[U-Boot] [RFC] Safe Linux Updater

[Wolfgang Denk <wd@denx.de>]

Dear Mats,

In message <ED3E0BCACD909541BA94A34C4A164D4C4FC9145C@post.tritech.se> you wrote:
> 
> I havn't seen the scripts of Alexandre but it sounds something like what
> we have already implemented.

I haven'ty seen the scripts either, but this is something that has
been implemented many times before, with many variations depending on
specific project needs.  But as I mentioned before, most users do not
push such scripts into mainline...

> >   Please note that this is a feature standardized for example in the
> >   Open Source Development Labs Carrier Grade Linux Requirements
> >   Definition, which says something like: "CGL shall provide support
> >   for detecting a repeating reboot cycle due to recurring failures
> >   and will go to an offline state if this occurs."
> 
> As I read Alexandre, the aim is to revert to a previous functional image,

Yes, of course.  And the boot counter is the mechanism that will
decide when to do that.

> not to go to an offline state.

Indeed.  U-Boots boot counter will select an alternative boot command
in this case - you can use this to hard hang or power off the board
and so implement strictly CGL conformant behaviour, or you can do
somthing else like fall back to the previous version.

> >  Normally you want to avoid all erase / write operations to
> >   the boot loader and it's private data structures in the process of
> >   a normal reboot / reset.
> 
> But a failing boot is not a normal boot. This should only occur when an
> update fails. After a maximum number of failing boots, the old functional

Alexandre wrote about a boot counter; he did not mention that he would
update this only on failed boot attempts.

Also, in my experience one should be especially careful when something
fails, and in such a situation I would all the more restrain from
messing with the environment if it can be avoided (and here it's
trivial to avoid).

> image is used and there is no need to update the counter any more.

Did you have a look at the current implementation of the boot counter
for the systems where it is supported?  Yes, we even do have a system
where the boot counter is stored in an environment variable (due to
hardware restrictions and the expectation that the system will
normally not need to be rebooted at all), but normally is can be
easily avoided to meddle with the environment for this functionality.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
A person who is more than casually interested in computers should  be
well  schooled in machine language, since it is a fundamental part of
a computer.                                           -- Donald Knuth