BFE EngineeringandClaude Fable 5
bf3c93cf85
The third simulator (deliberately not named "sim"): a QEMU -M virt VM that boots the real 6.18.46 kernel and enters at -kernel zImage — everything below (BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM and is explicitly out of scope. - qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/ - qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical 12-partition blkdevparts A/B layout (vda == mmcblk0 mapping) - qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents, whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem mounts, slirp networking, payload daemon start) - qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display - qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in build/build-kernel.sh (canonical RV1106 build untouched when unset): adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input - qemu/tests/boot-smoke.sh: sentinel-asserting boot test Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full stack boots both slots; 12 by-name symlinks; userdata persists across reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
qemu/ — the WardenOS device simulator
A QEMU virtual machine that boots the real forward-ported kernel (build/ +
patches/) and real userspace, so the device — init, daemons, networking,
OTA, watchdog — can be tested off-hardware. The third simulator in the stack,
deliberately not named "sim":
lvglsim(flare-edge) — SDL desktop build of the UI. Rendering only.sim/(this repo) — register-level Rust models of RV1106 blocks behind driver seams.qemu/(this) — the whole machine above the kernel entry point.
The boundary (read this before trusting a green run)
There is no RV1106 machine model in QEMU and everything below the kernel is
closed rkbin blobs plus mask ROM, so the VM enters at -kernel zImage on
-M virt (generic ARMv7 machine, virtio peripherals). That means:
- Not emulated, not tested here: BootROM, idblock/DDR-init, SPL, U-Boot, the real BCB-driven A/B slot selection, bootcount auto-revert. The untested A/B rollback chain stays untested by this tool.
- Substituted, not modeled: display (virtio-gpu, not VOP), input
(virtio-tablet, not GT911), network (virtio-net, not GMAC), storage
(virtio-blk, not eMMC). NPU/RGA/HPMCU behavior stays
sim/territory. - "Boots under emulation" is not "works on silicon". On-device claims still need on-device evidence; the VM narrows which claims need a panel.
Quick start
# 1. build the QEMU kernel variant (canonical RV1106 build + virt fragment)
WORK=$HOME/kbuild-out CROSS_COMPILE=arm-linux-gnueabihf- \
WARDEN_KCONFIG_FRAGMENT=qemu/configs/virt.fragment bash build/build-kernel.sh
# 2. build the initramfs (sha256-pinned static busybox + qemu/rootfs/)
bash qemu/mkinitramfs.sh
# 3. smoke it
bash qemu/tests/boot-smoke.sh $HOME/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
Host requirements: qemu-system-arm (Debian 13 ships QEMU 10), curl, cpio,
gcc-arm-linux-gnueabihf for the kernel build.
Status: bringup — boot smoke only. Disk/network harness, RS485 bridge to
sim/, portal scenarios, and display/touch land in later phases (see
docs/decisions/0006-qemu-device-sim.md once written).