Simplify to kernel-install-only; default to BBR + CAKE + ECN

Strip the project down to installing the BBRv3 kernel and nothing else, and
ship a single standard kernel (x86_64 + arm64, latest stable).

- install.sh: 1413 -> ~490 lines. Menu reduced to install latest / install
  specific / status / uninstall. Removed all qdisc/TCP-tuning/speedtest/
  smart-bandwidth/"madness"/clear-config features, the security (Dirty-Frag)
  mitigations, the profile (standard/max) selection, and the self-installing
  `b` quick command. Map dep command->package (sysctl->procps, awk->gawk) and
  abort clearly when a hard dependency is missing.
- Default network stack: on install write /etc/sysctl.d/99-bbrv3.conf with
  net.core.default_qdisc=cake, net.ipv4.tcp_congestion_control=bbr,
  net.ipv4.tcp_ecn=1 (CAKE has no compile-time default-qdisc option, so it is
  set via sysctl); uninstall removes the drop-in.
- prepare-kernel-config.sh: build sch_cake in (=y) so cake works at boot; drop
  the now-dead build-configs/ output.
- build.yml: matrix is just x86_64 + arm64 standard; tags are <arch>-<version>;
  removed the max profile/steps and the update-config-baseline auto-commit job;
  releases carry only the kernel .deb assets.
- Remove cve_2026_31431_detector.py and the two max-profile helper scripts.
- README rewritten to the 4-action, kernel-only scope.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/apply-bbrv3-max-profile.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-target="${1:-net/ipv4/tcp_bbr.c}"
-
-if [[ ! -f "$target" ]]; then
-  echo "BBRv3 source file not found: $target" >&2
-  exit 1
-fi
-
-if ! grep -q '^#define BBR_VERSION[[:space:]]*3' "$target"; then
-  echo "BBRv3 max profile requires BBR_VERSION=3 in $target." >&2
-  exit 1
-fi
-
-python3 - "$target" <<'PY'
-import re
-import sys
-from pathlib import Path
-
-path = Path(sys.argv[1])
-text = path.read_text()
-
-replacements = {
-    r"static const u32 bbr_probe_rtt_win_ms = .*?;": "static const u32 bbr_probe_rtt_win_ms = 10000;",
-    r"static const u32 bbr_probe_rtt_cwnd_gain = .*?;": "static const u32 bbr_probe_rtt_cwnd_gain = BBR_UNIT;",
-    r"static const u32 bbr_probe_rtt_mode_ms = .*?;": "static const u32 bbr_probe_rtt_mode_ms = 10;",
-    r"static const u32 bbr_tso_rtt_shift = .*?;": "static const u32 bbr_tso_rtt_shift = 2;",
-    r"static const int bbr_pacing_margin_percent = .*?;": "static const int bbr_pacing_margin_percent = 0;",
-    r"static const int bbr_startup_pacing_gain = .*?;": "static const int bbr_startup_pacing_gain = BBR_UNIT * 3;",
-    r"static const int bbr_startup_cwnd_gain = .*?;": "static const int bbr_startup_cwnd_gain = BBR_UNIT * 5 / 2;",
-    r"static const int bbr_drain_gain = .*?;": "static const int bbr_drain_gain = BBR_UNIT / 2;",
-    r"static const int bbr_cwnd_gain  = .*?;": "static const int bbr_cwnd_gain  = BBR_UNIT * 5 / 2;",
-    r"static const u32 bbr_cwnd_min_target = .*?;": "static const u32 bbr_cwnd_min_target = 64;",
-    r"static const u32 bbr_full_bw_thresh = .*?;": "static const u32 bbr_full_bw_thresh = BBR_UNIT * 105 / 100;",
-    r"static const u32 bbr_full_bw_cnt = .*?;": "static const u32 bbr_full_bw_cnt = 8;",
-    r"static const int bbr_extra_acked_gain = .*?;": "static const int bbr_extra_acked_gain = BBR_UNIT * 2;",
-    r"static const u32 bbr_extra_acked_max_us = .*?;": "static const u32 bbr_extra_acked_max_us = 750 * 1000;",
-    r"static const bool bbr_precise_ece_ack = .*?;": "static const bool bbr_precise_ece_ack = true;",
-    r"static const u32 bbr_ecn_max_rtt_us = .*?;": "static const u32 bbr_ecn_max_rtt_us = 0;",
-    r"static const u32 bbr_beta = .*?;": "static const u32 bbr_beta = BBR_UNIT * 20 / 100;",
-    r"static const u32 bbr_ecn_alpha_gain = .*?;": "static const u32 bbr_ecn_alpha_gain = BBR_UNIT * 1 / 32;",
-    r"static const u32 bbr_ecn_alpha_init = .*?;": "static const u32 bbr_ecn_alpha_init = BBR_UNIT * 1 / 2;",
-    r"static const u32 bbr_ecn_factor = .*?;": "static const u32 bbr_ecn_factor = BBR_UNIT * 20 / 100;",
-    r"static const u32 bbr_ecn_thresh = .*?;": "static const u32 bbr_ecn_thresh = BBR_UNIT * 7 / 10;",
-    r"static const u32 bbr_ecn_reprobe_gain = .*?;": "static const u32 bbr_ecn_reprobe_gain = BBR_UNIT * 3 / 4;",
-    r"static const u32 bbr_loss_thresh = [^\n]*": "static const u32 bbr_loss_thresh = BBR_UNIT * 3 / 100;  /* max: tolerate 3% loss before backing off */",
-    r"static const bool bbr_loss_probe_recovery = .*?;": "static const bool bbr_loss_probe_recovery = true;",
-    r"static const u32 bbr_full_loss_cnt = .*?;": "static const u32 bbr_full_loss_cnt = 8;",
-    r"static const u32 bbr_full_ecn_cnt = .*?;": "static const u32 bbr_full_ecn_cnt = 4;",
-    r"static const u32 bbr_inflight_headroom = .*?;": "static const u32 bbr_inflight_headroom = BBR_UNIT * 10 / 100;",
-    r"static const u32 bbr_bw_probe_cwnd_gain = .*?;": "static const u32 bbr_bw_probe_cwnd_gain = 2;",
-    r"static const u32 bbr_bw_probe_max_rounds = .*?;": "static const u32 bbr_bw_probe_max_rounds = 16;",
-    r"static const u32 bbr_bw_probe_rand_rounds = .*?;": "static const u32 bbr_bw_probe_rand_rounds = 2;",
-    r"static const u32 bbr_bw_probe_base_us = .*?;": "static const u32 bbr_bw_probe_base_us = 750 * 1000;",
-    r"static const u32 bbr_bw_probe_rand_us = .*?;": "static const u32 bbr_bw_probe_rand_us = 250 * 1000;",
-}
-
-missing = []
-for pattern, replacement in replacements.items():
-    text, count = re.subn(pattern, replacement, text, count=1)
-    if count != 1:
-        missing.append(pattern)
-
-pacing_pattern = re.compile(
-    r"static const int bbr_pacing_gain\[\] = \{\n"
-    r".*?\n"
-    r"\};",
-    re.S,
-)
-pacing_replacement = """static const int bbr_pacing_gain[] = {
-\tBBR_UNIT * 3 / 2,\t/* UP: aggressive but keep BBR's feedback usable */
-\tBBR_UNIT * 3 / 4,\t/* DOWN: drain the queue after probing */
-\tBBR_UNIT,\t\t/* CRUISE: hold the measured pipe */
-\tBBR_UNIT * 5 / 4,\t/* REFILL: refill faster than standard BBRv3 */
-};"""
-text, pacing_count = pacing_pattern.subn(pacing_replacement, text, count=1)
-if pacing_count != 1:
-    missing.append("static const int bbr_pacing_gain[]")
-
-if missing:
-    print("Failed to apply BBRv3 max profile; missing patterns:", file=sys.stderr)
-    for item in missing:
-        print(f"  {item}", file=sys.stderr)
-    sys.exit(1)
-
-path.write_text(text)
-PY
-
-grep -nE 'bbr_(startup_pacing_gain|startup_cwnd_gain|cwnd_gain|pacing_gain|beta|loss_thresh|full_loss_cnt|full_ecn_cnt|inflight_headroom|bw_probe_cwnd_gain|probe_rtt_mode_ms|pacing_margin_percent)' "$target"
-echo "Applied BBRv3 max profile to $target"

