[PATCH 0/4] Add boot slot locking to bootchooser

[PATCH 0/4] Add boot slot locking to bootchooser

[Lars Schmidt]

This patch series adds an option to lock slots to bootchooser.
When slots are locked, the remaining_attempts counter will not
get counted down. It is optional, so when not set, it does not 
have any effect on the counter. The choice of which slot to boot
is also not affected.

Lars Schmidt (4):
  bootchooser: implement locking of boot slots
  bootchooser: extend cmd tool by option to set slot locking
  Documentation: bootchooser: add information about slots_locked
  Documentation: migration-2025.07.0: add information about slots_locked

 Documentation/migration-guides/index.rst      |  1 +
 .../migration-guides/migration-2025.07.0.rst  |  8 +++
 Documentation/user/bootchooser.rst            | 26 +++++++++
 commands/bootchooser.c                        | 16 +++++-
 common/bootchooser.c                          | 55 +++++++++++++++++--
 include/bootchooser.h                         |  1 +
 6 files changed, 101 insertions(+), 6 deletions(-)
 create mode 100644 Documentation/migration-guides/migration-2025.07.0.rst

-- 
2.39.5

[PATCH 1/4] bootchooser: implement locking of boot slots

[Lars Schmidt]

This this new global slot lock inhibits the remaining attempts counter
from decreasing.
There are ways around this, but both come with a disadvantage:
  - If we mark the old slot as bad after a good update, we lose the
    distinction between old slots that are unbootable and ones that
    are bootable. Maintaining this distinction allows a health monitor
    to explicitly boot an old slot while preventing the bootloader
    from doing it automatically
  - If we set the maximum attempts to a very high number, we keep
    writing the storage every boot, even if we don't do
In both cases, by not decreasing and increasing the remaining attempts
counter constantly the number of write cycles is also lowered.

Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
---
 common/bootchooser.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/common/bootchooser.c b/common/bootchooser.c
index 58032a2b57..a50f757791 100644
--- a/common/bootchooser.c
+++ b/common/bootchooser.c
@@ -49,6 +49,7 @@ struct bootchooser {
 	struct state *state;
 	char *state_prefix;
 	int refs;
+	bool slots_locked;
 
 	int verbose;
 	int dryrun;
@@ -353,6 +354,7 @@ struct bootchooser *bootchooser_get(void)
 	int ret = -EINVAL, id = 1;
 	uint32_t last_chosen;
 	static int attempts_resetted;
+	uint32_t locked;
 
 	if (bootchooser) {
 		bootchooser->refs++;
@@ -397,6 +399,18 @@ struct bootchooser *bootchooser_get(void)
 		pr_warn("using non-redundant NV instead of barebox-state\n");
 	}
 
+	ret = getenv_u32(bc->state_prefix, "slots_locked", &locked);
+	if (!ret) {
+		bc->slots_locked = locked ? true : false;
+		if (bc->slots_locked)
+			pr_debug("Global slots locking is enabled\n");
+	} else {
+		/* this is an optional value, so if it doesn't exist,
+		 * we assume it's not locked
+		 */
+		bc->slots_locked = false;
+	}
+
 	INIT_LIST_HEAD(&bc->targets);
 
 	freep = targets = xstrdup(available_targets);
@@ -650,11 +664,14 @@ static struct bootchooser_target *bootchooser_get_target(struct bootchooser *bc)
 	return ERR_PTR(-ENOENT);
 
 found:
-	target->remaining_attempts--;
-
-	if (bc->verbose)
-		pr_info("name=%s decrementing remaining_attempts to %d\n",
-			target->name, target->remaining_attempts);
+	if (!bc->slots_locked) {
+		target->remaining_attempts--;
+		if (bc->verbose)
+			pr_info("name=%s remaining_attempts %d\n", target->name,
+				target->remaining_attempts);
+	} else {
+		pr_info("Slots locking is enabled, not decreasing remaining_attempts\n");
+	}
 
 	if (bc->verbose)
 		pr_info("selected target '%s', boot '%s'\n", target->name, target->boot);
-- 
2.39.5

Re: [PATCH 1/4] bootchooser: implement locking of boot slots

[Ahmad Fatoum]

Hi,

FTR, this is meant to be exercised by RAUC with the PR being here:
https://github.com/rauc/rauc/pull/1732

On 6/13/25 16:08, Lars Schmidt wrote:
> This this new global slot lock inhibits the remaining attempts counter
> from decreasing.

