This series fixes some issues in the RAUC bootmeth and adds two options to make it safer to use on real devices, together with tests.
Patches 1-4 fix bugs in bootmeth_rauc.c: an uninitialised pointer when a bootflow has no block device, a leak of the active slot name, a stack buffer overflow with long slot names in BOOT_ORDER, and a leak of the boot script when a boot attempt fails and is retried. Patch 5 makes the RAUC test restore the bootdev order also if it fails. Before, a failing check left a static array in std->bootdev_order, which was then passed to free() and aborted sandbox. Patch 6 adds a test that boots the same RAUC bootflow twice. Patch 7 makes the bootmeth set its BOOT_ORDER and BOOT_x_LEFT variables only for a device with a RAUC system, instead of for every MMC device it scans. Patches 8 and 9 make the bootmeth safer to use on real devices, without changing anything for existing users: - CONFIG_BOOTMETH_RAUC_PARTITIONS can give the partitions by their GPT names instead of their numbers. The bootmeth then only claims a device which has the partitions of all slots. With numbers, it claims any MMC device whose partitions happen to fit the configured layout, such as a standard distro installed to eMMC, and writes its variables to the environment. This allows to use BOOTMETH_RAUC safely alongside other bootmeths. - The new option CONFIG_BOOTMETH_RAUC_BOOTCMD, empty by default, sets a command built into U-Boot that boots the slot instead of running boot.scr from the boot partition. Nothing authenticates that partition, and signing the script is not a reliable fix, as the environment must stay writable for the RAUC variables and setting verify=no there skips all checks. With this option, U-Boot executes nothing from the boot partition. The bootmeth keeps both options in its platform data, which is set from Kconfig when it is bound. The tests in patches 11 and 12 change them at runtime, so sandbox_defconfig keeps the default configuration and all tests run on it. As partition names need GPT, patch 10 adds GPT support to DiskHelper in fs_helper.py for a second RAUC test image. --- Changes in v2: - Patches 1, 5 and 10: Add Reviewed-by tag from Simon. - Patch 2: Look up the slot in find_active_slot() and return it instead of a strdup() copy of its name (Simon). This also catches an unknown slot in BOOT_ORDER before its BOOT_x_LEFT counter is decremented. - Patch 3: Print an error for a too long slot name in CONFIG_BOOTMETH_RAUC_BOOT_ORDER, document the 32-character limit and pass on the return value of boot_left_name() (Simon). Rebase on the changes in patch 2. - Patch 4: Reset the bootflow state before loading the script again and move freeing the image list into bootflow_free_images() in bootflow.c, used by bootflow_free() as well (Simon). - New patch 6: Test booting the same bootflow twice (Simon). - New patch 7: Set BOOT_ORDER and BOOT_x_LEFT only for a device with a RAUC system (Simon). - Patch 8: Give the partition names in CONFIG_BOOTMETH_RAUC_PARTITIONS instead of the new option CONFIG_BOOTMETH_RAUC_PART_NAMES (Bastien), and only use a device which has the partitions of all slots (Simon). Renamed from "Optionally check the partition names". - Patches 8 and 9: Keep the options in the platform data of the bootmeth, set from Kconfig when it is bound, so that tests can change them at runtime. The boot script code is now always built (Simon). - Patches 11 and 12: Set the options in the tests instead of sandbox_defconfig, so that the default configuration is still tested, and drop the #ifdefs. Keep the RAUC test image (mmc10) on MBR with a boot script and use a second GPT image (mmc13) for partition names. Also check matching names, a slot with missing partitions, that MBR is rejected and that no variables are set for an unused device (Simon). Patch 11 is renamed from "Test the RAUC partition name check". - Link to v1: https://patch.msgid.link/[email protected] --- Frieder Schrempf (12): bootstd: rauc: Initialise desc in distro_rauc_scan_parts() bootstd: rauc: Fix leak of the active slot name bootstd: rauc: Fix overflow of the BOOT_x_LEFT name buffer bootstd: rauc: Free the boot script of a failed boot attempt test: boot: Restore the bootdev order if the RAUC test fails test: boot: Test booting a RAUC bootflow twice bootstd: rauc: Only set the RAUC variables for a RAUC device bootstd: rauc: Optionally find the partitions by name bootstd: rauc: Optionally boot with a built-in command test: fs_helper: Support GPT in DiskHelper test: boot: Test finding the RAUC partitions by name test: boot: Test the RAUC built-in boot command MAINTAINERS | 1 + arch/sandbox/dts/test.dts | 8 ++ boot/Kconfig | 24 ++++ boot/bootflow.c | 13 +- boot/bootmeth_rauc.c | 284 ++++++++++++++++++++++++++++++---------- configs/sandbox_defconfig | 1 + doc/develop/bootstd/rauc.rst | 15 +++ include/bootflow.h | 10 ++ include/bootmeth_rauc.h | 25 ++++ test/boot/bootflow.c | 301 +++++++++++++++++++++++++++++++++++++++++-- test/py/tests/fs_helper.py | 36 ++++-- test/py/tests/test_ut.py | 30 +++-- 12 files changed, 644 insertions(+), 104 deletions(-) --- base-commit: ee9fc27f2a2a43f253a6fe18d7a6f7c4eb0cda3b change-id: 20261029-main-c3a89be613d5 Best regards, -- Frieder Schrempf <[email protected]>
