U-Boot A/B Slot Selection: Suppressing Retry Decrements Does Not Make It Read-Only

bcb ab_select --no-dec sounds like a convenient way to
inspect the next Android boot slot without changing persistent state. In
U-Boot v2025.01, it disables one specific mutation: decrementing the
selected slot’s remaining tries. Other metadata repair, normalization
and synchronization writes remain possible.

For a product using this U-Boot A/B implementation, including a
bootloader built through Buildroot, distinguish observation from
selection before adding diagnostic calls. The analysis concerns
Android-style boot-control metadata, not MCUboot trailers or
filesystem-backed U-Boot bootcount.

Identify what the
option actually controls

The command handler initializes dec_tries to true and
changes it to false only when it parses --no-dec. It passes
that Boolean into ab_select_slot(), then publishes the
returned slot letter in the requested environment variable after a
nonnegative result. Tagged
BCB command.

Inside the selector, a selected slot that is not marked successful
can have its attempt count decremented. The Boolean gates that decrement
and its associated request to store metadata. It is not passed as a
general “do not write” flag to every storage operation. A/B
selector implementation.

A normal selection can therefore consume a trial attempt before the
operating system is launched. Calling it again merely to print the slot
can consume another attempt for an unconfirmed selection. Give attempt
accounting one intentional invocation point rather than assuming each
selection query is observational.

Follow the remaining store
paths

The selector reads the primary metadata and, when configured, its
backup. If the primary CRC is invalid, it can copy a CRC-valid backup or
initialize default metadata when no valid backup is available. It marks
the primary for storage in that path regardless of
dec_tries. The documentation also describes initial
metadata creation on a new system. Selector
repair path, A/B
integration guide.

Other paths can request a store too. A slot count beyond the array’s
capacity is clamped. When a slot is selected, the legacy suffix is
updated if it differs from that selection. If storage is needed, the
implementation recomputes the CRC and calls the primary-store
helper.

With backup support enabled, the function separately compares the
backup with the resulting primary metadata. A difference can cause a
backup write even when no retry decrement occurred. Thus an unchanged
counter is not sufficient evidence that the invocation left storage
untouched.

These observations do not mean every invalid structure is silently
replaced. The code has distinct magic and version checks, and failures
can terminate selection. They also do not establish atomicity or
durability for every storage failure. The narrower conclusion is that
--no-dec does not prohibit calls that write metadata.

Use the inspection path
for inspection

The separate bcb ab_dump command calls
ab_dump_abc(). In this tagged implementation that helper
reads and reports the control structure, checks structural fields and
prints the calculated CRC comparison; it does not invoke the selector’s
metadata-store path. A readable report remains different from a
successful future boot. Dump
command and helper, dump
implementation.

For incident analysis, prefer preserved metadata images and this
read-oriented inspection path over repeatedly running selection. Keep
the selected slot, stored suffix, retry count and successful-boot flag
as separate observations. Avoid interpreting a suffix alone as proof
that the corresponding image was accepted by the operating system.

A proposed model-based qualification compares ordinary selection and
--no-dec using valid metadata, a mismatched suffix, an
invalid primary with valid backup and differing backup content. Observe
actual storage calls or before-and-after fixture bytes, not only the
retry counter. Include write failures without assuming the selector
provides a transaction spanning both copies.

No selector, metadata repair or boot attempt was executed for this
article. The acceptance boundary is explicit: suppressing retry
decrement is a narrow policy choice, while avoiding persistent mutation
requires an inspection path that does not perform selection
maintenance.