BFE EngineeringandClaude Fable 5
bf3c93cf85
The third simulator (deliberately not named "sim"): a QEMU -M virt VM that boots the real 6.18.46 kernel and enters at -kernel zImage — everything below (BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM and is explicitly out of scope. - qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/ - qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical 12-partition blkdevparts A/B layout (vda == mmcblk0 mapping) - qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents, whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem mounts, slirp networking, payload daemon start) - qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display - qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in build/build-kernel.sh (canonical RV1106 build untouched when unset): adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input - qemu/tests/boot-smoke.sh: sentinel-asserting boot test Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full stack boots both slots; 12 by-name symlinks; userdata persists across reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
48 lines
2.1 KiB
Markdown
48 lines
2.1 KiB
Markdown
# qemu/ — the WardenOS device simulator
|
|
|
|
A QEMU virtual machine that boots the real forward-ported kernel (`build/` +
|
|
`patches/`) and real userspace, so the *device* — init, daemons, networking,
|
|
OTA, watchdog — can be tested off-hardware. The third simulator in the stack,
|
|
deliberately not named "sim":
|
|
|
|
- `lvglsim` (flare-edge) — SDL desktop build of the UI. Rendering only.
|
|
- `sim/` (this repo) — register-level Rust models of RV1106 blocks behind
|
|
driver seams.
|
|
- `qemu/` (this) — the whole machine above the kernel entry point.
|
|
|
|
## The boundary (read this before trusting a green run)
|
|
|
|
There is no RV1106 machine model in QEMU and everything below the kernel is
|
|
closed rkbin blobs plus mask ROM, so the VM **enters at `-kernel zImage`** on
|
|
`-M virt` (generic ARMv7 machine, virtio peripherals). That means:
|
|
|
|
- **Not emulated, not tested here:** BootROM, idblock/DDR-init, SPL, U-Boot,
|
|
the real BCB-driven A/B slot selection, bootcount auto-revert. The untested
|
|
A/B rollback chain stays untested by this tool.
|
|
- **Substituted, not modeled:** display (virtio-gpu, not VOP), input
|
|
(virtio-tablet, not GT911), network (virtio-net, not GMAC), storage
|
|
(virtio-blk, not eMMC). NPU/RGA/HPMCU behavior stays `sim/` territory.
|
|
- "Boots under emulation" is **not** "works on silicon". On-device claims
|
|
still need on-device evidence; the VM narrows which claims need a panel.
|
|
|
|
## Quick start
|
|
|
|
```sh
|
|
# 1. build the QEMU kernel variant (canonical RV1106 build + virt fragment)
|
|
WORK=$HOME/kbuild-out CROSS_COMPILE=arm-linux-gnueabihf- \
|
|
WARDEN_KCONFIG_FRAGMENT=qemu/configs/virt.fragment bash build/build-kernel.sh
|
|
|
|
# 2. build the initramfs (sha256-pinned static busybox + qemu/rootfs/)
|
|
bash qemu/mkinitramfs.sh
|
|
|
|
# 3. smoke it
|
|
bash qemu/tests/boot-smoke.sh $HOME/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
|
|
```
|
|
|
|
Host requirements: `qemu-system-arm` (Debian 13 ships QEMU 10), `curl`, `cpio`,
|
|
`gcc-arm-linux-gnueabihf` for the kernel build.
|
|
|
|
Status: bringup — boot smoke only. Disk/network harness, RS485 bridge to
|
|
`sim/`, portal scenarios, and display/touch land in later phases (see
|
|
`docs/decisions/0006-qemu-device-sim.md` once written).
|