[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Makito SHIOKAWA]

Boot Image Fallback is a mechanism that enables a system to fallback to a
"known good" boot image in the event of catastrophic boot failure (i.e.
failure to boot, panic on boot, failure to initialize HW/SW). (CGL
Availability Requirements Definition V4.0: AVL.9.0). On system especially used
in telecommunication, 99.999% high availability is required. So, this function
is highly needed (like my customer requires).

This time, I'm thinking of implementing Boot Image Fallback on U-Boot as
follows (like a way GRUB does). So, I would appreciate any comments to this.


It uses new U-Boot command "bootmf" and fw_setenv.

* bootmf

It is a wrapper of "bootm", and it boots kernel with fallback enabled on
multiple kernel images.


Also, it uses new U-Boot environment variables as follows.

* imgaddr<N>

It holds physical address of flash partition that kernel image is written. <N>
is integer and becomes an entry of corresponding kernel image.

(ex.) imgaddr0=0xf8000000, imgaddr1=0xf8200000

* bootargs<N>

It holds kernel parameter of entry <N>.

(ex.) bootargs0=root=/dev/mtdblock1 , bootargs1=root=/dev/mtdblock3

* default

It holds default entry that "bootmf" tries to boot on default.

(ex.) default=1

* fallback

It holds list of fallback entry that "bootmf" tries to boot on next if it
fails to boot default entry.

(ex.) fallback=1 2


Now, I assume that circumstances are as follows. (In my case, Linux on
Freescale MPC8540.)

* There are three flash partitions "kernel-0", "kernel-1", "kernel-2" that
kernel images are written.

* Environment variables are set as follows.

bootcmd=bootmf
imgaddr0=0xf8000000 (physical address of "kernel-0")
imgaddr1=0xf8200000 (physical address of "kernel-1")
imgaddr2=0xf8400000 (physical address of "kernel-2")
bootargs0=root=/dev/mtdblock1 (rootfs of "kernel-0")
bootargs1=root=/dev/mtdblock3 (rootfs of "kernel-1")
bootargs2=root=/dev/mtdblock5 (rootfs of "kernel-2")
default=0
fallback=1 2

* "fw_setenv default 0" is written to /etc/rc.local.


Then it behaves as follows.

1. When U-Boot boots up, "bootmf" is executed and tries to boot default entry
in "default". Before booting kernel, "bootmf" sets corresponding fallback
entry in "fallback" to "default". ((ex.) When booting entry "0", "1" is set
and when booting entry "1", "2" is set.)

2. If kernel succeeds to boot, "default" is set to "0" by fw_setenv. So, next
time U-Boot boots up and "bootmf" is executed, entry "0" will be booted again.

3. If kernel fails to boot, "default" stays to fallback entry "1" because
fw_setenv won't be executed. So, next time U-Boot boots and "bootmf" is
executed, fallback entry "1" will be booted.


By this way, Boot Image Fallback on U-Boot can be realized. I recognize that
this needs to rewrite flash each time booting a kernel, but I think there
won't be so many reboots once stable system operation have started.

I'll write and send a prototype of "bootmf" if it is needed.


Best regards,

-- 
MIRACLE LINUX CORPORATION
Makito SHIOKAWA

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Matthias Fuchs]

Hi, 

take a look at Wolfgang's last posting from Tuesday on the 'intended behavior 
of bootm'. The bootlimit/altbootcmd function (in your case probably together 
with a hardware watchdog) could be the stuff you are (and I was) looking for.

