BFE EngineeringandClaude Fable 5
c7e06514ad
Phase 3 of the device sim, all verified on QEMU 10.0.11: - qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures degrade to real-slave silence), line-protocol control socket for register seeding and fault injection (drop/exception/clear), bounds-checked so a scenario typo answers err instead of panicking the bus. 7 unit tests, bench in the sim_bench pattern. Verified end-to-end: guest master frame on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct. - virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the full PCI set probes (16550A ttyS0, i6300esb). - Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb resets the VM ~30s later (first environment where this arm is testable). - qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside the VM against flare-edge's mock portal on the host — authenticated check-in, firmware desired-state pull, and download of a real signed tier-1 .wfw offer, asserted from the portal log. Found and filed flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on non-RV1106 memory maps); runs against a flared built from the qemu-vm-support fix branch. - stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM deviations), firmware-version stamp, newline-terminated state seeds. - CI: rs485-bridge joins the test loop and bench job; new qemu-tools job (shellcheck + initramfs + disk image on hosted runners); kernel-build gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
29 lines
1.1 KiB
Bash
Executable File
29 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build the QEMU device-sim initramfs: the pinned static busybox + qemu/rootfs/.
|
|
# The busybox binary is the ONLY external input (sha256-pinned, fail-closed —
|
|
# see qemu/lib.sh).
|
|
#
|
|
# Env:
|
|
# BUSYBOX path to a local busybox binary (skips the download; still verified)
|
|
# OUT output dir (default: qemu/out); initramfs at $OUT/initramfs.cpio.gz
|
|
set -euo pipefail
|
|
|
|
QEMU_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=qemu/lib.sh disable=SC1091
|
|
. "$QEMU_DIR/lib.sh"
|
|
OUT="${OUT:-$QEMU_DIR/out}"
|
|
|
|
qemu_get_busybox
|
|
|
|
# Assemble in a scratch dir, removed on exit (scratch-dir leaks were a past
|
|
# review finding in this repo).
|
|
SCRATCH="$(mktemp -d "${TMPDIR:-/tmp}/warden-qemu-initramfs.XXXXXX")"
|
|
trap 'rm -rf "$SCRATCH"' EXIT
|
|
qemu_stage_rootfs "$SCRATCH/root"
|
|
|
|
# Pack (newc cpio, gzip). No device nodes required: /init mounts devtmpfs and
|
|
# reopens the console itself, so the archive builds unprivileged.
|
|
( cd "$SCRATCH/root" && find . -print0 | cpio -0 -o -H newc -R +0:+0 2>/dev/null ) \
|
|
| gzip -9 > "$OUT/initramfs.cpio.gz"
|
|
qemu_log "initramfs: $OUT/initramfs.cpio.gz ($(du -h "$OUT/initramfs.cpio.gz" | cut -f1))"
|