qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

tests/mk-bootimg/run-boot-img-validate-tests.sh

@@ -0,0 +1,124 @@
+#!/bin/bash
+# Regression tests for the post-build boot.img validation in
+# build/mk-bootimg.sh: the FIT metadata %512 check, the per-image
+# data-position %512 check (and fdtget's own failure path, issue #22 --
+# a missing or erroring fdtget used to be swallowed and treated as nothing
+# to check), and the >=4096 embedded-data-FIT check.
+#
+# Runs the real script end to end with stub mkimage/resource_tool/fdtget so
+# the arithmetic is exercised as it actually ships, not copied out and
+# re-tested in isolation. The stub mkimage answers the -B capability probe
+# and, for the real build invocation, writes a synthetic boot.img whose
+# 4-byte big-endian metadata-size word and total length are test-controlled --
+# the same field mk-bootimg.sh reads with `od -An -tu4 -j4 -N4 --endian=big`.
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SCRIPT="$HERE/../../build/mk-bootimg.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+STUBS="$TMP/stubs"
+mkdir -p "$STUBS"
+
+cat > "$STUBS/mkimage" <<'EOF'
+#!/bin/bash
+if [ "$#" -eq 0 ]; then
+    echo "Usage: mkimage [-T type] -l image" >&2
+    echo "   -B => align size in hex for FIT structure and header" >&2
+    exit 1
+fi
+out=""
+for a in "$@"; do out="$a"; done
+python3 -c '
+import sys
+out, meta, total = sys.argv[1], int(sys.argv[2]), int(sys.argv[3])
+total = max(total, 8)
+data = bytearray(total)
+data[4:8] = (meta & 0xffffffff).to_bytes(4, "big")
+open(out, "wb").write(bytes(data))
+' "$out" "${MKBI_META:-512}" "${MKBI_TOTAL:-8192}"
+EOF
+chmod +x "$STUBS/mkimage"
+
+cat > "$STUBS/resource_tool" <<'EOF'
+#!/bin/bash
+img=""
+for a in "$@"; do
+    case "$a" in --image=*) img="${a#--image=}" ;; esac
+done
+echo stub > "$img"
+EOF
+chmod +x "$STUBS/resource_tool"
+
+cat > "$STUBS/fdtget" <<'EOF'
+#!/bin/bash
+# Invoked as: fdtget -t u FILE /images/NAME data-position
+node="$4"
+name="${node#/images/}"
+var="FDTGET_$(printf '%s' "$name" | tr '[:lower:]' '[:upper:]')_POS"
+val="${!var-}"
+if [ -z "$val" ] || [ "$val" = "FAIL" ]; then
+    echo "fdtget: FDT_ERR_NOTFOUND, $node data-position" >&2
+    exit 1
+fi
+echo "$val"
+EOF
+chmod +x "$STUBS/fdtget"
+
+KERNEL="$TMP/zImage"; DTB="$TMP/rv1106-warden.dtb"
+head -c 4096 /dev/urandom > "$KERNEL"
+head -c 512 /dev/urandom > "$DTB"
+
+fails=0
+run_case() {  # run_case <name> <want_rc:ok|fail> <want_grep>
+    local name="$1" want_rc="$2" want_grep="$3" out rc
+    out="$(PATH="$STUBS:$PATH" "$SCRIPT" --kernel "$KERNEL" --dtb "$DTB" \
+        --resource-tool "$STUBS/resource_tool" --out "$TMP/boot.img" 2>&1)"
+    rc=$?
+    if [ "$want_rc" = ok ] && [ "$rc" -ne 0 ]; then
+        echo "FAIL: $name (expected success, got rc=$rc: $out)"; fails=$((fails + 1)); return
+    fi
+    if [ "$want_rc" = fail ] && [ "$rc" -eq 0 ]; then
+        echo "FAIL: $name (expected failure, script exited 0: $out)"; fails=$((fails + 1)); return
+    fi
+    if ! printf '%s' "$out" | grep -qF -- "$want_grep"; then
+        echo "FAIL: $name (output missing '$want_grep'): $out"; fails=$((fails + 1)); return
+    fi
+    echo "PASS: $name"
+}
+
+# A well-formed image: metadata 512-aligned and small, every data-position
+# 512-aligned. The baseline every failure case below is a single change from.
+MKBI_META=512 MKBI_TOTAL=8192 \
+FDTGET_FDT_POS=512 FDTGET_KERNEL_POS=1024 FDTGET_RESOURCE_POS=1536 \
+    run_case "well-formed image accepted" ok "FIT metadata 512 bytes"
+
+# Metadata size itself not a multiple of 512 (the exact value measured from
+# the SDK's vendored mkimage 2017.09, see the comment above the probe).
+MKBI_META=1064 MKBI_TOTAL=8192 \
+FDTGET_FDT_POS=512 FDTGET_KERNEL_POS=1024 FDTGET_RESOURCE_POS=1536 \
+    run_case "unaligned metadata size rejected" fail "not a multiple of 512"
+
+# One sub-image's data-position not a multiple of 512; the FATAL must name it.
+MKBI_META=512 MKBI_TOTAL=8192 \
+FDTGET_FDT_POS=512 FDTGET_KERNEL_POS=148 FDTGET_RESOURCE_POS=1536 \
+    run_case "unaligned data-position rejected" fail "/images/kernel data-position 148 is not 512-aligned"
+
+# fdtget itself fails (not on PATH, or the FIT it just built is malformed).
+# Regression for issue #22: this used to be swallowed by `|| true` and
+# treated as "nothing to check" instead of a build failure.
+MKBI_META=512 MKBI_TOTAL=8192 \
+FDTGET_FDT_POS=512 FDTGET_KERNEL_POS=FAIL FDTGET_RESOURCE_POS=1536 \
+    run_case "fdtget failure fails the build, not skips the check" fail \
+    "fdtget could not read /images/kernel data-position"
+
+# Metadata swelled to >=4096 bytes: an embedded-data FIT, which this U-Boot
+# rejects outright. 4096 is itself a multiple of 512 so this must be caught
+# by the second check, not mistaken for the first.
+MKBI_META=4096 MKBI_TOTAL=8192 \
+FDTGET_FDT_POS=512 FDTGET_KERNEL_POS=1024 FDTGET_RESOURCE_POS=1536 \
+    run_case "embedded-data FIT rejected" fail "embedded-data FIT"
+
+[ "$fails" -eq 0 ] && echo "All mk-bootimg boot.img validation tests passed." || echo "$fails test(s) failed."
+exit "$fails"