Matthias

On Thursday 24 April 2008 04:53:48 Makito SHIOKAWA wrote:
> Boot Image Fallback is a mechanism that enables a system to fallback to a
> "known good" boot image in the event of catastrophic boot failure (i.e.
> failure to boot, panic on boot, failure to initialize HW/SW). (CGL
> Availability Requirements Definition V4.0: AVL.9.0). On system especially
> used in telecommunication, 99.999% high availability is required. So, this
> function is highly needed (like my customer requires).
>
> This time, I'm thinking of implementing Boot Image Fallback on U-Boot as
> follows (like a way GRUB does). So, I would appreciate any comments to
> this.
>
>
> It uses new U-Boot command "bootmf" and fw_setenv.
>
> * bootmf
>
> It is a wrapper of "bootm", and it boots kernel with fallback enabled on
> multiple kernel images.
>
>
> Also, it uses new U-Boot environment variables as follows.
>
> * imgaddr<N>
>
> It holds physical address of flash partition that kernel image is written.
> <N> is integer and becomes an entry of corresponding kernel image.
>
> (ex.) imgaddr0=0xf8000000, imgaddr1=0xf8200000
>
> * bootargs<N>
>
> It holds kernel parameter of entry <N>.
>
> (ex.) bootargs0=root=/dev/mtdblock1 , bootargs1=root=/dev/mtdblock3
>
> * default
>
> It holds default entry that "bootmf" tries to boot on default.
>
> (ex.) default=1
>
> * fallback
>
> It holds list of fallback entry that "bootmf" tries to boot on next if it
> fails to boot default entry.
>
> (ex.) fallback=1 2
>
>
> Now, I assume that circumstances are as follows. (In my case, Linux on
> Freescale MPC8540.)
>
> * There are three flash partitions "kernel-0", "kernel-1", "kernel-2" that
> kernel images are written.
>
> * Environment variables are set as follows.
>
> bootcmd=bootmf
> imgaddr0=0xf8000000 (physical address of "kernel-0")
> imgaddr1=0xf8200000 (physical address of "kernel-1")
> imgaddr2=0xf8400000 (physical address of "kernel-2")
> bootargs0=root=/dev/mtdblock1 (rootfs of "kernel-0")
> bootargs1=root=/dev/mtdblock3 (rootfs of "kernel-1")
> bootargs2=root=/dev/mtdblock5 (rootfs of "kernel-2")
> default=0
> fallback=1 2
>
> * "fw_setenv default 0" is written to /etc/rc.local.
>
>
> Then it behaves as follows.
>
> 1. When U-Boot boots up, "bootmf" is executed and tries to boot default
> entry in "default". Before booting kernel, "bootmf" sets corresponding
> fallback entry in "fallback" to "default". ((ex.) When booting entry "0",
> "1" is set and when booting entry "1", "2" is set.)
>
> 2. If kernel succeeds to boot, "default" is set to "0" by fw_setenv. So,
> next time U-Boot boots up and "bootmf" is executed, entry "0" will be
> booted again.
>
> 3. If kernel fails to boot, "default" stays to fallback entry "1" because
> fw_setenv won't be executed. So, next time U-Boot boots and "bootmf" is
> executed, fallback entry "1" will be booted.
>
>
> By this way, Boot Image Fallback on U-Boot can be realized. I recognize
> that this needs to rewrite flash each time booting a kernel, but I think
> there won't be so many reboots once stable system operation have started.
>
> I'll write and send a prototype of "bootmf" if it is needed.
>
>
> Best regards,
-- 
-------------------------------------------------------------------------
Dipl.-Ing. Matthias Fuchs
Head of System Design

esd electronic system design gmbh
Vahrenwalder Str. 207 - 30165 Hannover - GERMANY
Phone: +49-511-37298-0 - Fax: +49-511-37298-68
Please visit our homepage http://www.esd.eu
Quality Products - Made in Germany
-------------------------------------------------------------------------
Gesch?ftsf?hrer: Klaus Detering, Dr. Werner Schulze
Amtsgericht Hannover HRB 51373 - VAT-ID DE 115672832
-------------------------------------------------------------------------

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Bartlomiej Sieka]

Makito SHIOKAWA wrote:
> Boot Image Fallback is a mechanism that enables a system to fallback to a
> "known good" boot image in the event of catastrophic boot failure (i.e.
> failure to boot, panic on boot, failure to initialize HW/SW). (CGL
> Availability Requirements Definition V4.0: AVL.9.0). On system especially used
> in telecommunication, 99.999% high availability is required. So, this function
> is highly needed (like my customer requires).
> 
> This time, I'm thinking of implementing Boot Image Fallback on U-Boot as
> follows (like a way GRUB does). So, I would appreciate any comments to this.
> 
> 
> It uses new U-Boot command "bootmf" and fw_setenv.
> 
> * bootmf
> 
> It is a wrapper of "bootm", and it boots kernel with fallback enabled on
> multiple kernel images.

Hello,

You might want to have a look an the new image format introduced
recently. It allows you to have multiple kernels (and ramdisks, and
other types of images) in one image file, and access these components in
elegant way. Have a look in doc/uImage.FIT/. In particular,
doc/uImage.FIT/command_syntax_extensions.txt describes new syntax that
you might find useful.

> 
> 
> Also, it uses new U-Boot environment variables as follows.
> 
> * imgaddr<N>
> 
> It holds physical address of flash partition that kernel image is written. <N>
> is integer and becomes an entry of corresponding kernel image.
> 
> (ex.) imgaddr0=0xf8000000, imgaddr1=0xf8200000

This is where you may want to consider the new syntax mentioned above.

