From: Wolfgang Denk Date: Mon, 17 Jun 2013 16:24:52 +0200 Subject: [U-Boot] [RFC] Safe Linux Updater In-Reply-To: References: <130325823.452426.1371459938406.JavaMail.root@openwide.fr>, <20130617122641.2C6A73804A4@gemini.denx.de> Message-ID: <20130617142452.263D63804AB@gemini.denx.de> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Dear Mats, In message you wrote: > > I havn't seen the scripts of Alexandre but it sounds something like what > we have already implemented. I haven'ty seen the scripts either, but this is something that has been implemented many times before, with many variations depending on specific project needs. But as I mentioned before, most users do not push such scripts into mainline... > > Please note that this is a feature standardized for example in the > > Open Source Development Labs Carrier Grade Linux Requirements > > Definition, which says something like: "CGL shall provide support > > for detecting a repeating reboot cycle due to recurring failures > > and will go to an offline state if this occurs." > > As I read Alexandre, the aim is to revert to a previous functional image, Yes, of course. And the boot counter is the mechanism that will decide when to do that. > not to go to an offline state. Indeed. U-Boots boot counter will select an alternative boot command in this case - you can use this to hard hang or power off the board and so implement strictly CGL conformant behaviour, or you can do somthing else like fall back to the previous version. > > Normally you want to avoid all erase / write operations to > > the boot loader and it's private data structures in the process of > > a normal reboot / reset. > > But a failing boot is not a normal boot. This should only occur when an > update fails. After a maximum number of failing boots, the old functional Alexandre wrote about a boot counter; he did not mention that he would update this only on failed boot attempts. Also, in my experience one should be especially careful when something fails, and in such a situation I would all the more restrain from messing with the environment if it can be avoided (and here it's trivial to avoid). > image is used and there is no need to update the counter any more. Did you have a look at the current implementation of the boot counter for the systems where it is supported? Yes, we even do have a system where the boot counter is stored in an environment variable (due to hardware restrictions and the expectation that the system will normally not need to be rebooted at all), but normally is can be easily avoided to meddle with the environment for this functionality. Best regards, Wolfgang Denk -- DENX Software Engineering GmbH, MD: Wolfgang Denk & Detlev Zundel HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de A person who is more than casually interested in computers should be well schooled in machine language, since it is a fundamental part of a computer. -- Donald Knuth