 argv-boundary wire. `sic host/hop1/hop2 cmd` peels
incus/docker/pct container hops; argv is length-framed end to end so
`sic host touch 'a b'` stays ONE file (no space-split anywhere). The
daemon dual-reads v1 and v2 (first-byte dispatch), so pre-0.2.0 clients
keep working during rollout. Hardened: outer-netstring length cap before
alloc, per-element/byte caps, explicit argc (empty "" args representable,
canonical decimal only). Reviewed (bullpen 964/970).
-- Markus Fritsche <mfritsche@reauktion.de> Thu, 23 Jul 2026 12:00:00 +0000
sicd (0.1.0-1) unstable; urgency=low
* Initial release: netstring-framed argv over stdin, execvp'd. Deploy on
target hosts, run over ssh.
-- Markus Fritsche <mfritsche@reauktion.de> Sat, 19 Jul 2026 12:00:00 +0000
debian/sicd/debian/control
Vendored
-19
View File
@@ -1,19 +0,0 @@
Source: sicd
Section: net
Priority: optional
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Build-Depends: debhelper-compat (= 13), golang-go
Standards-Version: 4.6.2
Homepage: https://git.reauktion.de/marfrit/sic
Package: sicd
Architecture: any
Depends: ${misc:Depends}
Recommends: openssh-server
Description: sic daemon — netstring-framed argv over stdin, execvp'd
sicd reads netstring-framed argv from stdin and runs it with execvp, so no
shell re-parses the arguments. Deploy it on target hosts and run it over ssh
(as the remote command, or pinned to a key with command="sicd").
.
Installs /usr/bin/sicd. A Python reference implementation and the wire-format
design doc are under /usr/share/doc/sicd/.
debian/sicd/debian/copyright
Vendored
-26
View File
@@ -1,26 +0,0 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: sic
Source: https://git.reauktion.de/marfrit/sic
Files: *
Copyright: 2026 marfrit
License: MIT
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.