> 
> * bootargs<N>
> 
> It holds kernel parameter of entry <N>.

And here too.

> 
> (ex.) bootargs0=root=/dev/mtdblock1 , bootargs1=root=/dev/mtdblock3
> 
> * default
> 
> It holds default entry that "bootmf" tries to boot on default.

Please check the "default booting configuration" feature of the new
image format, seems like it might be what you're looking for.

Regards,
Barlomiej

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Makito SHIOKAWA]

Hi,

Thank you for your reply.

 > take a look at Wolfgang's last posting from Tuesday on the 'intended behavior
 > of bootm'. The bootlimit/altbootcmd function (in your case probably together
 > with a hardware watchdog) could be the stuff you are (and I was) looking for.

This corresponds to CGL Availability Requirements Definition V4.0: AVL.9.1, 
whereas Boot Image Fallback is AVL.9.0.
(http://developer.osdl.org/dev/cgl/cgl40/cgl40-availability.pdf)
Boot Image Fallback must handle not only image CRC error before kernel boot, 
but a boot failure like kernel panic during kernel boot process (after image 
has successfully loaded). Also, it must fallback after power-on reset.

-- 
MIRACLE LINUX CORPORATION
Makito SHIOKAWA

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Makito SHIOKAWA]

Hi,

Thank you for your reply.

 > You might want to have a look an the new image format introduced
 > recently. It allows you to have multiple kernels (and ramdisks, and
 > other types of images) in one image file, and access these components in
 > elegant way. Have a look in doc/uImage.FIT/. In particular,
 > doc/uImage.FIT/command_syntax_extensions.txt describes new syntax that
 > you might find useful.

I'll check it if this can be a substitution.

-- 
MIRACLE LINUX CORPORATION
Makito SHIOKAWA

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Makito SHIOKAWA]

> You might want to have a look an the new image format introduced
> recently. It allows you to have multiple kernels (and ramdisks, and
> other types of images) in one image file, and access these components in
> elegant way. Have a look in doc/uImage.FIT/. In particular,
> doc/uImage.FIT/command_syntax_extensions.txt describes new syntax that
> you might find useful.

I've read it but I'm afraid it's bit different from Boot Image Fallback.

Boot Image Fallback decides image to boot according to a order of images to 
boot and depending on previous boot has succeeded or not. So, this kind of 
mechanism is still needed.

 >> * default
 >>
 >> It holds default entry that "bootmf" tries to boot on default.
 >
 > Please check the "default booting configuration" feature of the new
 > image format, seems like it might be what you're looking for.

Also, on Boot Image Fallback, "default" changes dynamically but "default 
booting configuration" is embedded in ".its" and it's static.


Anyway thank you. By the way, is it able to define "bootargs" for each image 
entry on ".its"?


Regards,

-- 
/********************************
  * MIRACLE LINUX CORPORATION    *
  * Makito SHIOKAWA              *
  * <mshiokawa@miraclelinux.com> *
  ********************************/

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Wolfgang Denk]

In message <481059E9.5090302@miraclelinux.com> you wrote:
> 
>  > of bootm'. The bootlimit/altbootcmd function (in your case probably together
>  > with a hardware watchdog) could be the stuff you are (and I was) looking for.
> 
> This corresponds to CGL Availability Requirements Definition V4.0: AVL.9.1, 
> whereas Boot Image Fallback is AVL.9.0.
> (http://developer.osdl.org/dev/cgl/cgl40/cgl40-availability.pdf)
> Boot Image Fallback must handle not only image CRC error before kernel boot, 
> but a boot failure like kernel panic during kernel boot process (after image 
> has successfully loaded). Also, it must fallback after power-on reset.

Actually it implements the features needed to handle all of this.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
Every revolutionary idea - in science, politics, art, or  whatever  -
evokes three stages of reaction in a hearer:
  1. It is completely impossible - don't waste my time.
  2. It is possible, but it is not worth doing.
  3. I said it was a good idea all along.

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Wolfgang Denk]

In message <48108027.7020605@miraclelinux.com> you wrote:
>
> I've read it but I'm afraid it's bit different from Boot Image Fallback.
> 
> Boot Image Fallback decides image to boot according to a order of images to 
> boot and depending on previous boot has succeeded or not. So, this kind of 
> mechanism is still needed.

Are you aware that U-Boot has scripting capabilities, to the extend of
being able to run shell scripts?

What you are asking for can be pretty easily implemented using a few
macro definitions utilizing the aforementioned features.

If you think something is missing, please point out which specific
feature you think is missing.

Please make sure to read the previous postings and the available
documentation on this topic.

