From 0660a4028776e2afde232ecbdce2943758bf5e15 Mon Sep 17 00:00:00 2001
From: Mikhail Chusavitin <mchusavitin@mchusmbp.local>
Date: Wed, 8 Apr 2026 09:40:18 +0300
Subject: [PATCH] Harden HPL builder cache and runtime libs

---
 iso/builder/build-hpl.sh | 39 +++++++++++++++++++++++++++++++--------
 iso/builder/build.sh     |  3 ++-
 2 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/iso/builder/build-hpl.sh b/iso/builder/build-hpl.sh
index d93f0a3..9c5f0b4 100755
--- a/iso/builder/build-hpl.sh
+++ b/iso/builder/build-hpl.sh
@@ -27,13 +27,22 @@ echo "=== HPL ${HPL_VERSION} ==="
 CACHE_DIR="${DIST_DIR}/hpl-${HPL_VERSION}"
 CACHE_ROOT="${BEE_CACHE_DIR:-${DIST_DIR}/cache}"
 DOWNLOAD_CACHE_DIR="${CACHE_ROOT}/hpl-downloads"
+HPL_SOURCE_META="${DOWNLOAD_CACHE_DIR}/hpl-${HPL_VERSION}.source"
 
-if [ -x "${CACHE_DIR}/bin/xhpl" ]; then
+cache_valid() {
+    [ -x "${CACHE_DIR}/bin/xhpl" ] || return 1
+    [ -L "${CACHE_DIR}/lib/libopenblas.so" ] || return 1
+    [ -L "${CACHE_DIR}/lib/libblas.so" ] || return 1
+    find "${CACHE_DIR}/lib" -maxdepth 1 -name 'libopenblas*.so*' -type f | grep -q .
+}
+
+if cache_valid; then
     echo "=== HPL cached, skipping build ==="
     echo "binary: ${CACHE_DIR}/bin/xhpl"
     exit 0
 fi
 
+rm -rf "${CACHE_DIR}"
 mkdir -p "${DOWNLOAD_CACHE_DIR}" "${CACHE_DIR}/bin" "${CACHE_DIR}/lib"
 
 # ── download HPL source ────────────────────────────────────────────────────────
@@ -80,6 +89,7 @@ download_hpl_tarball() {
         echo "=== trying HPL source: ${url} ==="
         if download_to_file "${url}" "${tmp}"; then
             mv "${tmp}" "${out}"
+            printf 'mode=tarball\nurl=%s\n' "${url}" > "${HPL_SOURCE_META}"
             return 0
         fi
         rm -f "${tmp}"
@@ -103,9 +113,11 @@ download_hpl_from_git_archive() {
         echo "=== trying HPL git source: ${HPL_GIT_URL} ref ${ref} ==="
         rm -rf "${repo_dir}" "${archive_dir}" "${archive_tmp}"
         if git clone --depth 1 --branch "${ref}" "${HPL_GIT_URL}" "${repo_dir}"; then
+            resolved_commit="$(git -C "${repo_dir}" rev-parse HEAD)"
             mv "${repo_dir}" "${archive_dir}"
             tar czf "${archive_tmp}" -C "${tmp_root}" "hpl-${HPL_VERSION}"
             mv "${archive_tmp}" "${out}"
+            printf 'mode=git\nurl=%s\nref=%s\ncommit=%s\n' "${HPL_GIT_URL}" "${ref}" "${resolved_commit}" > "${HPL_SOURCE_META}"
             rm -rf "${tmp_root}"
             HPL_SOURCE_MODE="git"
             return 0
@@ -123,6 +135,13 @@ download_hpl_from_git_archive() {
     return 1
 }
 
+if [ -f "${HPL_SOURCE_META}" ]; then
+    case "$(awk -F= '$1=="mode"{print $2}' "${HPL_SOURCE_META}" 2>/dev/null)" in
+        git) HPL_SOURCE_MODE="git" ;;
+        tarball) HPL_SOURCE_MODE="tarball" ;;
+    esac
+fi
+
 if [ ! -f "${HPL_TAR}" ]; then
     echo "=== downloading HPL ${HPL_VERSION} ==="
     download_hpl_tarball "${HPL_TAR}" || download_hpl_from_git_archive "${HPL_TAR}"
@@ -140,6 +159,7 @@ if [ "${HPL_SOURCE_MODE}" = "tarball" ]; then
     echo "sha256 OK: hpl-${HPL_VERSION}.tar.gz"
 else
     echo "=== HPL source obtained from git fallback; skipping tarball sha256 check ==="
+    [ -f "${HPL_SOURCE_META}" ] && cat "${HPL_SOURCE_META}"
 fi
 