scripts/build-bbrv3-max-kernel.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-kernel_version="${1:-}"
-arch="${2:-$(uname -m)}"
-repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
-workdir="${BBRV3_MAX_WORKDIR:-$repo_root/kernel-max}"
-
-if [[ -z "$kernel_version" ]]; then
-  raw_version=$(curl -fsSL https://www.kernel.org/finger_banner |
-    awk -F: '/latest stable version/ {gsub(/^[ \t]+|[ \t]+$/, "", $2); print $2; exit}')
-  if [[ "$raw_version" =~ ^[0-9]+\.[0-9]+$ ]]; then
-    kernel_version="${raw_version}.0"
-  else
-    kernel_version="$raw_version"
-  fi
-fi
-
-case "$arch" in
-  aarch64|arm64)
-    build_arch="arm64"
-    config_arch="arm64"
-    ;;
-  x86_64)
-    build_arch="x86_64"
-    config_arch="x86_64"
-    ;;
-  *)
-    echo "Unsupported arch: $arch" >&2
-    exit 1
-    ;;
-esac
-
-if ! [[ "$kernel_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-  echo "Unexpected kernel version: $kernel_version" >&2
-  exit 1
-fi
-
-branch=$(echo "$kernel_version" | grep -oE '^[0-9]+\.[0-9]+')
-mkdir -p "$workdir"
-
-if [[ ! -d "$workdir/linux/.git" ]]; then
-  git clone --depth=1 --branch "linux-$branch.y" \
-    https://github.com/gregkh/linux.git "$workdir/linux"
-fi
-
-cd "$workdir/linux"
-git fetch --depth=1 origin "linux-$branch.y"
-git reset --hard FETCH_HEAD
-git clean -fdx
-
-bash "$repo_root/scripts/apply-bbrv3-port.sh"
-bash "$repo_root/scripts/apply-bbrv3-max-profile.sh"
-
-grep -v "MODULE_DESCRIPTION" net/ipv4/tcp_bbr.c > net/ipv4/tcp_bbr.c.tmp
-mv net/ipv4/tcp_bbr.c.tmp net/ipv4/tcp_bbr.c
-echo 'MODULE_DESCRIPTION("TCP BBR v3 Max - aggressive throughput profile by Joey");' >> net/ipv4/tcp_bbr.c
-
-IFS='.' read -r v p s <<< "$kernel_version"
-sed -i "s/^VERSION *=.*/VERSION = $v/" Makefile
-sed -i "s/^PATCHLEVEL *=.*/PATCHLEVEL = $p/" Makefile
-sed -i "s/^SUBLEVEL *=.*/SUBLEVEL = $s/" Makefile
-
-export GITHUB_WORKSPACE="$repo_root"
-export KERNEL_VERSION="$kernel_version"
-bash "$repo_root/scripts/prepare-kernel-config.sh" "$config_arch"
-
-if [[ "$build_arch" == "arm64" ]]; then
-  make ARCH=arm64 bindeb-pkg -j"$(nproc)" LOCALVERSION=-bbrv3-max KDEB_COMPRESS=gzip skipdbg=true
-else
-  make bindeb-pkg -j"$(nproc)" LOCALVERSION=-bbrv3-max KDEB_COMPRESS=gzip skipdbg=true
-fi
-
-if find "$workdir" -maxdepth 1 \( -name '*-dbg*.deb' -o -name '*-dbgsym*.deb' \) | grep -q .; then
-  echo "ERROR: debug deb package was generated." >&2
-  find "$workdir" -maxdepth 1 \( -name '*-dbg*.deb' -o -name '*-dbgsym*.deb' \) -print >&2
-  exit 1
-fi
-
-find "$workdir" -maxdepth 1 -name 'linux-*.deb' -print | sort

