Within the Raspberry Pi 5 firmware, using the autoboot.txt's [all] and [tryboot] sections to define a default and "tryboot" boot_partition for an A/B upgrade implementation, it would be nice if there was a way to identify in the [all] section a boot partition to fallback onto if the first boot_partition is unbootable.
For example, having an autoboot.txt like this:
Then this would allow for when the tryboot flag is not set to attempt to boot from partition 2, but if that fails (such as secure boot fails to verify or if the desired files cannot be loaded) that then the firmware would switch to partition 3 and try to boot that before moving on to the next device in the boot order.
If the tryboot flag is set, then the firmware would try to boot from partition 3, but if that fails, then it would switch to partition 2 and try to boot that.
In this way, besides just during A/B upgrades, if there's a boot failure like file corruption of the kernel, then at least the system would still be bootable, just into an older installation. And during an A/B upgrade, when booting into the just-upgraded system with tryboot set, if that fails then you'd just boot into the original system and your upgrade mechanism could see this and mark the just-upgraded system as "bad".
Is something like this already possible? Such as automatically setting the tryboot flag if the [all] section's boot_partition is not bootable?
For example, having an autoboot.txt like this:
Code:
[all]tryboot_a_b=1boot_partition=2boot_partition_fallback=3[tryboot]boot_partition=3boot_partition_fallback=2If the tryboot flag is set, then the firmware would try to boot from partition 3, but if that fails, then it would switch to partition 2 and try to boot that.
In this way, besides just during A/B upgrades, if there's a boot failure like file corruption of the kernel, then at least the system would still be bootable, just into an older installation. And during an A/B upgrade, when booting into the just-upgraded system with tryboot set, if that fails then you'd just boot into the original system and your upgrade mechanism could see this and mark the just-upgraded system as "bad".
Is something like this already possible? Such as automatically setting the tryboot flag if the [all] section's boot_partition is not bootable?
Statistics: Posted by bradfa — Wed Jul 23, 2025 7:12 pm