qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/etc/rc

@@ -0,0 +1,54 @@
+#!/bin/busybox sh
+# Stage-1 rc: sourced by /init (still PID 1, initramfs root) when a virtio
+# disk is present. Emulates U-Boot's slot choice — parse warden.slot= from the
+# cmdline, mount that rootfs, switch_root into it. This is an EMULATION of the
+# A/B selection outcome, not the BCB/bootcount mechanism itself.
+
+# /dev/block/by-name/<PARTNAME> symlinks: the contract flare-edge slotctl.rs
+# relies on. blkdevparts= gives every vda partition a PARTNAME in sysfs.
+mkdir -p /dev/block/by-name
+for uev in /sys/class/block/vda*/uevent; do
+    [ -f "$uev" ] || continue
+    partname=""
+    devname=""
+    while IFS='=' read -r k v; do
+        case "$k" in
+            PARTNAME) partname="$v" ;;
+            DEVNAME)  devname="$v" ;;
+        esac
+    done < "$uev"
+    [ -n "$partname" ] && [ -n "$devname" ] \
+        && ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
+done
+
+# Slot select: whole-token parse of warden.slot= (never a substring match).
+slot="_a"
+for tok in $(cat /proc/cmdline); do
+    case "$tok" in
+        warden.slot=*) slot="${tok#warden.slot=}" ;;
+    esac
+done
+case "$slot" in
+    _a|_b) ;;
+    *) echo "rc: bad warden.slot='$slot', falling back to _a"; slot="_a" ;;
+esac
+
+root="/dev/block/by-name/rootfs${slot}"
+if [ ! -e "$root" ]; then
+    echo "rc: $root missing — staying in initramfs"
+    return 0
+fi
+
+mkdir -p /mnt
+if ! mount -t ext4 "$root" /mnt; then
+    echo "rc: mount of $root failed — staying in initramfs"
+    return 0
+fi
+if [ ! -x /mnt/sbin/init ]; then
+    echo "rc: $root has no /sbin/init — staying in initramfs"
+    umount /mnt
+    return 0
+fi
+
+echo "rc: switching root to rootfs${slot} ($root)"
+exec switch_root /mnt /sbin/init

qemu/rootfs/init

@@ -0,0 +1,32 @@
+#!/bin/busybox sh
+# WardenOS QEMU device sim: initramfs /init (PID 1).
+#
+# Phase-1 duty: prove the kernel booted on -M virt — print the sentinel the
+# smoke test greps for, then power off (PSCI SYSTEM_OFF, so qemu exits).
+# `warden.shell` on the kernel cmdline drops to an interactive shell instead.
+
+/bin/busybox mount -t devtmpfs devtmpfs /dev 2>/dev/null
+
+# The cpio archive carries no device nodes (it is built unprivileged, no
+# mknod); reopen stdio on the real console now that devtmpfs is mounted.
+exec </dev/console >/dev/console 2>&1
+
+/bin/busybox --install -s /bin
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+
+echo "WARDEN-QEMU-BOOT-OK"
+
+# With a virtio disk attached, hand over to the stage-1 rc (by-name symlinks,
+# slot select, switch_root). It only returns on failure — then fall through to
+# the diskless shell/poweroff behavior below.
+if [ -b /dev/vda ]; then
+    . /etc/rc
+fi
+
+if grep -qw warden.shell /proc/cmdline; then
+    echo "warden.shell: interactive shell (exit to power off)"
+    setsid cttyhack sh
+fi
+
+poweroff -f

