review: iteration-1 fixes across CI, bridge, VM harness, and docs
CI/pipeline: - KERNEL_TARBALL passed as a YAML env literal '~' was never tilde-expanded and would have failed every hosted kernel-build dispatch; the path is now exported from the shell. Verified reproducible before the fix. - Every job gets timeout-minutes; boot smoke uses timeout -k so a wedged qemu is SIGKILLed instead of holding the job. - Tarball fetch + fail-closed sha256 verification deduplicated into build/fetch-kernel-tarball.sh (with curl retries), used by build-kernel.sh and both CI jobs. busybox fetch gains retries too. - ccache layer for kernel-build (cache keyed on defconfig+patches) recovers the incremental-compile speed the ephemeral-runner move cost. - build-kernel.sh now asserts every fragment option survived olddefconfig — merge_config -m pastes text and Kconfig silently drops unmet symbols. rs485-bridge: - pending-buffer cap (2x max RTU ADU) instead of unbounded growth; explicit accept-loop error handling with backoff instead of .flatten(); per-arm inline bounds instead of the string-keyed lookup whose default would have mis-bounded a future get-input; control-socket cleanup errors surfaced; flag-shaped values rejected in arg parsing; doc example uses a private mktemp dir. Test timing margins widened for contended runners (gap 25->120ms, 60x margin on the split-frame test). VM harness: - stage-1/stage-2 boot scripts share one validated slot parser and one by-name populator (qemu/rootfs/etc/warden-lib.sh) — the duplicated parser had already diverged on validation; userdata/oem mount failures now fail fast with a greppable sentinel; udhcpc fallback keys off the interface actually having an address; switch_root applet guarded. - boot-smoke delegates the qemu invocation to run.sh (machine shape lives in ONE place); run.sh port 0 disables a hostfwd. - mkimage: unknown partition names fail at build time; DISK_END is a max, not last-entry; --state keys validated as filenames. - portal-scenario: mock readiness is asserted (no silent fall-through), hostfwd port collisions retried, mount-failure sentinel fails fast. - ui-shot: fixed sleeps replaced with bounded screendump polling; the repaint assertion is real and documented as such. qmp.py loses its module-global and gains argv validation. Docs/scrub: bench-host paths and the site AP name removed from six more port docs and two evidence tables; path-bearing build artifacts (.elf, .map) untracked (the 154-byte firmware .bin is path-free and stays); ADR-0003 marked visibility-superseded by ADR-0007; stale section cross-reference fixed; flare-edge noted as private for outside readers; stale root-level review report removed per the new workspace rule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
This commit is contained in:
BFE Engineering
co-authored by
Claude Fable 5
Claude Fable 5
parent
b667ff5b1e
commit
2756de0b46
+17
-30
@@ -1,37 +1,19 @@
|
||||
#!/bin/busybox sh
|
||||
# Stage-1 rc: sourced by /init (still PID 1, initramfs root) when a virtio
|
||||
# disk is present. Emulates U-Boot's slot choice — parse warden.slot= from the
|
||||
# cmdline, mount that rootfs, switch_root into it. This is an EMULATION of the
|
||||
# A/B selection outcome, not the BCB/bootcount mechanism itself.
|
||||
# disk is present. Emulates U-Boot's slot choice — mount the validated slot's
|
||||
# rootfs and switch_root into it. This is an EMULATION of the A/B selection
|
||||
# outcome, not the BCB/bootcount mechanism itself.
|
||||
#
|
||||
# Every guarded failure path `return`s to /init (valid in a sourced script;
|
||||
# /init then falls through to shell/poweroff). The final exec is the one
|
||||
# unguardable step: if switch_root itself fails to launch, the shell — PID 1 —
|
||||
# exits and the kernel panics; the applet-existence check below catches the
|
||||
# only preventable variant of that.
|
||||
|
||||
# /dev/block/by-name/<PARTNAME> symlinks: the contract flare-edge slotctl.rs
|
||||
# relies on. blkdevparts= gives every vda partition a PARTNAME in sysfs.
|
||||
mkdir -p /dev/block/by-name
|
||||
for uev in /sys/class/block/vda*/uevent; do
|
||||
[ -f "$uev" ] || continue
|
||||
partname=""
|
||||
devname=""
|
||||
while IFS='=' read -r k v; do
|
||||
case "$k" in
|
||||
PARTNAME) partname="$v" ;;
|
||||
DEVNAME) devname="$v" ;;
|
||||
esac
|
||||
done < "$uev"
|
||||
[ -n "$partname" ] && [ -n "$devname" ] \
|
||||
&& ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
|
||||
done
|
||||
. /etc/warden-lib.sh
|
||||
|
||||
# Slot select: whole-token parse of warden.slot= (never a substring match).
|
||||
slot="_a"
|
||||
for tok in $(cat /proc/cmdline); do
|
||||
case "$tok" in
|
||||
warden.slot=*) slot="${tok#warden.slot=}" ;;
|
||||
esac
|
||||
done
|
||||
case "$slot" in
|
||||
_a|_b) ;;
|
||||
*) echo "rc: bad warden.slot='$slot', falling back to _a"; slot="_a" ;;
|
||||
esac
|
||||
warden_populate_by_name
|
||||
slot="$(warden_slot)"
|
||||
|
||||
root="/dev/block/by-name/rootfs${slot}"
|
||||
if [ ! -e "$root" ]; then
|
||||
@@ -49,6 +31,11 @@ if [ ! -x /mnt/sbin/init ]; then
|
||||
umount /mnt
|
||||
return 0
|
||||
fi
|
||||
if ! command -v switch_root >/dev/null; then
|
||||
echo "rc: busybox lacks switch_root — staying in initramfs"
|
||||
umount /mnt
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "rc: switching root to rootfs${slot} ($root)"
|
||||
exec switch_root /mnt /sbin/init
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
# shellcheck shell=sh
|
||||
# Shared helpers for the VM's stage-1 (/init + /etc/rc, initramfs) and stage-2
|
||||
# (/sbin/init, disk rootfs) boot scripts. Present in both filesystems because
|
||||
# both are staged from the same qemu/rootfs/ skeleton. ONE copy of each rule —
|
||||
# the slot-validation drift between two hand-copied parsers was a real
|
||||
# review finding.
|
||||
|
||||
# Populate /dev/block/by-name/<PARTNAME> symlinks from sysfs uevents — the
|
||||
# contract flare-edge's slotctl.rs relies on. blkdevparts= gives every vda
|
||||
# partition a PARTNAME.
|
||||
warden_populate_by_name() {
|
||||
mkdir -p /dev/block/by-name
|
||||
for uev in /sys/class/block/vda*/uevent; do
|
||||
[ -f "$uev" ] || continue
|
||||
partname=""
|
||||
devname=""
|
||||
while IFS='=' read -r k v; do
|
||||
case "$k" in
|
||||
PARTNAME) partname="$v" ;;
|
||||
DEVNAME) devname="$v" ;;
|
||||
esac
|
||||
done < "$uev"
|
||||
[ -n "$partname" ] && [ -n "$devname" ] \
|
||||
&& ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
|
||||
done
|
||||
}
|
||||
|
||||
# Parse warden.slot= from the cmdline (whole-token, never substring) and
|
||||
# VALIDATE it — echoes "_a" or "_b", falling back to _a with a warning.
|
||||
warden_slot() {
|
||||
slot="_a"
|
||||
for tok in $(cat /proc/cmdline); do
|
||||
case "$tok" in
|
||||
warden.slot=*) slot="${tok#warden.slot=}" ;;
|
||||
esac
|
||||
done
|
||||
case "$slot" in
|
||||
_a|_b) ;;
|
||||
*) echo "warden-lib: bad warden.slot='$slot', falling back to _a" >&2; slot="_a" ;;
|
||||
esac
|
||||
echo "$slot"