It turns out, the RAUC developers tell me, that slots is a RAUC concept
and indeed there is no mention of slots anywhere in
common/bootchooser.c. Bootchooser instead has targets.

> There are ways around this, but both come with a disadvantage:
>   - If we mark the old slot as bad after a good update, we lose the
>     distinction between old slots that are unbootable and ones that
>     are bootable. Maintaining this distinction allows a health monitor
>     to explicitly boot an old slot while preventing the bootloader
>     from doing it automatically
>   - If we set the maximum attempts to a very high number, we keep
>     writing the storage every boot, even if we don't do
> In both cases, by not decreasing and increasing the remaining attempts
> counter constantly the number of write cycles is also lowered.
> 
> Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
> ---
>  common/bootchooser.c | 27 ++++++++++++++++++++++-----
>  1 file changed, 22 insertions(+), 5 deletions(-)
> 
> diff --git a/common/bootchooser.c b/common/bootchooser.c
> index 58032a2b57..a50f757791 100644
> --- a/common/bootchooser.c
> +++ b/common/bootchooser.c
> @@ -49,6 +49,7 @@ struct bootchooser {
>  	struct state *state;
>  	char *state_prefix;
>  	int refs;
> +	bool slots_locked;

rename to attempts_locked.

>  
>  	int verbose;
>  	int dryrun;
> @@ -353,6 +354,7 @@ struct bootchooser *bootchooser_get(void)
>  	int ret = -EINVAL, id = 1;
>  	uint32_t last_chosen;
>  	static int attempts_resetted;
> +	uint32_t locked;
>  
>  	if (bootchooser) {
>  		bootchooser->refs++;
> @@ -397,6 +399,18 @@ struct bootchooser *bootchooser_get(void)
>  		pr_warn("using non-redundant NV instead of barebox-state\n");
>  	}
>  
> +	ret = getenv_u32(bc->state_prefix, "slots_locked", &locked);

attempts_locked.

> +	if (!ret) {
> +		bc->slots_locked = locked ? true : false;

Needlessly verbose. Just initialize attempts_locked to false and then here:

if (!ret && locked) {
	bc->attempts_locked = true;
        pr_debug(...);
}
> +		if (bc->slots_locked)
> +			pr_debug("Global slots locking is enabled\n");

"boot attempt counting is locked\n" ?

> +	} else {
> +		/* this is an optional value, so if it doesn't exist,
> +		 * we assume it's not locked
> +		 */
> +		bc->slots_locked = false;
> +	}

Can be dropped with above suggested change.

> +
>  	INIT_LIST_HEAD(&bc->targets);
>  
>  	freep = targets = xstrdup(available_targets);
> @@ -650,11 +664,14 @@ static struct bootchooser_target *bootchooser_get_target(struct bootchooser *bc)
>  	return ERR_PTR(-ENOENT);
>  
>  found:
> -	target->remaining_attempts--;
> -
> -	if (bc->verbose)
> -		pr_info("name=%s decrementing remaining_attempts to %d\n",
> -			target->name, target->remaining_attempts);
> +	if (!bc->slots_locked) {

attempts_locked

> +		target->remaining_attempts--;
> +		if (bc->verbose)
> +			pr_info("name=%s remaining_attempts %d\n", target->name,
> +				target->remaining_attempts);
> +	} else {
> +		pr_info("Slots locking is enabled, not decreasing remaining_attempts\n");
> +	}
>  
>  	if (bc->verbose)
>  		pr_info("selected target '%s', boot '%s'\n", target->name, target->boot);

