BFE EngineeringandClaude Fable 5
bf3c93cf85
The third simulator (deliberately not named "sim"): a QEMU -M virt VM that boots the real 6.18.46 kernel and enters at -kernel zImage — everything below (BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM and is explicitly out of scope. - qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/ - qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical 12-partition blkdevparts A/B layout (vda == mmcblk0 mapping) - qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents, whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem mounts, slirp networking, payload daemon start) - qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display - qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in build/build-kernel.sh (canonical RV1106 build untouched when unset): adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input - qemu/tests/boot-smoke.sh: sentinel-asserting boot test Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full stack boots both slots; 12 by-name symlinks; userdata persists across reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
25 lines
849 B
Markdown
25 lines
849 B
Markdown
# qemu/payload/ — guest binaries (never committed)
|
|
|
|
Drop **static musl armv7** binaries here; `qemu/mkimage.sh` copies everything
|
|
in this directory (except this README) into `/usr/bin/` of both rootfs slots.
|
|
Static musl is the same target the device uses for its Rust daemons, so the
|
|
exact production binaries run unmodified in the VM.
|
|
|
|
Typical payload, built in a flare-edge checkout:
|
|
|
|
```sh
|
|
# flared (static musl armv7)
|
|
tools/build-flared.sh --local
|
|
# warden-modbus and friends: see tools/build-firmware.sh for the recipes
|
|
```
|
|
|
|
Then:
|
|
|
|
```sh
|
|
cp <flare-edge>/target/armv7-unknown-linux-musleabihf/release/warden-flared qemu/payload/
|
|
```
|
|
|
|
Stage-2 init starts `warden-flared` and `warden-modbus` automatically when
|
|
present (logs land in `/tmp/<name>.log` inside the guest). An empty payload is
|
|
valid — the image boots to a busybox-only userspace.
|