Hi Frieder, On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: > bootstd: rauc: Optionally check the partition names > > The RAUC bootmeth uses any MMC device on which the boot partition of a > slot holds a filesystem and the root partition exists. This also matches > devices with a different layout, for example a single-system image or a > standard distro installed to eMMC. The bootmeth then claims such a > device and creates and saves its BOOT_ORDER and BOOT_x_LEFT variables in > the environment, which makes it difficult to run BOOTMETH_RAUC alongside > other bootmeths.
One thing I'd like to check here. distro_rauc_read_bootflow() still calls env_set() for BOOT_ORDER and each BOOT_x_LEFT before any partition is looked at, so these variables still appear in the environment for every MMC device scanned, including those that fail the name check. This patch stops the RAUC bootmeth saving them, but if another bootmeth (or something else) later runs saveenv, they end up in the saved environment anyway. If the aim is to leave other devices alone, please can you move the defaulting of these variables to after the scan succeeds? scan_parts() would then need to use CONFIG_BOOTMETH_RAUC_BOOT_ORDER when BOOT_ORDER is not set. > > Add CONFIG_BOOTMETH_RAUC_PART_NAMES to set the expected names of the > boot and root partitions of each slot, in the same format as > CONFIG_BOOTMETH_RAUC_PARTITIONS. If set, a slot only counts if its > partitions carry these names. As only GPT provides partition names, > this also rejects MBR devices. The option is empty by default, which > keeps the current behaviour. > > Assisted-by: LLM > Signed-off-by: Frieder Schrempf <[email protected]> > > boot/Kconfig | 13 +++++++++ > boot/bootmeth_rauc.c | 68 > ++++++++++++++++++++++++++++++++++++++++---- > doc/develop/bootstd/rauc.rst | 7 +++++ > 3 files changed, 82 insertions(+), 6 deletions(-) > diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c > @@ -138,6 +161,11 @@ static int distro_rauc_scan_parts(struct bootflow *bflow) > ret = part_get_info(desc, slot->root_part, &fs_info); > if (ret) > continue; > + if (!distro_rauc_part_name_ok(desc, slot->boot_part, > + slot->boot_part_name) || > + !distro_rauc_part_name_ok(desc, slot->root_part, > + slot->root_part_name)) > + continue; > slot_found = true; Only one slot has to match for the device to be claimed, and distro_rauc_boot() then picks the active slot from BOOT_ORDER without checking whether that slot passed. So if slot A matches and slot B's partitions have other names, the bootmeth still boots slot B when it is active. Since this option is meant to make the bootmeth safer, I suspect it should either require every slot to match, or record which slots passed and have find_active_slot() skip the others. What do you think? Also, part_get_info() has just filled 'fs_info' for the root partition, so you can compare fs_info.name directly instead of reading the partition a second time. Regards, Simon