> Also, on Boot Image Fallback, "default" changes dynamically but "default 
> booting configuration" is embedded in ".its" and it's static.

You can define boot commands, and change these definitions with each
boot you perform.

Don't look for a turn-key solution, instead look for building blocks
which you can easily put together.

> Anyway thank you. By the way, is it able to define "bootargs" for each image 
> entry on ".its"?

The "bootargs" variable normally gets built dynamically, and of cource
you can change the settings each time you build it.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
"The one charm of marriage is that it makes a  life  of  deception  a
neccessity."                                            - Oscar Wilde

[U-Boot-Users] [RFC] Implementing Boot Image Fallback on U-Boot

[Makito SHIOKAWA]

Hi,

Thank you for your reply.

> Are you aware that U-Boot has scripting capabilities, to the extend of
> being able to run shell scripts?

What I was thinking as "boomf" is like a patch bellow (It is for U-Boot 1.1.4 
and just a prototype). I knew about scripting, but I thought it was difficult 
to do this processing by a script (especially error checks). Also, I didn't 
think it's a good way to set corresponding long script to "bootcmd" (U-Boot 
environment area is limited).

But, is it better to do this processing by a script? (Or, is there more proper 
way to do same kind of things?)

> What you are asking for can be pretty easily implemented using a few
> macro definitions utilizing the aforementioned features.

Is it able to do without using all of the elements (new command, new 
environment variable, fw_setenv) I wrote in the first mail?
I'll check documents and sources over again, but I would appreciate if you can 
give me some keywords of those features ...


Best regards,

---
  common/Makefile     |    2
  common/cmd_bootmf.c |  256 +++++++++++++++++++++++++++++++++++++++++++++++++++
  2 files changed, 257 insertions(+), 1 deletion(-)

