OCPBUGS-54594: update bootloader on aarch64 systems

The aarch64 kernel changed the file format [1] [2] and older
RHEL8 based systems (4.12 and 4.11) need to update the bootloader
otherwise the system won't boot when they get upgraded to 4.19
based on RHEL 9.6.

Let's add a systemd unit here that will update the bootloader.
Also need to add code that will handle the RAID case because
bootupd doesn't currently handle that case.

It's worth mentioning that we did hit this upstream in Fedora
CoreOS as well [3] and we took this fix from that [4] and another
similar issue [5] as inspiration here.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2162369
[2] https://issues.redhat.com/browse/RHEL-25537
[3] coreos/fedora-coreos-tracker#1441
[4] coreos/fedora-coreos-config#2308
[5] coreos/fedora-coreos-config#3042

Fixes: https://issues.redhat.com/browse/OCPBUGS-54594

Author: dustymabe

overlay.d/05rhcos/usr/lib/systemd/system-preset/43-manifest-rhcos.preset

@@ -22,3 +22,8 @@ enable nmstate.service
 # This unit is not activated on OSTree systems, but it still pulls in
 # `network-online.target`. Explicitly disable it.
 disable dnf-makecache.timer
+
+# Enable the unit to update the bootloader on aarch64
+# machines so they can boot 9.6+ kernels.
+# https://issues.redhat.com/browse/OCPBUGS-54594
+enable coreos-bootupctl-update-aarch64.service

overlay.d/05rhcos/usr/lib/systemd/system/coreos-bootupctl-update-aarch64.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Update Bootloader for aarch64 systems
+Documentation=https://issues.redhat.com/browse/OCPBUGS-54594
+ConditionArchitecture=arm64
+ConditionFirmware=uefi
+ConditionPathExists=!/var/lib/coreos-update-bootloader-aarch64-OCPBUGS-54594.stamp
+
+[Service]
+Type=oneshot
+# Only run once regardless of success or failure so we touch
+# our stamp file here.
+ExecStartPre=touch /var/lib/coreos-update-bootloader-aarch64-OCPBUGS-54594.stamp
+ExecStart=/usr/libexec/coreos-update-bootloader
+RemainAfterExit=yes
+MountFlags=slave
+
+[Install]
+WantedBy=multi-user.target

overlay.d/05rhcos/usr/libexec/coreos-update-bootloader

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -euo pipefail
+
+# https://issues.redhat.com/browse/OCPBUGS-54594
+
+# This script updates the bootloader using bootupd
+# and also detects RAID-1 setups as those requires
+# extra steps.
+if [ -e /dev/disk/by-label/EFI-SYSTEM ]; then
+    echo "Found ESP; calling 'bootupctl update'"
+    bootupctl update
+    exit
+fi
+
+# Handle RAID case manually since bootupd doesn't support it.
+# https://github.com/coreos/bootupd/issues/132
+#
+# First we'll find the RAID device the root filesystem is
+# mounted from (i.e. /dev/md127).
+root_raid_device=$(findmnt --json --target /sysroot \
+                     | jq -r .filesystems[0].source)
+echo "Detected root raid device is: $root_raid_device"
+# Next we'll find all the devices that are a part of that
+# RAID array that have an ESP (i.e. a vfat formatted partition
+# with a label that starts with "esp-", like "esp-1", "esp-2").
+# and we'll capture the device name for the partition.
+esp_partitions=$(
+    lsblk --paths --fs -J | \
+        jq --arg raid_device "${root_raid_device}" -r '
+            .blockdevices[]
+            | select(.children[]?.children[]?.name == $raid_device)
+            | .children[]
+            | select(
+                (.fstype == "vfat") and
+                (.label != null)    and
+                (.label | startswith("esp"))
+              )
+            | .name')
+for part in $esp_partitions; do
+    echo "Found ESP replica in ${part}; updating"
+    mount $part /boot/efi
+    echo "[Before Update: ${part}]"
+    find /boot/efi/ -type f | xargs md5sum
+    cp -rp /usr/lib/bootupd/updates/EFI /boot/efi
+    echo "[After Update: ${part}]"
+    find /boot/efi/ -type f | xargs md5sum
+    umount /boot/efi
+done
+sync