On 31.10.26 15:06, Simon Glass wrote: > Hi Frieder, > > On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: >> bootstd: rauc: Optionally check the partition names >> >> The RAUC bootmeth uses any MMC device on which the boot partition of a >> slot holds a filesystem and the root partition exists. This also matches >> devices with a different layout, for example a single-system image or a >> standard distro installed to eMMC. The bootmeth then claims such a >> device and creates and saves its BOOT_ORDER and BOOT_x_LEFT variables in >> the environment, which makes it difficult to run BOOTMETH_RAUC alongside >> other bootmeths. > > One thing I'd like to check here. distro_rauc_read_bootflow() still > calls env_set() for BOOT_ORDER and each BOOT_x_LEFT before any > partition is looked at, so these variables still appear in the > environment for every MMC device scanned, including those that fail > the name check. This patch stops the RAUC bootmeth saving them, but if > another bootmeth (or something else) later runs saveenv, they end up > in the saved environment anyway. If the aim is to leave other devices > alone, please can you move the defaulting of these variables to after > the scan succeeds? scan_parts() would then need to use > CONFIG_BOOTMETH_RAUC_BOOT_ORDER when BOOT_ORDER is not set.
Right, I will try to add a patch that moves changing the env to the point where we know the device is valid. > >> >> Add CONFIG_BOOTMETH_RAUC_PART_NAMES to set the expected names of the >> boot and root partitions of each slot, in the same format as >> CONFIG_BOOTMETH_RAUC_PARTITIONS. If set, a slot only counts if its >> partitions carry these names. As only GPT provides partition names, >> this also rejects MBR devices. The option is empty by default, which >> keeps the current behaviour. >> >> Assisted-by: LLM >> Signed-off-by: Frieder Schrempf <[email protected]> >> >> boot/Kconfig | 13 +++++++++ >> boot/bootmeth_rauc.c | 68 >> ++++++++++++++++++++++++++++++++++++++++---- >> doc/develop/bootstd/rauc.rst | 7 +++++ >> 3 files changed, 82 insertions(+), 6 deletions(-) > >> diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c >> @@ -138,6 +161,11 @@ static int distro_rauc_scan_parts(struct bootflow >> *bflow) >> ret = part_get_info(desc, slot->root_part, &fs_info); >> if (ret) >> continue; >> + if (!distro_rauc_part_name_ok(desc, slot->boot_part, >> + slot->boot_part_name) || >> + !distro_rauc_part_name_ok(desc, slot->root_part, >> + slot->root_part_name)) >> + continue; >> slot_found = true; > > Only one slot has to match for the device to be claimed, and > distro_rauc_boot() then picks the active slot from BOOT_ORDER without > checking whether that slot passed. So if slot A matches and slot B's > partitions have other names, the bootmeth still boots slot B when it > is active. Since this option is meant to make the bootmeth safer, I > suspect it should either require every slot to match, or record which > slots passed and have find_active_slot() skip the others. What do you > think? Yes, I agree. The existing matching based on partition indices only requires a single valid slot and this behavior needs to stay for compatibility reasons. But for the named partitions I think I will make it require both slots to match. Recording the slot state and then skip the invalid ones later seems a bit too complex. > > Also, part_get_info() has just filled 'fs_info' for the root > partition, so you can compare fs_info.name directly instead of reading > the partition a second time. Ok.
