feat: preserve normal radio profiles across event firmware (#11110)

* feat: isolate event radio profiles * fix: preserve identity on degraded config boot * fix: guard event profile storage * style: align event profile storage names * fix: discard event profile on normal boot * refactor: simplify event profile cleanup * fix: limit inactive profile migration to event firmware * fix(event): make event-profile capacity check portable across filesystems The USERPREFS_EVENT_MODE storage preflight called FSCom.totalBytes() and FSCom.usedBytes(), which only exist on ESP32's LittleFS wrapper. Every other backend failed to compile once event mode was enabled: error: 'class InternalFileSystem' has no member named 'totalBytes' (nRF52) error: no member named 'totalBytes' in 'fs::FS' (Portduino) This was not caught earlier because the event block is behind #if USERPREFS_EVENT_MODE, and the existing unit tests only cover the pure helpers, which compile identically either way. Add fsTotalBytes()/fsUsedBytes() to FSCommon and implement them per backend: littlefs v1 traversal for nRF52 (Adafruit_LittleFS) and STM32 (STM32_LittleFS), FSInfo for RP2040, statvfs for Portduino, and the native methods for ESP32 and nRF54L15. The nRF52/STM32 path reports "full" if the traversal errors so the capacity check fails safe. Verified with USERPREFS_EVENT_MODE=1: native-macos test_event_profile_storage passes 5/5, and heltec-v3, rak4631, rak11310 and rak3172 all build clean. * fix(event): use std::filesystem for Portduino capacity, bump native-suite-count Two CI fixes: - native-windows has no <sys/statvfs.h>, so the Portduino branch of fsTotalBytes()/fsUsedBytes() broke the Windows build. Switch to std::filesystem::space(), which is already used under ARCH_PORTDUINO in HostMetrics.cpp and works on both POSIX and MinGW. Errors report "full" so the capacity check still fails safe. - This PR adds test/test_event_profile_storage, taking test/ from 40 to 41 suite directories, which trips the native-suite-count reconciliation check. * fix(event): scope boot-write deferral to the radio profile, address review Review feedback: - Copilot: saveProto()'s boot-write deferral applied to every file, so loadFromDisk()'s recovery writes (e.g. restoring owner fields into devicestate) were silently dropped and never retried, because the ctor CRC baselines are computed after loadFromDisk(). Deferral now applies only to the radio-profile files, via isRadioProfileFile(). - jp-bennett: eventConfigFromStandard() wrapped a struct copy plus one field assignment in a header helper with its own unit test. Inlined at its single call site and removed; the behaviour is covered end-to-end by hardware validation instead (RAK4631 normal -> event -> normal preserves NodeNum and public key while swapping LoRa, and restores the original channel byte-identically). - jp-bennett: the active-backup encrypted-storage migration ran for normal builds too, which changed non-event behaviour and contradicted the PR's stated event-only scope. Scoped to USERPREFS_EVENT_MODE; the adjacent block already covers the inactive standard backup in event builds. New tests (all verified to fail under mutation, not vacuous): - test_event_paths_never_collide_with_standard_or_shared_files: the core safety property. A path-table slip would make event firmware overwrite the user's real config, channels or backup, or capture a shared file like devicestate/nodedb. Nothing asserted this before. - test_only_radio_profile_files_defer_boot_writes: guards the deferral fix above so re-widening it fails loudly. - test_event_reservation_fits_smallest_supported_filesystem: the reservation is compile-time but must fit filesystems as small as 14 KiB (STM32WL) and 28 KiB (nRF52840). Protobuf growth pushing it past those would silently stop event profiles persisting - the exact failure mode confirmed by fault injection on a RAK4631. Verified with USERPREFS_EVENT_MODE both on and off: 7/7 tests pass, and rak4631, heltec-v3, rak11310 and rak3172 all build clean. * fix: preserve event profile storage recovery --------- Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz> Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: Benjamin Faershtein <benjaminfaershtein@Benjamins-MacBook-Pro-2.local>
2026-07-26 22:58:23 +00:00
parent 5c5cb094e6
commit 45cb8e7500
6 changed files with 401 additions and 7 deletions
@@ -1 +1 @@
-40
+41
@@ -0,0 +1,124 @@
+#include "MeshTypes.h" // Include BEFORE TestUtil.h
+#include "TestUtil.h"
+#include "mesh/NodeDB.h"
+#include <unity.h>
+
+void test_standard_profile_uses_standard_files()
+{
+    const auto paths = radioProfileStoragePaths(false);
+
+    TEST_ASSERT_EQUAL_STRING("/prefs/config.proto", paths.config);
+    TEST_ASSERT_EQUAL_STRING("/prefs/channels.proto", paths.channels);
+    TEST_ASSERT_EQUAL_STRING("/backups/backup.proto", paths.backup);
+}
+
+void test_event_profile_uses_isolated_files()
+{
+    const auto paths = radioProfileStoragePaths(true);
+
+    TEST_ASSERT_EQUAL_STRING("/prefs/event-config.proto", paths.config);
+    TEST_ASSERT_EQUAL_STRING("/prefs/event-channels.proto", paths.channels);
+    TEST_ASSERT_EQUAL_STRING("/backups/event-backup.proto", paths.backup);
+}
+
+void test_boot_defers_persistence_until_config_is_verified()
+{
+    TEST_ASSERT_TRUE(shouldDeferBootPersistence(true, false, false));
+    TEST_ASSERT_TRUE(shouldDeferBootPersistence(true, true, true));
+    TEST_ASSERT_FALSE(shouldDeferBootPersistence(true, true, false));
+    TEST_ASSERT_FALSE(shouldDeferBootPersistence(false, true, true));
+}
+
+void test_event_profile_requires_room_for_atomic_profile_writes()
+{
+    TEST_ASSERT_TRUE(hasEventProfileStorageSpace(EVENT_PROFILE_STORAGE_RESERVATION_BYTES, 0));
+    TEST_ASSERT_FALSE(hasEventProfileStorageSpace(EVENT_PROFILE_STORAGE_RESERVATION_BYTES - 1, 0));
+    TEST_ASSERT_FALSE(hasEventProfileStorageSpace(EVENT_PROFILE_STORAGE_RESERVATION_BYTES, 1));
+    TEST_ASSERT_FALSE(hasEventProfileStorageSpace(1, 2));
+    // A full filesystem must never look like it has room.