 # ── download OpenBLAS from Debian 12 apt repo ─────────────────────────────────
@@ -195,12 +215,15 @@ find "${TMP_DEB}" \( -name 'libopenblas*.so*' \) \( -type f -o -type l \) \
     -exec cp -a {} "${CACHE_DIR}/lib/" \;
 echo "=== OpenBLAS libs: $(ls "${CACHE_DIR}/lib/" | wc -l) files ==="
 
-# also need libopenblas-dev header for compilation (we only need the .so symlink)
-OPENBLAS_SO="$(find "${CACHE_DIR}/lib" -maxdepth 1 -name 'libopenblas.so.*' -type f | sort | head -1)"
-[ -n "${OPENBLAS_SO}" ] || { echo "ERROR: libopenblas.so not extracted"; exit 1; }
-SONAME="$(basename "${OPENBLAS_SO}")"
-ln -sf "${SONAME}" "${CACHE_DIR}/lib/libopenblas.so" 2>/dev/null || true
-ln -sf "${SONAME}" "${CACHE_DIR}/lib/libblas.so" 2>/dev/null || true
+# Debian runtime packages may ship the real ELF under a variant-specific name
+# such as libopenblasp-r0.3.xx.so, while libopenblas.so.0 is only a symlink.
+# Pick any real shared object we extracted, then synthesize the generic linker
+# names HPL expects.
+OPENBLAS_REAL_SO="$(find "${CACHE_DIR}/lib" -maxdepth 1 -name 'libopenblas*.so*' -type f | sort | head -1)"
+[ -n "${OPENBLAS_REAL_SO}" ] || { echo "ERROR: libopenblas shared object not extracted"; ls -l "${CACHE_DIR}/lib"; exit 1; }
+OPENBLAS_REAL_NAME="$(basename "${OPENBLAS_REAL_SO}")"
+ln -sf "${OPENBLAS_REAL_NAME}" "${CACHE_DIR}/lib/libopenblas.so" 2>/dev/null || true
+ln -sf "${OPENBLAS_REAL_NAME}" "${CACHE_DIR}/lib/libblas.so" 2>/dev/null || true
 
 # ── build HPL ─────────────────────────────────────────────────────────────────
 BUILD_TMP=$(mktemp -d)
@@ -293,7 +316,7 @@ HPLlib       = \$(LIBdir)/libhpl.a
 # Compiler
 CC           = gcc
 CCNOOPT      = \$(HPL_DEFS)
-CCFLAGS      = \$(HPL_DEFS) -O3 -march=native -funroll-loops -fomit-frame-pointer
+CCFLAGS      = \$(HPL_DEFS) -O3 -mtune=generic -funroll-loops -fomit-frame-pointer
 
 # Linker
 LINKER       = gcc
diff --git a/iso/builder/build.sh b/iso/builder/build.sh
index fd0e2bb..09b12ef 100755
--- a/iso/builder/build.sh
+++ b/iso/builder/build.sh
@@ -1158,7 +1158,8 @@ cp "${HPL_CACHE}/bin/xhpl" "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/xhpl"
 chmod +x "${OVERLAY_STAGE_DIR}/usr/local/lib/bee/xhpl"
 chmod +x "${OVERLAY_STAGE_DIR}/usr/local/bin/bee-hpl" 2>/dev/null || true
 # Inject OpenBLAS runtime libs needed by xhpl
-cp "${HPL_CACHE}/lib/"* "${OVERLAY_STAGE_DIR}/usr/lib/" 2>/dev/null || true
+[ -e "${HPL_CACHE}/lib/libopenblas.so" ] || { echo "ERROR: HPL cache missing libopenblas.so"; exit 1; }
+cp "${HPL_CACHE}/lib/"* "${OVERLAY_STAGE_DIR}/usr/lib/"
 echo "=== HPL injected: xhpl + $(ls "${HPL_CACHE}/lib/" | wc -l) OpenBLAS libs ==="
 
 # --- embed build metadata ---