How to revert to the previous slot if the new slot fails to boot successfully?

[tigerinus]

Hello @ejoerns

We are building a embeded system with RAUC support.

A scenario we are looking at is that,

1. say we have slot A running the system fine, and we've written the new update bundle to slot B
2. for some reason the init process when booting from slot B determines that there is an error (e.g. a specific service exited with an error code)
3. the system should revert back to slot A and some how let the user know there was a failure with slot B.

Is this scenario supported? How exactly do we achieve this goal?

Much appreciated!

[tigerinus]

Is https://rauc.readthedocs.io/en/latest/basic.html#boot-confirmation-and-fallback the right information for my scenario?

[ejoerns]

For the basic fallback handling as I described below, yes.

[ejoerns]

One way to achieve a similar behavior would be tu just order the good-marking after the successful initialisation.

This way the bootloader would attempt to boot the slot n times before falling back.

Depending on your bootloader, you can use boot-attempts-primary=1 to allow only a single try on first boot.

Another way would be to explicitly mark the slot bad in the service that determines the error (e.g. by executing rauc status mark-bad) and then reboot.

The question of how to notify the user is a bit more tricky. There currently is no existing solid fallback detection in RAUC. However, I would assume that all the necessary pieces of information should be there or ready to add. However, I am not yet 100% sure about the best way to implement it.

This more or less belongs to the life cycle handling support we are indirectly working on. We already have the information that we are within a certain installation transaction, we can detect if we booted into a new system and one could extend the 'mark' interface to end or abort the transaction. In this context, I would see an option to notify the user.

Informing the user by the time of service error is not sufficient I guess?

[tigerinus]

Depending on your bootloader, you can use boot-attempts-primary=1 to allow only a single try on first boot.

We use grub, does boot-attempts-primary=1 apply? how?

Another way would be to explicitly mark the slot bad in the service that determines the error (e.g. by executing rauc status mark-bad) and then reboot.

Yes, this is what we are looking at right now.

We just don't know how to tell whether current boot is a revert from previously failed update or a normal boot of successful update.

I guess we can use some filepath under user data partition for state keeping - it's just not elegant enough to us.

[ejoerns]

We use grub, does boot-attempts-primary=1 apply? how?

boot-attempts-primar is currently only supported for barebox and u-boot. But that's just a question of implementation (which should be quite fast-forward for other bootloaders).

#1074 should serve as a blueprint here.

I guess we can use some filepath under user data partition for state keeping - it's just not elegant enough to us.

A workaround could be to look into the status file and check if the currently booted slot group is the one with the most recent installation timestamp.

The elegant way is the one I outlined above. That would however still need a bit of implementation in RAUC.