+    TEST_ASSERT_FALSE(
+        hasEventProfileStorageSpace(EVENT_PROFILE_STORAGE_RESERVATION_BYTES, EVENT_PROFILE_STORAGE_RESERVATION_BYTES));
+}
+
+// The whole point of the feature is that an event build never touches the user's real radio profile
+// or the shared files. A copy/paste slip in the path table would silently overwrite them, which no
+// amount of runtime testing would catch on a device that had never held a normal profile.
+void test_event_paths_never_collide_with_standard_or_shared_files()
+{
+    const auto standard = radioProfileStoragePaths(false);
+    const auto event = radioProfileStoragePaths(true);
+
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.config, standard.config));
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.channels, standard.channels));
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.backup, standard.backup));
+
+    // The three event paths must also be distinct from each other.
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.config, event.channels));
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.config, event.backup));
+    TEST_ASSERT_NOT_EQUAL(0, strcmp(event.channels, event.backup));
+
+    // Files shared by both profiles must never be captured by either profile's paths.
+    const char *sharedFiles[] = {deviceStateFileName, nodeDatabaseFileName, moduleConfigFileName, uiconfigFileName,
+                                 legacyPrefFileName};
+    for (const char *shared : sharedFiles) {
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(event.config, shared));
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(event.channels, shared));
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(event.backup, shared));
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(standard.config, shared));
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(standard.channels, shared));
+        TEST_ASSERT_NOT_EQUAL(0, strcmp(standard.backup, shared));
+    }
+}
+
+// Boot-write deferral must cover the radio profile and nothing else: widening it silently drops
+// boot-time recovery writes (devicestate/nodedb) that are never retried.
+void test_only_radio_profile_files_defer_boot_writes()
+{
+    TEST_ASSERT_TRUE(isRadioProfileFile(configFileName));
+    TEST_ASSERT_TRUE(isRadioProfileFile(channelFileName));
+    TEST_ASSERT_TRUE(isRadioProfileFile(backupFileName));
+
+    TEST_ASSERT_FALSE(isRadioProfileFile(deviceStateFileName));
+    TEST_ASSERT_FALSE(isRadioProfileFile(nodeDatabaseFileName));
+    TEST_ASSERT_FALSE(isRadioProfileFile(moduleConfigFileName));
+    TEST_ASSERT_FALSE(isRadioProfileFile(uiconfigFileName));
+}
+
+// The reservation is compile-time, but the filesystems it has to fit in are tiny: nRF52840
+// InternalFS is 28 KiB and the STM32WL family is 14 KiB. If protobuf growth pushes the reservation
+// past what those can spare, event builds silently stop persisting their profile.
+void test_event_reservation_fits_smallest_supported_filesystem()
+{
+    constexpr size_t STM32WL_FILESYSTEM_BYTES = 14 * 1024;
+    constexpr size_t NRF52840_FILESYSTEM_BYTES = 28 * 1024;
+
+    TEST_ASSERT_EQUAL_UINT32(2 * (meshtastic_LocalConfig_size + meshtastic_ChannelFile_size),
+                             EVENT_PROFILE_STORAGE_RESERVATION_BYTES);
+
+    // Leave at least half of the smallest filesystem for everything else under /prefs.
+    TEST_ASSERT_LESS_THAN_UINT32(STM32WL_FILESYSTEM_BYTES / 2, EVENT_PROFILE_STORAGE_RESERVATION_BYTES);
+    TEST_ASSERT_TRUE(hasEventProfileStorageSpace(NRF52840_FILESYSTEM_BYTES, 0));
+    TEST_ASSERT_TRUE(hasEventProfileStorageSpace(STM32WL_FILESYSTEM_BYTES, 0));
+}
+
+void setUp(void) {}
+
+void tearDown(void) {}
+
+extern "C" {
+void setup()
+{
+    initializeTestEnvironment();
+    UNITY_BEGIN();
+    RUN_TEST(test_standard_profile_uses_standard_files);
+    RUN_TEST(test_event_profile_uses_isolated_files);
+    RUN_TEST(test_boot_defers_persistence_until_config_is_verified);
+    RUN_TEST(test_event_profile_requires_room_for_atomic_profile_writes);
+    RUN_TEST(test_event_paths_never_collide_with_standard_or_shared_files);
+    RUN_TEST(test_only_radio_profile_files_defer_boot_writes);
+    RUN_TEST(test_event_reservation_fits_smallest_supported_filesystem);
+    exit(UNITY_END());
+}
+
+void loop() {}
+}