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

[PATCH 2/4] bootchooser: extend cmd tool by option to set slot locking

[Lars Schmidt]

Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
---
 commands/bootchooser.c | 16 +++++++++++++++-
 common/bootchooser.c   | 28 ++++++++++++++++++++++++++++
 include/bootchooser.h  |  1 +
 3 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/commands/bootchooser.c b/commands/bootchooser.c
index 46b063e027..497427eaf0 100644
--- a/commands/bootchooser.c
+++ b/commands/bootchooser.c
@@ -48,8 +48,9 @@ static int do_bootchooser(int argc, char *argv[])
 	int info = 0;
 	bool done_something = false;
 	bool last_boot_successful = false;
+	int lock_state = -1;
 
-	while ((opt = getopt(argc, argv, "a:p:is")) > 0) {
+	while ((opt = getopt(argc, argv, "a:p:islL")) > 0) {
 		switch (opt) {
 		case 'a':
 			if (!strcmp(optarg, "default"))
@@ -69,6 +70,12 @@ static int do_bootchooser(int argc, char *argv[])
 		case 's':
 			last_boot_successful = true;
 			break;
+		case 'l':
+			lock_state = true;
+			break;
+		case 'L':
+			lock_state = false;
+			break;
 		default:
 			return COMMAND_ERROR_USAGE;
 		}
@@ -109,6 +116,11 @@ static int do_bootchooser(int argc, char *argv[])
 		done_something = true;
 	}
 
+	if (lock_state >= 0) {
+		ret = bootchooser_lock_slots(bootchooser, lock_state);
+		done_something = true;
+	}
+
 	if (!done_something) {
 		printf("Nothing to do\n");
 		ret = COMMAND_ERROR_USAGE;
@@ -126,6 +138,8 @@ BAREBOX_CMD_HELP_TEXT("Options:")
 BAREBOX_CMD_HELP_OPT ("-a <n|default> [TARGETS]",  "set remaining attempts of given targets to 'n' or the default attempts")
 BAREBOX_CMD_HELP_OPT ("-p <n|default> [TARGETS]",  "set priority of given targets to 'n' or the default priority")
 BAREBOX_CMD_HELP_OPT ("-i",  "Show information about the bootchooser")
+BAREBOX_CMD_HELP_OPT ("-l",  "Enable global slots lock")
+BAREBOX_CMD_HELP_OPT ("-L",  "Disable global slots lock")
 BAREBOX_CMD_HELP_OPT ("-s",  "Mark the last boot successful")
 BAREBOX_CMD_HELP_END
 
diff --git a/common/bootchooser.c b/common/bootchooser.c
index a50f757791..b25ce3681d 100644
--- a/common/bootchooser.c
+++ b/common/bootchooser.c
@@ -635,6 +635,9 @@ void bootchooser_info(struct bootchooser *bc)
 
 	printf("\nlast booted target: %s\n", bc->last_chosen ?
 	       bc->last_chosen->name : "unknown");
+
+	printf("Locking of boot slots: %s",
+	       bc->slots_locked ? "enabled" : "disabled");
 }
 
 /**
@@ -821,6 +824,31 @@ struct bootchooser_target *bootchooser_get_last_chosen(struct bootchooser *bc)
 	return bc->last_chosen;
 }
 
+/**
+ * bootchooser_locks_slots - sets the state of the slots_locked
+ * @bc:		The bootchooser
+ * @locked: Set slots_locked to true or false
+ *
+ * Bootchooser stores the value if states are locked globally.
+ * This means remaining_attempts will not be counted down, when slots are
+ * locked
+ *
+ * Return: 0 for success, negative error code otherwise
+ */
+int bootchooser_lock_slots(struct bootchooser *bc, bool locked)
+{
+	uint32_t not_needed;
+	/* We just need to check here, if the value exists in the device tree
+	 * So if it doesn't exist, we can inform user about it for easier debugging
+	 */
+	if (getenv_u32(bc->state_prefix, "slots_locked", &not_needed))
+		pr_warn("Could not find value in device tree\n");
+	else
+		bc->slots_locked = locked;
+
+	return 0;
+}
+
 static int bootchooser_boot_one(struct bootchooser *bc, int *tryagain)
 {
 	char *system;
diff --git a/include/bootchooser.h b/include/bootchooser.h
index 31989163b2..d63868abe4 100644
--- a/include/bootchooser.h
+++ b/include/bootchooser.h
@@ -17,6 +17,7 @@ void bootchooser_info(struct bootchooser *bootchooser);
 int bootchooser_boot(struct bootchooser *bc);
 
