'bootipq' and 'bootm' difference in uboot (was: Sysupgrade from initramfs on IPQ4019)

Dear All,

With a lot of help, I've nearly got OpenWrt running on my Netgear WAC510 (an IPQ4019 access point).

Unfortunately I'm stuck at the last (I hope!) hurdle: writing OpenWrt to flash instead of booting from RAM.

I've got serial console access to uboot and can tftp over my initramfs image and install my sysupgrade binary using the sysupgrade tool, but uboot won't boot it from flash.

I've copied the whole output from this process:
..power on into uboot..
printenv
tftpboot my initramfs image into unused RAM
boot the data at that address
..in OpenWrt..
cat /proc/mtd
cat /proc/partitions
ubinfo
copy over sysupgrade binary
run sysupgrade..
..uboot fails..
try booting with 'debug' option
bootipq debug

Here's the full log of the above commands:

I'm acutely aware this is a potentially dangerous step to mess up (I've already hard-bricked one of these things), so any advice would be very welcome.

I think I need to tell uboot where the new kernel/rootfs is. How do I know where it is in the same notation as uboot wants? Is the 'bootargs' uboot variable (near the bottom of the bootlog) significant?

Many thanks,

Tim

I can't find any documentation on what the difference between bootm and bootipq is in uboot.

This Netgear WAC510 simply runs 'bootipq' to load the stock firmware, but after I've sysupgraded from an initramfs image of OpenWrt, I get this:
Config not availabale
bootipq failed!!
resetting ...

I know bootm boots the application at a specific address, and I'm guessing that bootipq uses a setting somewhere to determine what to boot and where, but I'm lost at this point..

Do I need to use bootipq? Can I just use bootm if I can figure out where to load the kernel and rootfs to? This version of uboot appears to have been neutered a bit as there's loads of useful commands missing in it, it seems..

Any uboot experts out there? :-:confused:

Tim

Hm,is bootipq maybe defined as env variable?

Sadly not.. The env variables are not shedding any light on this thing, other than telling me how to switch to the 'backup' firmware image (env 'primary' and 'secondary'):
(IPQ40xx) # printenv
baudrate=115200
boot_cnt=1
bootcmd=bootipq
bootdelay=2
bootparm=init=/bin/sh
bootparms=init=/bin/sh
delenv=sf probe && sf erase 0x000e0000 +0x10000
ethact=eth0
fdt_high=0x87000000
flash_type=0
fw_upgrade=0
install_cal_to_end_of_nor=sf probe && sf read 0x84000000 0x170000 0x10000 && sf erase 0x1f0000 +0x10000 && sf write 0x84000000 0x1f00
ipaddr=192.168.1.11
machid=8010100
nand_erasesize=20000
nand_oobsize=40
nand_writesize=800
primary=0
proceed_upgrade=0
product_id=WAC510
secondary=3800000
show_cal_at_end_of_nor=sf probe && sf read 0x84000000 0x1f0000 0x10000 && md.b 0x84001000 0x40
stderr=serial
stdin=serial
stdout=serial
Environment size: 692/65532 bytes
(IPQ40xx) #

The stock firmware doesn't seem to upgrade the kernel, only the rootfs. It uses standard linux mtd tools to write the rootfs partition, but there's no mention of the kernel which is tar'd up in the stock firmware upgrade file.

I've been going through everything I can, and I think bootipq sets up the UBI filesystem on one of the NAND chips and boots from there. Sysupgrade successfully writes to the UBI partitions, but there's a tiny bit of magic happening that must be some kind of config file/bootloader that needs to sit in the UBI file system which bootipq is missing.

Tim

Hm,you can actually change bootcmd to bootm and then location of the kernel.
That will tell you if bootipq is the one to blame

Trouble is, I can't find the location of the kernel.

