BFE EngineeringandClaude Fable 5
c7e06514ad
Phase 3 of the device sim, all verified on QEMU 10.0.11: - qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures degrade to real-slave silence), line-protocol control socket for register seeding and fault injection (drop/exception/clear), bounds-checked so a scenario typo answers err instead of panicking the bus. 7 unit tests, bench in the sim_bench pattern. Verified end-to-end: guest master frame on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct. - virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the full PCI set probes (16550A ttyS0, i6300esb). - Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb resets the VM ~30s later (first environment where this arm is testable). - qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside the VM against flare-edge's mock portal on the host — authenticated check-in, firmware desired-state pull, and download of a real signed tier-1 .wfw offer, asserted from the portal log. Found and filed flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on non-RV1106 memory maps); runs against a flared built from the qemu-vm-support fix branch. - stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM deviations), firmware-version stamp, newline-terminated state seeds. - CI: rs485-bridge joins the test loop and bench job; new qemu-tools job (shellcheck + initramfs + disk image on hosted runners); kernel-build gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
115 lines
5.2 KiB
Bash
Executable File
115 lines
5.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# End-to-end device scenario: the REAL warden-flared, running inside the VM,
|
|
# checks in to flare-edge's mock FLARE portal on the host and pulls its
|
|
# firmware desired-state — the exact device-initiated HTTPS(-shaped) flow a
|
|
# panel performs, with zero flare-edge code changes (the portal URL is a state
|
|
# file; 10.0.2.2 is slirp's host alias).
|
|
#
|
|
# FAILS CLOSED on every missing prerequisite — never a soft skip.
|
|
#
|
|
# Usage: portal-scenario.sh <zImage-virt>
|
|
# Env: FLARE_EDGE path to a flare-edge checkout (provides mock-flare-portal.py)
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # qemu/tests/
|
|
QDIR="$(cd "$HERE/.." && pwd)" # qemu/
|
|
|
|
ZIMAGE="${1:-}"
|
|
if [ -z "$ZIMAGE" ] || [ ! -f "$ZIMAGE" ]; then
|
|
echo "FATAL: usage: $0 <zImage> — the virt.fragment kernel variant" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "${FLARE_EDGE:-}" ] || [ ! -f "$FLARE_EDGE/tools/mock-flare-portal.py" ]; then
|
|
echo "FATAL: FLARE_EDGE must point at a flare-edge checkout (mock-flare-portal.py not found under '${FLARE_EDGE:-}')" >&2
|
|
exit 1
|
|
fi
|
|
[ -x "$QDIR/payload/warden-flared" ] || {
|
|
echo "FATAL: no qemu/payload/warden-flared — build a static musl armv7 flared (see qemu/payload/README.md)" >&2
|
|
exit 1
|
|
}
|
|
command -v qemu-system-arm >/dev/null || {
|
|
echo "FATAL: qemu-system-arm not on PATH — see qemu/README.md" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Short-named scratch: AF_UNIX socket paths are capped at ~108 chars.
|
|
WORK="$(mktemp -d /tmp/wqp.XXXXXX)"
|
|
QEMU_PID="" MOCK_PID=""
|
|
cleanup() {
|
|
if [ -n "$QEMU_PID" ]; then kill "$QEMU_PID" 2>/dev/null || true; fi
|
|
if [ -n "$MOCK_PID" ]; then kill "$MOCK_PID" 2>/dev/null || true; fi
|
|
rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
DEVICE_ID="$(python3 -c 'import uuid; print(uuid.uuid4())')"
|
|
API_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(24))')"
|
|
PORT=$((20000 + RANDOM % 20000))
|
|
|
|
# 0. a real signed tier-1 .wfw offer (version above the image's 0.0.1), so the
|
|
# scenario exercises desired-state -> download -> signature/hash verify, not
|
|
# just an empty 204. Signed with the committed desk key; the payload flared
|
|
# is a FLARED_DEV_KEY=1 build that trusts it (desk-testing only).
|
|
head -c 8388608 /dev/urandom > "$WORK/rootfs-payload.img"
|
|
FW_SIGNING_KEY_FILE="$FLARE_EDGE/tools/testdata/fw-dev-key.seed" \
|
|
WARDEN_KERNEL_VERSION=6.18.46 WARDEN_BUILDROOT_VERSION=2025.02 \
|
|
WARDEN_UBOOT_VERSION=2017.09 \
|
|
bash "$FLARE_EDGE/tools/mk-wfw.sh" "$WORK/rootfs-payload.img" 1 0.0.2 "$WORK/offer.wfw"
|
|
|
|
# 1. mock portal on the host, our device pre-registered (no pairing needed —
|
|
# the same credential-seeding shortcut fw-e2e-test.sh uses), offering the .wfw.
|
|
python3 "$FLARE_EDGE/tools/mock-flare-portal.py" \
|
|
--port "$PORT" --device "$DEVICE_ID:$API_KEY" \
|
|
--wfw "$WORK/offer.wfw" > "$WORK/mock.log" 2>&1 &
|
|
MOCK_PID=$!