 struct bootchooser_target *bootchooser_get_last_chosen(struct bootchooser *bootchooser);
+int bootchooser_lock_slots(struct bootchooser *bc, bool locked);
 const char *bootchooser_target_name(struct bootchooser_target *target);
 struct bootchooser_target *bootchooser_target_by_name(struct bootchooser *bootchooser,
 						      const char *name);
-- 
2.39.5

Re: [PATCH 2/4] bootchooser: extend cmd tool by option to set slot locking

[Ahmad Fatoum]

Hi,

On 6/13/25 16:08, Lars Schmidt wrote:

Please write a commit message.

> Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
> ---
>  commands/bootchooser.c | 16 +++++++++++++++-
>  common/bootchooser.c   | 28 ++++++++++++++++++++++++++++
>  include/bootchooser.h  |  1 +
>  3 files changed, 44 insertions(+), 1 deletion(-)
> 
> diff --git a/commands/bootchooser.c b/commands/bootchooser.c
> index 46b063e027..497427eaf0 100644
> --- a/commands/bootchooser.c
> +++ b/commands/bootchooser.c
> @@ -48,8 +48,9 @@ static int do_bootchooser(int argc, char *argv[])
>  	int info = 0;
>  	bool done_something = false;
>  	bool last_boot_successful = false;
> +	int lock_state = -1;
>  
> -	while ((opt = getopt(argc, argv, "a:p:is")) > 0) {
> +	while ((opt = getopt(argc, argv, "a:p:islL")) > 0) {
>  		switch (opt) {
>  		case 'a':
>  			if (!strcmp(optarg, "default"))
> @@ -69,6 +70,12 @@ static int do_bootchooser(int argc, char *argv[])
>  		case 's':
>  			last_boot_successful = true;
>  			break;
> +		case 'l':
> +			lock_state = true;
> +			break;
> +		case 'L':
> +			lock_state = false;
> +			break;
>  		default:
>  			return COMMAND_ERROR_USAGE;
>  		}
> @@ -109,6 +116,11 @@ static int do_bootchooser(int argc, char *argv[])
>  		done_something = true;
>  	}
>  
> +	if (lock_state >= 0) {
> +		ret = bootchooser_lock_slots(bootchooser, lock_state);

s/slots/attempts/

> +		done_something = true;
> +	}
> +
>  	if (!done_something) {
>  		printf("Nothing to do\n");
>  		ret = COMMAND_ERROR_USAGE;
> @@ -126,6 +138,8 @@ BAREBOX_CMD_HELP_TEXT("Options:")
>  BAREBOX_CMD_HELP_OPT ("-a <n|default> [TARGETS]",  "set remaining attempts of given targets to 'n' or the default attempts")
>  BAREBOX_CMD_HELP_OPT ("-p <n|default> [TARGETS]",  "set priority of given targets to 'n' or the default priority")
>  BAREBOX_CMD_HELP_OPT ("-i",  "Show information about the bootchooser")
> +BAREBOX_CMD_HELP_OPT ("-l",  "Enable global slots lock")
> +BAREBOX_CMD_HELP_OPT ("-L",  "Disable global slots lock")

