Files

T

BFE EngineeringandClaude Fable 5 b667ff5b1e license: GPL-2.0-only repo-wide

Replaces the dual MIT/Apache-2.0 licensing (and its GPL carve-out) with a
single GPL-2.0-only license for the whole repository: coherent with the
kernel patch series it exists to carry, the embedded-Linux norm, and the
stack's openness principle — anyone shipping products on this SDK publishes
their changes. GPL-2.0 (not 3) deliberately: the Installation-Information
clause of GPLv3 sits badly with WardenOS's signed A/B firmware chain.
LICENSE is now the canonical GPLv2 text; crate manifests updated;
inbound = outbound noted in the README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

2026-08-30 07:44:32 -06:00

src

review: iteration-2 fixes (fail-closed loader whole-name match + doc accuracy)

2026-08-25 16:02:22 -06:00

Cargo.lock

ci: commit Cargo.lock files for reproducible --locked builds

2026-08-25 13:53:11 -06:00

Cargo.toml

license: GPL-2.0-only repo-wide

2026-08-30 07:44:32 -06:00

README.md

tools: config-lint — MCU-load-vs-reserved-memory gate (0x40000 brick class)

2026-08-24 17:56:33 -06:00

README.md

config-lint — static target-config gates

Catches flash-time config faults the behavioural sim cannot: mistakes in the memory map, not the logic. The first check is the one that would have caught the c8a3 brick — a boot-loaded coprocessor firmware dropped at 0x40000, which is a reserved-memory carve-out on Thunder-Boot boards but plain kernel RAM on ours, so the MCU and the kernel fought over the same DRAM and the board hung before eth0.

The check

Every address the idblock loader drops MCU firmware to must sit inside a reserved-memory node in the target devicetree.

MCU loads come from the rkbin loader .ini: each LOADERn=Hpmcu (any hpmcu/mcu/amp entry) in [LOADER_OPTION], with its LOAD_ADDR from [LOADERn_PARAM].
Reserved ranges come from the devicetree: every reg = <addr size> inside a reserved-memory { … } node.

A load outside all reservations is a failure (non-zero exit).

Use

cargo run -p warden-config-lint -- --ini <loader.ini> --dt <devicetree.dts>

In CI, feed the flattened devicetree so includes and overlays are resolved:

dtc -I dtb -O dts build/.../rv1106g-warden.dtb > /tmp/warden.dts
config-lint --ini .../RKBOOT/RV1106MINIALL*.ini --dt /tmp/warden.dts

Exit 0 = every MCU load is reserved (or there are none); 1 = a collision was found; 2 = usage/IO error.

Test

cargo test -p warden-config-lint

The suite encodes the brick as a regression: the real Thunder-Boot .ini (Hpmcu @ 0x40000) fails against a DT with no rtos@40000 node and passes once the reservation is added — and our board's non-TB loader (no boot-loaded MCU) always passes. See ../../docs/architecture.md §5 and, for the hardware hazard, the boot-loaded-mcu-0x40000-hazard note.