|
|
for _ in $(seq 1 50); do
|
|
curl -so /dev/null "http://127.0.0.1:$PORT/" && break
|
|
kill -0 "$MOCK_PID" 2>/dev/null || { echo "FATAL: mock portal died:" >&2; cat "$WORK/mock.log" >&2; exit 1; }
|
|
sleep 0.2
|
|
done
|
|
echo "== mock portal on :$PORT, device $DEVICE_ID"
|
|
|
|
# 2. image seeded with the portal URL + credentials.
|
|
bash "$QDIR/mkinitramfs.sh"
|
|
# All four enrolment keys — flare::enrolment() returns None (and the report
|
|
# loop parks forever) unless flare.site is present too.
|
|
bash "$QDIR/mkimage.sh" \
|
|
--portal-url "http://10.0.2.2:$PORT" \
|
|
--state "flare.device_id=$DEVICE_ID" \
|
|
--state "flare.api_key=$API_KEY" \
|
|
--state "flare.site=qemu-devsim"
|
|
|
|
# 3. boot the VM headless (daemons run; console log to file).
|
|
bash "$QDIR/run.sh" --kernel "$ZIMAGE" \
|
|
--ssh-port $((PORT + 1)) --http-port $((PORT + 2)) --api-port $((PORT + 3)) \
|
|
> "$WORK/console.log" 2>&1 &
|
|
QEMU_PID=$!
|
|
|
|
# 4. assert: rootfs up, and the portal saw — from OUR device id — an
|
|
# authenticated check-in, the firmware desired-state pull, and the signed
|
|
# .wfw asset download (i.e. flared accepted the offer and fetched it; the
|
|
# verify+stage+APPLYING that follow are a dry run without
|
|
# WARDEN_FW_ALLOW_APPLY, exactly like fw-e2e-test.sh).
|
|
deadline=$((SECONDS + 420))
|
|
ok_boot=0 ok_report=0 ok_fw=0 ok_asset=0
|
|
while [ $SECONDS -lt $deadline ]; do
|
|
[ $ok_boot -eq 0 ] && grep -aq 'WARDEN-QEMU-ROOTFS-OK' "$WORK/console.log" && {
|
|
ok_boot=1; echo "== VM userspace up"; }
|
|
grep -aq "POST /api/v1/devices/$DEVICE_ID/report -> 200" "$WORK/mock.log" && ok_report=1
|
|
grep -aq "GET /api/v1/devices/$DEVICE_ID/firmware -> 200" "$WORK/mock.log" && ok_fw=1
|
|
grep -aq "GET /api/v1/devices/$DEVICE_ID/firmware/assets/.* -> 200" "$WORK/mock.log" && ok_asset=1
|
|
[ $ok_report -eq 1 ] && [ $ok_fw -eq 1 ] && [ $ok_asset -eq 1 ] && break
|
|
kill -0 "$QEMU_PID" 2>/dev/null || { echo "FATAL: VM exited early" >&2; tail -30 "$WORK/console.log" >&2; exit 1; }
|
|
sleep 2
|
|
done
|
|
|
|
echo "== portal log (our device's requests):"
|
|
grep -a "$DEVICE_ID" "$WORK/mock.log" | tail -5 || true
|
|
|
|
fail=0
|
|
[ $ok_boot -eq 1 ] || { echo "FAIL: VM never reached WARDEN-QEMU-ROOTFS-OK"; fail=1; }
|
|
[ $ok_report -eq 1 ] || { echo "FAIL: no authenticated check-in (POST report 200) seen"; fail=1; }
|
|
[ $ok_fw -eq 1 ] || { echo "FAIL: no firmware desired-state pull (GET firmware 200) seen"; fail=1; }
|
|
[ $ok_asset -eq 1 ] || { echo "FAIL: signed .wfw asset was never downloaded"; fail=1; }
|
|
if [ $fail -eq 0 ]; then echo "PORTAL-SCENARIO-PASS"; else echo "PORTAL-SCENARIO-FAIL"; exit 1; fi
|