s/slots/attempts/

>  BAREBOX_CMD_HELP_OPT ("-s",  "Mark the last boot successful")
>  BAREBOX_CMD_HELP_END
>  
> diff --git a/common/bootchooser.c b/common/bootchooser.c
> index a50f757791..b25ce3681d 100644
> --- a/common/bootchooser.c
> +++ b/common/bootchooser.c
> @@ -635,6 +635,9 @@ void bootchooser_info(struct bootchooser *bc)
>  
>  	printf("\nlast booted target: %s\n", bc->last_chosen ?
>  	       bc->last_chosen->name : "unknown");
> +
> +	printf("Locking of boot slots: %s",

s/boot slots/boot attempt counter/

> +	       bc->slots_locked ? "enabled" : "disabled");
>  }
>  
>  /**
> @@ -821,6 +824,31 @@ struct bootchooser_target *bootchooser_get_last_chosen(struct bootchooser *bc)
>  	return bc->last_chosen;
>  }
>  
> +/**
> + * bootchooser_locks_slots - sets the state of the slots_locked

bootchooser_lock_attempts - lock bootchooser attempt counter

> + * @bc:		The bootchooser
> + * @locked: Set slots_locked to true or false

whether attempt counter is locked or not

> + *
> + * Bootchooser stores the value if states are locked globally.

Instruct bootchooser to lock the boto attempts counter.

> + * This means remaining_attempts will not be counted down, when slots are
> + * locked
> + *
> + * Return: 0 for success, negative error code otherwise
> + */
> +int bootchooser_lock_slots(struct bootchooser *bc, bool locked)
> +{
> +	uint32_t not_needed;
> +	/* We just need to check here, if the value exists in the device tree
> +	 * So if it doesn't exist, we can inform user about it for easier debugging
> +	 */
> +	if (getenv_u32(bc->state_prefix, "slots_locked", &not_needed))
> +		pr_warn("Could not find value in device tree\n");
> +	else
> +		bc->slots_locked = locked;
> +
> +	return 0;

Return error code, bootchooser -l without support should be an error,
but there is no point in printing that error code here, when we just
chose one ourselves.

Cheers,
Ahmad

> +}
> +
>  static int bootchooser_boot_one(struct bootchooser *bc, int *tryagain)
>  {
>  	char *system;
> diff --git a/include/bootchooser.h b/include/bootchooser.h
> index 31989163b2..d63868abe4 100644
> --- a/include/bootchooser.h
> +++ b/include/bootchooser.h
> @@ -17,6 +17,7 @@ void bootchooser_info(struct bootchooser *bootchooser);
>  int bootchooser_boot(struct bootchooser *bc);
>  
>  struct bootchooser_target *bootchooser_get_last_chosen(struct bootchooser *bootchooser);
> +int bootchooser_lock_slots(struct bootchooser *bc, bool locked);
>  const char *bootchooser_target_name(struct bootchooser_target *target);
>  struct bootchooser_target *bootchooser_target_by_name(struct bootchooser *bootchooser,
>  						      const char *name);

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

[PATCH 3/4] Documentation: bootchooser: add information about slots_locked

[Lars Schmidt]

The new slots_locked variable does have influence on
remaining_attempt counter.

Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
---
 Documentation/user/bootchooser.rst | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/Documentation/user/bootchooser.rst b/Documentation/user/bootchooser.rst
index 351e1d14e1..306443270a 100644
--- a/Documentation/user/bootchooser.rst
+++ b/Documentation/user/bootchooser.rst
@@ -77,6 +77,16 @@ no remaining attempts left.
 To prevent ending up in an unbootable system after a number of failed boot
 attempts, there is also a built-in mechanism to reset the counters to their defaults,
 controlled by the ``global.bootchooser.reset_attempts`` variable.
+Alternatively, counting down the remaining attempts can be disabled by
+locking the bootchooser slots.
+This is done by defining a (32-bit) ``slots_locked`` variable in the
+bootstate and setting its value to ``1`` (usually from userspace).
+
+The variable affects all slots, is optional and its absence is
+interpreted as ``0``, meaning that attempts are decremented normally.
+
+The ``slots_locked`` value does not influence the decision on which slot
+to boot if any, only whether to decrement the attempts when booting.
 