qemu/rootfs/sbin/init

@@ -0,0 +1,80 @@
+#!/bin/busybox sh
+# Stage-2 init: PID 1 on the disk rootfs (rootfs_a or rootfs_b), reached via
+# switch_root from the initramfs. Brings up the minimum a WardenOS userspace
+# needs — mounts, by-name symlinks, network, serial alias — then starts any
+# payload daemons and holds. This stands in for the device's BusyBox SysV
+# /etc/init.d/S* sequence; it is deliberately tiny, not a model of it.
+
+/bin/busybox mount -t devtmpfs devtmpfs /dev 2>/dev/null
+exec </dev/console >/dev/console 2>&1
+/bin/busybox --install -s /bin
+
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+mount -t tmpfs tmpfs /tmp
+
+# Fresh devtmpfs — repopulate the by-name contract (slotctl.rs depends on it).
+mkdir -p /dev/block/by-name
+for uev in /sys/class/block/vda*/uevent; do
+    [ -f "$uev" ] || continue
+    partname=""
+    devname=""
+    while IFS='=' read -r k v; do
+        case "$k" in
+            PARTNAME) partname="$v" ;;
+            DEVNAME)  devname="$v" ;;
+        esac
+    done < "$uev"
+    [ -n "$partname" ] && [ -n "$devname" ] \
+        && ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
+done
+
+# Slot (whole-token parse, same rule as stage 1).
+slot="_a"
+for tok in $(cat /proc/cmdline); do
+    case "$tok" in
+        warden.slot=*) slot="${tok#warden.slot=}" ;;
+    esac
+done
+
+# The device's matched mounts: persistent state and the slot's oem partition.
+mount -t ext4 /dev/block/by-name/userdata /userdata || echo "init: userdata mount failed"
+mount -t ext4 "/dev/block/by-name/oem${slot}" /oem || echo "init: oem${slot} mount failed"
+mkdir -p /userdata/warden
+
+# RS485: warden-modbus hardcodes /dev/ttyS4 at compile time; alias it to the
+# VM's pci-serial UART when one is present (needs the virt.fragment kernel).
+[ -c /dev/ttyS0 ] && ln -sf /dev/ttyS0 /dev/ttyS4
+
+# Network: slirp user-mode net on eth0 (DHCP, fallback to QEMU's static map).
+ip link set lo up
+if [ -e /sys/class/net/eth0 ]; then
+    ip link set eth0 up
+    if ! udhcpc -i eth0 -n -q -t 5 -T 2 >/dev/null 2>&1; then
+        ip addr add 10.0.2.15/24 dev eth0 2>/dev/null
+        ip route replace default via 10.0.2.2 dev eth0
+        echo "nameserver 10.0.2.3" > /etc/resolv.conf
+    fi
+fi
+
+hostname warden-qemu
+
+echo "WARDEN-QEMU-ROOTFS-OK slot=${slot}"
+
+# Payload daemons (dropped into /usr/bin by qemu/mkimage.sh from qemu/payload/).
+for d in /usr/bin/warden-flared /usr/bin/warden-modbus; do
+    if [ -x "$d" ]; then
+        name="$(basename "$d")"
+        echo "init: starting $name"
+        "$d" > "/tmp/${name}.log" 2>&1 &
+    fi
+done
+
+if grep -qw warden.shell /proc/cmdline; then
+    echo "warden.shell: interactive shell (exit powers off)"
+    setsid cttyhack sh
+    poweroff -f
+fi
+
+# Hold: daemons run, console idles, scenarios drive the VM from outside.
+while :; do sleep 3600; done

qemu/rootfs/usr/share/udhcpc/default.script

@@ -0,0 +1,18 @@
+#!/bin/busybox sh
+# Minimal udhcpc hook for the VM (busybox looks here by default).
+[ -n "$1" ] || exit 1
+case "$1" in
+    deconfig)
+        ip addr flush dev "$interface"
+        ip link set "$interface" up
+        ;;
+    bound|renew)
+        ip addr replace "$ip/${mask:-24}" dev "$interface"
+        [ -n "${router:-}" ] && ip route replace default via "${router%% *}" dev "$interface"
+        if [ -n "${dns:-}" ]; then
+            : > /etc/resolv.conf
+            for d in $dns; do echo "nameserver $d" >> /etc/resolv.conf; done
+        fi
+        ;;
+esac
+exit 0