sdk: bootstrap standalone repo (P0)
- Dual license (LICENSE / LICENSE-MIT / LICENSE-APACHE) matching the crate manifests. - ADRs 0001-0005: kernel base (direct 5.10->6.18.46 forward-port), tiered MC/DC, standalone repo, CI runner (3rd repo-scoped runner on 0640), driver source-of-truth. - README goal 1 reconciled to the verified 6.18.46 forward-port (was stale plan44/6.6). - Drop tracked build objects (*.o now gitignored). - Capture the display (VOP dclk-pol + WIN1) and GT911 touch bring-up VERIFIED docs + capabilities-audit update from this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf
This commit is contained in:
BFE Engineering
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
19ff701deb
commit
189f7aec38
@@ -0,0 +1,28 @@
|
||||
# ADR 0001 — Kernel base: direct 5.10→6.18 forward-port
|
||||
|
||||
**Status:** Accepted (2026-08-25). Supersedes the README's original plan44/6.6 goal.
|
||||
|
||||
## Context
|
||||
The vendor kernel is Rockchip 5.10.160 (via Luckfox). We want the newest stable
|
||||
Linux runnable on our Buildroot LTS (2025.02.x). Two candidate paths existed:
|
||||
(a) baseline on plan44's OpenWrt RV1106 fork (Linux 6.6, 152 RV1106 patches), or
|
||||
(b) forward-port the vendor tree directly onto a chosen upstream stable.
|
||||
|
||||
## Decision
|
||||
Forward-port **directly to Linux 6.18.46** from vendor 5.10.160, carrying **no
|
||||
plan44/OpenWrt code**. Reuse the already-upstream **rv1126** register data where it
|
||||
matches the RV1106 ("RV-series lite" VOP, clk, pinctrl), and carry the RV1106
|
||||
deltas as a reviewable patch series in `patches/`.
|
||||
|
||||
## Consequences
|
||||
- Done and **hardware-verified on `warden-c8a3`**: clk, pinctrl, eMMC, GMAC, TRNG,
|
||||
OTP, SARADC/TSADC, RTC, USB host, PWM/backlight, VOP display, GT911 touch, AIC8800
|
||||
wifi, RGA, I2S audio, HPMCU mailbox, open NPU driver, PVTM.
|
||||
- **uClibc stays load-bearing** — RGA/MPP/ISP/NPU userspace ship as uClibc-only
|
||||
blobs; a glibc swap breaks media (flare-edge #51, wontfix). Any kernel bump
|
||||
inherits this.
|
||||
- Kernel bumps risk struct-ABI breaks for out-of-tree modules (the AIC8800/VLAN
|
||||
`struct net_device` offset saga). Mitigation: ship one matched full boot+oem
|
||||
image, never a partial reflash.
|
||||
- Deferred by design: crypto-v3 accelerator (CPU crypto already covers the need),
|
||||
open NPU *compute* (a person-year register-RE effort, no RV1106 prior art).
|
||||
@@ -0,0 +1,28 @@
|
||||
# ADR 0002 — Tiered MC/DC coverage policy
|
||||
|
||||
**Status:** Accepted (2026-08-25).
|
||||
|
||||
## Context
|
||||
The goal "port + harden 100% of drivers to 100% MC/DC" is infeasible as literally
|
||||
stated: ~97% of driver LOC is vendor blobs (the AIC8800 wifi driver alone is 88.5K
|
||||
lines) that we cannot meaningfully unit-test to MC/DC on the host. Forcing MC/DC on
|
||||
that code would be theatre, not assurance.
|
||||
|
||||
## Decision
|
||||
A **two-tier** policy, measured against the Hardware Abstraction Seam:
|
||||
|
||||
- **Tier 1 — our own hardware-facing code → real 100% MC/DC.** `modbus_engine.c`,
|
||||
`relays.c`, `warden_rga.c` (wrapper), `hpmcu.rs`, `devmem.rs`, `freshness.c`, plus
|
||||
the two smallest near-mainline drivers where feasible. Enforced in CI
|
||||
(`gcc-14 -fcondition-coverage` + `gcov-14 --conditions`; `cargo-llvm-cov --mcdc`
|
||||
for Rust).
|
||||
- **Tier 2 — ported/vendor drivers → fault-injection + branch coverage + benchmarks**
|
||||
against the simulator, behind a stable seam. Explicitly NOT literal MC/DC.
|
||||
|
||||
## Consequences
|
||||
- Matches the user's framing: "as many drivers as possible at 100% MC/DC; for the
|
||||
rest, a very serious testing and benchmarking system."
|
||||
- The seam is the shared object: the same thing MC/DC is measured against and the
|
||||
simulator implements — the two goals reinforce, not duplicate.
|
||||
- Every Tier-1 file gets a `drivers/<name>-mcdc/` host harness with an
|
||||
`enforce-mcdc.sh` that fails CI below 100%.
|
||||
@@ -0,0 +1,20 @@
|
||||
# ADR 0003 — warden-sdk is a standalone repo
|
||||
|
||||
**Status:** Accepted (2026-08-25).
|
||||
|
||||
## Context
|
||||
Our real SDK changes lived as uncommitted edits in a 2GB opaque vendor fork, with
|
||||
no CI, tests, or versioning of their own. The SDK requirement (future-features-2
|
||||
§SDK) calls for "its own repo, held to firmware standards."
|
||||
|
||||
## Decision
|
||||
A **private** `bfe-noah/warden-sdk` GitHub repo, standalone from day one with its own
|
||||
CI/versioning. Work lands on a `bringup` branch; the first commit to `main` is gated
|
||||
on a passing code-review-harness run, green CI, and [maintainer]'s fresh explicit go-ahead.
|
||||
|
||||
## Consequences
|
||||
- flare-edge consumes warden-sdk later (flared depending on `warden-sim`, drivers
|
||||
built from here) — a separate, [maintainer]-gated integration step; flare-edge is not
|
||||
edited by the SDK-completion effort.
|
||||
- Private for now (references bench devices / in-progress hardening); can be opened
|
||||
later once scrubbed, matching how `flare-deployment` is handled.
|
||||
@@ -0,0 +1,21 @@
|
||||
# ADR 0004 — CI/CD runner: 3rd repo-scoped self-hosted runner on 0640
|
||||
|
||||
**Status:** Accepted (2026-08-25).
|
||||
|
||||
## Context
|
||||
The heavy kernel/firmware build needs the SDK toolchain and Buildroot's baked-in
|
||||
absolute paths — impractical on GitHub-hosted runners. flare-edge already builds on
|
||||
a repo-scoped self-hosted runner on `bfe-mpc-0640` (label `flare-edge`); a repo-scoped
|
||||
registration cannot be shared across repos by label alone.
|
||||
|
||||
## Decision
|
||||
Register a **third repo-scoped runner instance** on `bfe-mpc-0640`, label
|
||||
`warden-sdk` (own systemd unit `actions.runner.bfe-noah-warden-sdk.*`, own
|
||||
`CPUQuota=400%`/`MemoryMax=6G` drop-in). Only the heavy `kernel-build` job uses
|
||||
`runs-on: [self-hosted, warden-sdk]`; all host-testable jobs (tests, coverage, MC/DC,
|
||||
benchmarks, badges, patches-apply) run on GitHub-hosted runners.
|
||||
|
||||
## Consequences
|
||||
- Isolated from the flare backend + flare-edge CI already on that host (cgroup-capped).
|
||||
- Runner setup + host build deps + the project-local `python` venv documented in
|
||||
`docs/ci-cd.md`, mirroring flare-edge's.
|
||||
@@ -0,0 +1,21 @@
|
||||
# ADR 0005 — Hardened drivers live in warden-sdk/drivers/
|
||||
|
||||
**Status:** Accepted (2026-08-25).
|
||||
|
||||
## Context
|
||||
Our own hardware-facing driver code (relays, modbus master, RGA wrapper, HPMCU
|
||||
supervisor, devmem/reset ladder, freshness) is the Tier-1 MC/DC target, but it
|
||||
currently lives in flare-edge. The kernel driver source lives in an un-versioned
|
||||
scratch tree (`flare-edge/research/linux-6.18.46/`).
|
||||
|
||||
## Decision
|
||||
Bring **hardened copies into `warden-sdk/drivers/`** as the canonical source-of-truth,
|
||||
each with its HAL seam and a 100% MC/DC host harness. The RV1106 kernel deltas are
|
||||
formalized as a patch series in `patches/`. flare-edge consumes warden-sdk later
|
||||
(separate, [maintainer]-gated step).
|
||||
|
||||
## Consequences
|
||||
- Realizes the seam architecture (ADR-referenced in `docs/architecture.md`).
|
||||
- flare-edge is not edited now; a later integration step points flare-edge at these.
|
||||
- Risk: temporary duplication of shared constants between the two repos until the
|
||||
integration lands — tracked, acceptable for the bring-up window.
|
||||
Reference in New Issue
Block a user