 If ``global.bootchooser.retry`` is enabled (set to ``1``), the bootchooser
 algorithm will iterate through all valid boot targets (and decrease their
@@ -107,6 +117,19 @@ on the :ref:`reset reason <reset_reason>` (i.e. != WDG) using the
 This will reset the ``remaining_attempts`` counter of the *last chosen* slot to
 its default value (``reset_attempts``).
 
+Another option is to use ``slots_locked``.
+Normally this should be controlled from Linux userspace using the *barebox-state* tool, i.e.::
+
+  barebox-state -s  bootstate.slots_locked=1
+
+It can also be locked via the :ref:`bootchooser command <command_bootchooser>`::
+
+  bootchooser -l
+
+or unlocked::
+
+  bootchooser -L
+
 
 .. _dt-utils: https://git.pengutronix.de/cgit/tools/dt-utils
 
-- 
2.39.5

Re: [PATCH 3/4] Documentation: bootchooser: add information about slots_locked

[Ahmad Fatoum]

Hi,

On 6/13/25 16:08, Lars Schmidt wrote:
> The new slots_locked variable does have influence on
> remaining_attempt counter.
> 
> Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
> ---
>  Documentation/user/bootchooser.rst | 23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
> 
> diff --git a/Documentation/user/bootchooser.rst b/Documentation/user/bootchooser.rst
> index 351e1d14e1..306443270a 100644
> --- a/Documentation/user/bootchooser.rst
> +++ b/Documentation/user/bootchooser.rst
> @@ -77,6 +77,16 @@ no remaining attempts left.
>  To prevent ending up in an unbootable system after a number of failed boot
>  attempts, there is also a built-in mechanism to reset the counters to their defaults,
>  controlled by the ``global.bootchooser.reset_attempts`` variable.
> +Alternatively, counting down the remaining attempts can be disabled by
> +locking the bootchooser slots.

bootchooser boot attempts

> +This is done by defining a (32-bit) ``slots_locked`` variable in the

attempts_locked.

> +bootstate and setting its value to ``1`` (usually from userspace).
> +
> +The variable affects all slots, is optional and its absence is

all targets

> +interpreted as ``0``, meaning that attempts are decremented normally.
> +
> +The ``slots_locked`` value does not influence the decision on which slot

attempts_locked

> +to boot if any, only whether to decrement the attempts when booting.
>  
>  If ``global.bootchooser.retry`` is enabled (set to ``1``), the bootchooser
>  algorithm will iterate through all valid boot targets (and decrease their
> @@ -107,6 +117,19 @@ on the :ref:`reset reason <reset_reason>` (i.e. != WDG) using the
>  This will reset the ``remaining_attempts`` counter of the *last chosen* slot to
>  its default value (``reset_attempts``).
>  
> +Another option is to use ``slots_locked``.

attempted_locked

> +Normally this should be controlled from Linux userspace using the *barebox-state* tool, i.e.::
> +
> +  barebox-state -s  bootstate.slots_locked=1

attempts_locked

> +
> +It can also be locked via the :ref:`bootchooser command <command_bootchooser>`::
> +
> +  bootchooser -l
> +
> +or unlocked::
> +
> +  bootchooser -L
> +
>  
>  .. _dt-utils: https://git.pengutronix.de/cgit/tools/dt-utils
>  

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

[PATCH 4/4] Documentation: migration-2025.07.0: add information about slots_locked

[Lars Schmidt]

Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
---
 Documentation/migration-guides/index.rst               | 1 +
 Documentation/migration-guides/migration-2025.07.0.rst | 8 ++++++++
 Documentation/user/bootchooser.rst                     | 3 +++
 3 files changed, 12 insertions(+)
 create mode 100644 Documentation/migration-guides/migration-2025.07.0.rst

diff --git a/Documentation/migration-guides/index.rst b/Documentation/migration-guides/index.rst
index 182654847f..4bba061476 100644
--- a/Documentation/migration-guides/index.rst
+++ b/Documentation/migration-guides/index.rst
@@ -12,3 +12,4 @@ cause build errors are generally out-of-scope for these documents.
 