|
||||
}
|
||||
+24
-25
@@ -13,33 +13,29 @@ mount -t proc proc /proc
|
||||
mount -t sysfs sysfs /sys
|
||||
mount -t tmpfs tmpfs /tmp
|
||||
|
||||
# Fresh devtmpfs — repopulate the by-name contract (slotctl.rs depends on it).
|
||||
mkdir -p /dev/block/by-name
|
||||
for uev in /sys/class/block/vda*/uevent; do
|
||||
[ -f "$uev" ] || continue
|
||||
partname=""
|
||||
devname=""
|
||||
while IFS='=' read -r k v; do
|
||||
case "$k" in
|
||||
PARTNAME) partname="$v" ;;
|
||||
DEVNAME) devname="$v" ;;
|
||||
esac
|
||||
done < "$uev"
|
||||
[ -n "$partname" ] && [ -n "$devname" ] \
|
||||
&& ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
|
||||
done
|
||||
. /etc/warden-lib.sh
|
||||
|
||||
# Slot (whole-token parse, same rule as stage 1).
|
||||
slot="_a"
|
||||
for tok in $(cat /proc/cmdline); do
|
||||
case "$tok" in
|
||||
warden.slot=*) slot="${tok#warden.slot=}" ;;
|
||||
esac
|
||||
done
|
||||
# Fresh devtmpfs — repopulate the by-name contract; same VALIDATED slot rule
|
||||
# as stage 1 (shared helper, so the two can never drift).
|
||||
warden_populate_by_name
|
||||
slot="$(warden_slot)"
|
||||
|
||||
# The device's matched mounts: persistent state and the slot's oem partition.
|
||||
mount -t ext4 /dev/block/by-name/userdata /userdata || echo "init: userdata mount failed"
|
||||
mount -t ext4 "/dev/block/by-name/oem${slot}" /oem || echo "init: oem${slot} mount failed"
|
||||
# Fail-fast: a scenario against an image whose userdata cannot mount would
|
||||
# otherwise burn its whole deadline before failing generically. warden.shell
|
||||
# still gets a shell for post-mortem.
|
||||
mount_fatal() {
|
||||
if ! mount -t ext4 "/dev/block/by-name/$1" "$2"; then
|
||||
echo "WARDEN-QEMU-MOUNT-FAILED $1"
|
||||
if grep -qw warden.shell /proc/cmdline; then
|
||||
echo "warden.shell: post-mortem shell (exit powers off)"
|
||||
setsid cttyhack sh
|
||||
fi
|
||||
poweroff -f
|
||||
fi
|
||||
}
|
||||
mount_fatal userdata /userdata
|
||||
mount_fatal "oem${slot}" /oem
|
||||
mkdir -p /userdata/warden
|
||||
|
||||
# RS485: warden-modbus hardcodes /dev/ttyS4 at compile time; alias it to the
|
||||
@@ -47,10 +43,13 @@ mkdir -p /userdata/warden
|
||||
[ -c /dev/ttyS0 ] && ln -sf /dev/ttyS0 /dev/ttyS4
|
||||
|
||||
# Network: slirp user-mode net on eth0 (DHCP, fallback to QEMU's static map).
|
||||
# The fallback keys off the interface actually having an address — udhcpc
|
||||
# exiting 0 only proves a lease, not that the hook script applied it.
|
||||
ip link set lo up
|
||||
if [ -e /sys/class/net/eth0 ]; then
|
||||
ip link set eth0 up
|
||||
if ! udhcpc -i eth0 -n -q -t 5 -T 2 >/dev/null 2>&1; then
|
||||
udhcpc -i eth0 -n -q -t 5 -T 2 >/dev/null 2>&1 || true
|
||||
if ! ip -4 addr show dev eth0 | grep -q 'inet '; then
|
||||
ip addr add 10.0.2.15/24 dev eth0 2>/dev/null
|
||||
ip route replace default via 10.0.2.2 dev eth0
|
||||
echo "nameserver 10.0.2.3" > /etc/resolv.conf
|
||||
|
||||
Reference in New Issue
Block a user