--- a/common/Makefile
+++ b/common/Makefile
@@ -29,7 +29,7 @@ AOBJS	=

  COBJS	= main.o ACEX1K.o altera.o bedbug.o circbuf.o \
  	  cmd_ace.o cmd_autoscript.o \
-	  cmd_bdinfo.o cmd_bedbug.o cmd_bmp.o cmd_boot.o cmd_bootm.o \
+	  cmd_bdinfo.o cmd_bedbug.o cmd_bmp.o cmd_boot.o cmd_bootm.o cmd_bootmf.o \
  	  cmd_cache.o cmd_console.o \
  	  cmd_date.o cmd_dcr.o cmd_diag.o cmd_display.o cmd_doc.o cmd_dtt.o \
  	  cmd_eeprom.o cmd_elf.o cmd_ext2.o \
--- /dev/null
+++ b/common/cmd_bootmf.c
@@ -0,0 +1,256 @@
+/*
+ * (C) Copyright 2008
+ * Makito SHIOKAWA, MIRACLE LINUX CORPORATION, mshiokawa at miraclelinux.com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#include <common.h>
+#include <command.h>
+
+extern int do_bootm (cmd_tbl_t *, int, int, char *[]);
+
+/*
+ * Codes are taken from GRUB
+ */
+
+#define MAXINT 0x7FFFFFFF
+#define MAX_FALLBACK_ENTRIES 8
+
+static int default_entry;
+static int fallback_entryno;
+static int fallback_entries[MAX_FALLBACK_ENTRIES];
+static int current_entryno;
+
+static int tolower (int c)
+{
+	if (c >= 'A' && c <= 'Z')
+		return (c + ('a' - 'A'));
+	
+	return c;
+}
+
+static int safe_parse_maxint (char **str_ptr, int *myint_ptr)
+{
+	char *ptr = *str_ptr;
+	int myint = 0;
+	int mult = 10, found = 0;
+
+	/*
+	 *  Is this a hex number?
+	 */
+	if (*ptr == '0' && tolower (*(ptr + 1)) == 'x')
+	{
+		ptr += 2;
+		mult = 16;
+	}
+	
+	while (1)
+	{
+		/* A bit tricky. This below makes use of the equivalence:
+		   (A >= B && A <= C) <=> ((A - B) <= (C - B))
+		   when C > B and A is unsigned.  */
+		unsigned int digit;
+		
+		digit = tolower (*ptr) - '0';
+		if (digit > 9)
+		{
+			digit -= 'a' - '0';
+			if (mult == 10 || digit > 5)
+				break;
+			digit += 10;
+		}
+		
+		found = 1;
+		if (myint > ((MAXINT - digit) / mult))
+		{
+			return 0;
+		}
+		myint = (myint * mult) + digit;
+		ptr++;
+	}
+	
+	if (!found)
+	{
+		return 0;
+	}
+	
+	*str_ptr = ptr;
+	*myint_ptr = myint;
+	
+	return 1;
+}
+
+static int default_func (char *arg)
+{
+	if (! safe_parse_maxint (&arg, &default_entry))
+		return 1;
+
+	return 0;
+}
+
+/* Find the next word from CMDLINE and return the pointer. If
+   AFTER_EQUAL is non-zero, assume that the character `=' is treated as
+   a space. Caution: this assumption is for backward compatibility.  */
+static char *skip_to (int after_equal, char *cmdline)
+{
+	/* Skip until we hit whitespace, or maybe an equal sign. */
+	while (*cmdline && *cmdline != ' ' && *cmdline != '\t' &&
+	      ! (after_equal && *cmdline == '='))
+		cmdline ++;
+	
+	/* Skip whitespace, and maybe equal signs. */
+	while (*cmdline == ' ' || *cmdline == '\t' ||
+	      (after_equal && *cmdline == '='))
+		cmdline ++;
+
+	return cmdline;
+}
+
+static int fallback_func (char *arg)
+{
+	int i = 0;
+	
+	while (*arg)
+	{
+		int entry;
+		int j;
+		
+		if (! safe_parse_maxint (&arg, &entry))
+			return 1;
+		
+		/* Remove duplications to prevent infinite looping.  */
+		for (j = 0; j < i; j++)
+			if (entry == fallback_entries[j])
+				break;
+		if (j != i)
+			continue;
+		
+		fallback_entries[i++] = entry;
+		if (i == MAX_FALLBACK_ENTRIES)
+			break;
+		
+		arg = skip_to (0, arg);
+	}
+	
+	if (i < MAX_FALLBACK_ENTRIES)
+		fallback_entries[i] = -1;
+	
+	fallback_entryno = (i == 0) ? -1 : 0;
+	
+	return 0;
+}
+
+static int savedefault_func (void)
+{
+	int entryno;
+	int i;
+	int index = 0;
+	char buf[16];
+	
+	for (i = 0; i < MAX_FALLBACK_ENTRIES; i++)
+	{
+		if (fallback_entries[i] < 0)
+			break;
+		if (fallback_entries[i] == current_entryno)
+		{
+			index = i + 1;
+			break;
+		}
+	}
+	
+	if (index >= MAX_FALLBACK_ENTRIES || fallback_entries[index] < 0)
+	{
+		/* This is the last.  */
+		return 1;
+	}
+	
+	entryno = fallback_entries[index];
+	
+	sprintf(buf, "%d", entryno);
+	setenv("default", buf);
+	saveenv();
+	
+	return 0;
+}
+
+/*
+ * TODO: Add error check
+ */
+
+int do_bootmf (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[])
+{
+	char *s;
+	
+	default_entry = 0;
+	fallback_entryno = -1;
+	fallback_entries[0] = -1;
+	current_entryno = 0;
+	
+	if ((s = getenv("default")) != NULL)
+		default_func(s);
+	
+	if ((s = getenv("fallback")) != NULL)
+		fallback_func(s);
+	
+	while (1) {
+		char buf[16];
+		char *local_args[2];
+		ulong addr;
+		int rcode = 0;
+		
+		if (!current_entryno)
+			current_entryno = default_entry;
+		
+		savedefault_func();
+		
+		sprintf(buf, "imgaddr%d", current_entryno);
+		if ((s = getenv(buf)) != NULL)
+			addr = simple_strtoul(s, NULL, 16);
+		else
+			break;
+		
+		sprintf(buf, "bootargs%d", current_entryno);
+		if ((s = getenv(buf)) != NULL)
+			setenv("bootargs", s);
+		else
+			break;
+		
+		load_addr = addr;
+		local_args[0] = argv[0];
+		local_args[1] = NULL;
+		rcode = do_bootm (cmdtp, 0, 1, local_args);
+		if (rcode) {
+			if (fallback_entryno >= 0) {
+				current_entryno = fallback_entries[fallback_entryno];
+				fallback_entryno++;
+				if (fallback_entryno >= MAX_FALLBACK_ENTRIES
+				   || fallback_entries[fallback_entryno] < 0)
+					fallback_entryno = -1;
+			} else
+				break;
+		} else
+			break;
+	}
+	
+	return 1;
+}
+
+U_BOOT_CMD(
+	bootmf, 1, 1, do_bootmf,
+	"bootmf - boot application image from memory with fallback enabled\n",
+	NULL
+);

-- 
MIRACLE LINUX CORPORATION
Makito SHIOKAWA