I am attempting to use Redundant Boot to implement robust bootloader update. And I have partly succeeded, but I have witnessed some confusing behavior.
We are using i.MX8MM with eMMC. The eMMC has two boot partitions. We are using U-Boot compiled with Yocto from the uboot-imx Github repository.
I am successfully able to create the Secondary Image Table on partition boot0. If the bootloader at address 0x42 does not work, the secondary bootloader at address 0x1000 + 0x42 is loaded just as intended.
But now for the confusion: If boot1 does not contain a valid bootloader, the device will not boot. U-Boot gives the following error:
mmc_load_image_raw_sector: mmc block read error
SPL: failed to boot from all boot devices
### ERROR ### Please RESET the board ###
If boot0 at address 0x42 contains a valid bootloader, the device boots, regardless of what boot1 contains.
I did a bit of debugging, and SPL is attempting to read from boot1 when PERSIST_SECONDARY_BOOT is 1 but the bootloader is on boot0. This the code that causes this is in uboot-imx/arch/arm/mach-imx/imx8m/soc.c:
/*
* Swap the eMMC boot partitions in case there was a
* fallback event (i.e. primary image was corrupted
* and that corruption was recognized by the BootROM),
* so the SPL loads the rest of the U-Boot from the
* correct eMMC boot partition, since the BootROM
* leaves the boot partition set to the corrupted one.
*/
if (part == 1)
part = 2;
else if (part == 2)
part = 1;
continue;
I initially thought this was a bug in U-Boot, and I commented out the code. But this caused secondary boot to fail altogether, where before it worked. As far as I understood it, secondary boot happens inside one eMMC boot partition, and the contents of the other partition should not effect the boot. But clearly it does.
Am I understanding something wrong, or is there a bug in U-Boot?