    migration-2025.05.0
    migration-2025.06.0
+   migration-2025.07.0
\ No newline at end of file
diff --git a/Documentation/migration-guides/migration-2025.07.0.rst b/Documentation/migration-guides/migration-2025.07.0.rst
new file mode 100644
index 0000000000..c18743a633
--- /dev/null
+++ b/Documentation/migration-guides/migration-2025.07.0.rst
@@ -0,0 +1,8 @@
+Release v2025.07.0
+==================
+
+Bootchooser
+-----------
+
+Bootchooser now interprets a top-level ``slots_locked`` variable.
+For more information, see :ref:`slot locking feature <bootchooser,slots_lock>`
diff --git a/Documentation/user/bootchooser.rst b/Documentation/user/bootchooser.rst
index 306443270a..f767dc77e8 100644
--- a/Documentation/user/bootchooser.rst
+++ b/Documentation/user/bootchooser.rst
@@ -77,6 +77,9 @@ no remaining attempts left.
 To prevent ending up in an unbootable system after a number of failed boot
 attempts, there is also a built-in mechanism to reset the counters to their defaults,
 controlled by the ``global.bootchooser.reset_attempts`` variable.
+
+.. _bootchooser,slots_lock:
+
 Alternatively, counting down the remaining attempts can be disabled by
 locking the bootchooser slots.
 This is done by defining a (32-bit) ``slots_locked`` variable in the
-- 
2.39.5

Re: [PATCH 4/4] Documentation: migration-2025.07.0: add information about slots_locked

[Ahmad Fatoum]

Hi,

On 6/13/25 16:08, Lars Schmidt wrote:

commit message please

> Signed-off-by: Lars Schmidt <l.schmidt@pengutronix.de>
> ---
>  Documentation/migration-guides/index.rst               | 1 +
>  Documentation/migration-guides/migration-2025.07.0.rst | 8 ++++++++
>  Documentation/user/bootchooser.rst                     | 3 +++

s/slots/attempts/g below

>  3 files changed, 12 insertions(+)
>  create mode 100644 Documentation/migration-guides/migration-2025.07.0.rst
> 
> diff --git a/Documentation/migration-guides/index.rst b/Documentation/migration-guides/index.rst
> index 182654847f..4bba061476 100644
> --- a/Documentation/migration-guides/index.rst
> +++ b/Documentation/migration-guides/index.rst
> @@ -12,3 +12,4 @@ cause build errors are generally out-of-scope for these documents.
>  
>     migration-2025.05.0
>     migration-2025.06.0
> +   migration-2025.07.0
> \ No newline at end of file
> diff --git a/Documentation/migration-guides/migration-2025.07.0.rst b/Documentation/migration-guides/migration-2025.07.0.rst
> new file mode 100644
> index 0000000000..c18743a633
> --- /dev/null
> +++ b/Documentation/migration-guides/migration-2025.07.0.rst
> @@ -0,0 +1,8 @@
> +Release v2025.07.0
> +==================
> +
> +Bootchooser
> +-----------
> +
> +Bootchooser now interprets a top-level ``slots_locked`` variable.
> +For more information, see :ref:`slot locking feature <bootchooser,slots_lock>`
> diff --git a/Documentation/user/bootchooser.rst b/Documentation/user/bootchooser.rst
> index 306443270a..f767dc77e8 100644
> --- a/Documentation/user/bootchooser.rst
> +++ b/Documentation/user/bootchooser.rst
> @@ -77,6 +77,9 @@ no remaining attempts left.
>  To prevent ending up in an unbootable system after a number of failed boot
>  attempts, there is also a built-in mechanism to reset the counters to their defaults,
>  controlled by the ``global.bootchooser.reset_attempts`` variable.
> +
> +.. _bootchooser,slots_lock:
> +
>  Alternatively, counting down the remaining attempts can be disabled by
>  locking the bootchooser slots.
>  This is done by defining a (32-bit) ``slots_locked`` variable in the

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |