<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">On 03/31/2016 02:31 PM, Michal Sekletar wrote: </div> <blockquote cite="mid:CALVzVJYfHo-wLfunCUCjGn4mo1oFA5et9+V4wi4ogh+CzpyMLA@mail.gmail.com" type="cite"> <pre wrap="">We don't need to extend the kernel in order to implement this particular mechanism. After new kernel is installed, you make it default and mark as "tentative". Then, after first successful boot of newly added bootloader entry you just remove the flag, because it is known to work. </pre> </blockquote> I dont see how you plan on implement this if not with either a secondary program loader which stores an redundant environment or an kernel support that does the similar/same thing I mean you need to have a watchdog support,boot counter which get's cleared when system decides it's up and stable,boot limit which tells it how many times it should try with an given entry, an entry which points to which kernel/image/snapshot to use right? I'm pretty sure Kay and Lennart must have thought things through so they just dont add just some half ass, none future proof, working solution that give administrators and embedded distribution fake notion of redundancy or a "fail-safe" when images and or kernel or the OS itself get's update/upgraded. If this cannot or will not be reliably implemented there is no point in implementing this in the first place from my pov. JBG </body> </html>