Repository navigation
Retry target after an unusable backup - #60
felipebalbi merged 1 commit into
Conversation
9ae308f to
843dd0a
Compare
gjpmsft
changed the title
When the journal selects an unusable backup, try the distinct target rather than aborting without checking it during this boot. Record Attempting before handoff so the app tracks its running and update slots correctly.
e1b2a47 to
23c9d23
Compare
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for the bootloader recovery change.
No open issues 🎉
What changed in this PR
Adds a recovery path to the bootloader: when the selected backup cannot boot, it retries the target if the slots differ.
Changes:
- Retry the target after a failed backup boot.
- Record
Attemptingbefore retrying so the application identifies its running and update slots correctly. - Document the fallback behavior and once-per-boot candidate checks.
| File | Description |
|---|---|
| README.md | Documents reverse fallback and slot tracking. |
| libs/ec-slimloader/src/lib.rs | Adds the target retry and preceding Attempting status update. |
Review effort: Balanced
felipebalbi
left a comment
felipebalbi
left a comment
There was a problem hiding this comment.
Looks good to me but there is a small concern I would like to point out:
After this change, if both images fail we will ping-pong between Attempting -> Failed forever. This may cause extra wear on the particular page holding those states.
Not a super big deal, but it's a real flash wear concern.
Agreed, but we're in a state that is entirely unrecoverable at that point any way. |
1860501
into
OpenDevicePartnership:mcxa-secure-boot
Attemptingbefore boot so the app tracks its running/update slots correctly.