scripts/prepare-kernel-config.sh

@@ -27,7 +27,10 @@ apply_policy_config() {
   scripts/config --module NET_SCH_FQ_CODEL
   scripts/config --module NET_SCH_PIE
   scripts/config --module NET_SCH_FQ_PIE
-  scripts/config --module NET_SCH_CAKE
+  # CAKE built in (=y) so net.core.default_qdisc=cake works at boot without
+  # depending on module load timing. The kernel's compile-time default qdisc
+  # choice has no "cake" option, so the installer sets it via a sysctl drop-in.
+  scripts/config --enable NET_SCH_CAKE
   scripts/config --disable DEFAULT_FQ_CODEL
   scripts/config --disable DEFAULT_PFIFO_FAST
   scripts/config --enable DEFAULT_FQ
@@ -98,7 +101,7 @@ validate_config() {
   require_config_line 'CONFIG_NET_SCH_FQ_CODEL=m' 'CONFIG_NET_SCH_FQ_CODEL is not module-enabled.'
   require_config_line 'CONFIG_NET_SCH_PIE=m' 'CONFIG_NET_SCH_PIE is not module-enabled.'
   require_config_line 'CONFIG_NET_SCH_FQ_PIE=m' 'CONFIG_NET_SCH_FQ_PIE is not module-enabled.'
-  require_config_line 'CONFIG_NET_SCH_CAKE=m' 'CONFIG_NET_SCH_CAKE is not module-enabled.'
+  require_config_line 'CONFIG_NET_SCH_CAKE=y' 'CONFIG_NET_SCH_CAKE is not built in.'
   require_config_line 'CONFIG_NET_SCH_DEFAULT=y' 'CONFIG_NET_SCH_DEFAULT is not enabled.'
   require_config_line 'CONFIG_DEFAULT_FQ=y' 'CONFIG_DEFAULT_FQ is not enabled.'
   require_config_line 'CONFIG_DEFAULT_NET_SCH="fq"' 'CONFIG_DEFAULT_NET_SCH is not fq.'
@@ -129,7 +132,3 @@ run_olddefconfig
 apply_policy_config
 run_olddefconfig
 validate_config
-
-mkdir -p "$GITHUB_WORKSPACE/build-configs"
-cp .config "$GITHUB_WORKSPACE/build-configs/${arch}.config"
-cp .config "$GITHUB_WORKSPACE/build-configs/${arch}-${KERNEL_VERSION}.config"