I think sysupgrade wrote it to a UBI partition on the NAND chip, but I can't find out what that address is. Uboot is only telling me about the first NAND chip, which appears to be for manufacturing data and uboot itself:
(IPQ40xx) # nand info
Device 1: nand1, sector size 128 KiB
Page size 2048 b
OOB size 64 b
Erase size 131072 b
Device 2: nand2, sector size 4 KiB
Page size 256 b
OOB size 0 b
Erase size 4096 b
(IPQ40xx) # ubi info
mtdids not defined, no default present
Error initializing mtdparts!
(IPQ40xx) # mtdparts
mtdids not defined, no default present
(IPQ40xx) # smeminfo
flash_type: 0x6
flash_index: 0x0
flash_chip_select: 0x0
flash_block_size: 0x10000
flash_density: 0x1000000
partition table offset 0x0
No.: Name Attributes Start Size
0: 0:SBL1 0x0000ffff 0x0 0x40000
1: 0:MIBIB 0x001040ff 0x40000 0x20000
2: 0:QSEE 0x0000ffff 0x60000 0x60000
3: 0:CDT 0x0000ffff 0xc0000 0x10000
4: 0:DDRPARAMS 0x0000ffff 0xd0000 0x10000
5: 0:APPSBLENV 0x0000ffff 0xe0000 0x10000
6: 0:APPSBL 0x0000ffff 0xf0000 0xf0000
7: 0:MANUDATA 0x0000ffff 0x1e0000 0x10000
8: 0:ART 0x0000ffff 0x1f0000 0x10000
(IPQ40xx) #

Tim

When I type 'bootipq', I think a script is running that creates the UBI device and hands off control to some kind of boot file:
(IPQ40xx) # bootipq
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done
Boot count=1
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000003800000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 56 MiB
UBI: number of good PEBs: 448
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 4
UBI: available PEBs: 16
UBI: total number of reserved PEBs: 432
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 2/0
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (2793472)
Config not availabale
bootipq failed!!
resetting ...

Tim

Getting closer:
If I type bootipq debug I get this extra snippet of info:
bootargs=WAC510 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs mtdparts=spi0.1:56m(rootfs),56m(rootfs_1),15m(var_config),768k(Oops_log) rootwait

Which apparently contains the MTD->NAND mapping to hand over to the kernel via the 'mtdparts=' variable.

Now, I reckon if I can decode that back into uboot-land, I can get uboot to make the new OpenWrt UBI volume up from the NAND chip, then tell it to boot the kernel UBIFS volume.

What do you think?

Tim

This is new to me too,we need someone more experienced

Someone who knows more about ubifs and uboot would be best. I wonder if the person who makes sysupgrade compile ubi images would help?

Tim

So, it seems 'bootipq' is a hard-coded script which initialises the flash chip with a UBI file system.

I've managed to load the kernel from the 'kernel' volume, but I get a kernel panic because it can't find the 'rootfs' UBI volume.

What kernel parameters should I be passing to help it, because it looks like it's already scanning for it and failing to mount it automatically? Or is something else wrong? I've done a sysupgrade on this device, and some UBI volumes were created by the script.

Here's the bootlog:

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.9.82 (tim@ITDept002) (gcc version 5.5.0 (OpenWrt GCC 5.5.0 r6377-9c12177) ) #0 SMP Sun Mar 11 18:01:58
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt:Machine model: Netgear WAC510
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 13 pages/cpu @cfda9000 s20940 r8192 d24116 u53248
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63744
[    0.000000] Kernel command line: 
[    0.000000] Bootloader command line not present
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 248448K/257024K available (3860K kernel code, 246K rwdata, 1236K rodata, 236K init, 242K bss, 8576K reserved,)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xd0800000 - 0xff800000   ( 752 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc05cd3a0   (3861 kB)
[    0.000000]       .init : 0xc0723000 - 0xc075e000   ( 236 kB)
[    0.000000]       .data : 0xc075e000 - 0xc079b9c0   ( 247 kB)
[    0.000000]        .bss : 0xc079d000 - 0xc07d9868   ( 243 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] arm_arch_timer: Architected cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000023] Switching to timer-based delay loop, resolution 20ns
[    0.000412] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000431] pid_max: default: 32768 minimum: 301
[    0.000534] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000546] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.001173] CPU: Testing write buffer coherency: ok
[    0.001484] Setting up static identity map for 0x80208280 - 0x802082d8
[    0.005480] Brought up 4 CPUs
[    0.005499] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.005506] CPU: All CPU(s) started in SVC mode.
[    0.018033] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.018238] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.018263] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.018427] pinctrl core: initialized pinctrl subsystem
[    0.019744] NET: Registered protocol family 16
[    0.020050] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.049986] cpuidle: using governor ladder
[    0.080014] cpuidle: using governor menu
[    0.120898] msm_bus_fabric_init_driver
[    0.121160] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[    0.121177] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[    0.121196] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1
[    0.121238] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[    0.121252] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[    0.121267] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1
[    0.181232] usbcore: registered new interface driver usbfs
[    0.181326] usbcore: registered new interface driver hub
[    0.181438] usbcore: registered new device driver usb
[    0.181492] pps_core: LinuxPPS API ver. 1 registered
[    0.181502] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.181531] PTP clock support registered
[    0.182785] clocksource: Switched to clocksource arch_sys_counter
[    0.183800] NET: Registered protocol family 2
[    0.184424] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.184471] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.184520] TCP: Hash tables configured (established 2048 bind 2048)
[    0.184585] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.184619] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.184806] NET: Registered protocol family 1
[    0.186039] No memory allocated for crashlog
[    0.186270] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    0.192403] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.192418] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.196926] io scheduler noop registered
[    0.196941] io scheduler deadline registered (default)
[    0.200960] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.201020] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.201080] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.201133] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.201283] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.202048] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.202093] msm_serial 78af000.serial: uartclk = 1843200
[    0.202140] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 125, base_baud = 115200) is a MSM
[    0.202165] msm_serial: console setup on port #0
[    0.730922] console [ttyMSM0] enabled
[    0.735970] msm_serial: driver initialized
[    0.746508] loop: module loaded
[    0.747621] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.749342] m25p80 spi0.0: found s25fl016k, expected mx25l1606e
[    0.761161] random: fast init done
[    0.764725] m25p80 spi0.0: s25fl016k (2048 Kbytes)
[    0.764905] 9 ofpart partitions found on MTD device spi0.0
[    0.769637] Creating 9 MTD partitions on "spi0.0":
[    0.775131] 0x000000000000-0x000000040000 : "0:SBL1"
[    0.780899] 0x000000040000-0x000000060000 : "0:MIBIB"
[    0.785999] 0x000000060000-0x0000000c0000 : "0:QSEE"
[    0.790839] 0x0000000c0000-0x0000000d0000 : "0:CDT"
[    0.795862] 0x0000000d0000-0x0000000e0000 : "0:DDRPARAMS"
[    0.800417] 0x0000000e0000-0x0000000f0000 : "0:APPSBLENV"
[    0.806040] 0x0000000f0000-0x0000001e0000 : "0:APPSBL"
[    0.811415] 0x0000001e0000-0x0000001f0000 : "0:MANUDATA"
[    0.816547] 0x0000001f0000-0x000000200000 : "0:ART"
[    0.822949] libphy: ipq40xx_mdio: probed
[    0.859753] ESS reset ok!
[    0.892743] ESS reset ok!
[    1.323290] libphy: Fixed MDIO Bus: probed
[    1.323316] libphy: mdio_driver_register: qca8k
[    1.423507] i2c /dev entries driver
[    1.425375] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 666000 KHz
[    1.425868] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 716800 KHz
[    1.433644] sdhci: Secure Digital Host Controller Interface driver
[    1.441778] sdhci: Copyright(c) Pierre Ossman
[    1.448158] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.504424] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.504662] nand: Winbond W25N01GV 1G 3.3V 8-bit
[    1.510084] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.515086] Scanning device for bad blocks
[    1.941965] random: crng init done
[    2.049679] 1 ofpart partitions found on MTD device spi0.1
[    2.049705] Creating 1 MTD partitions on "spi0.1":
[    2.054083] 0x000000000000-0x000003800000 : "rootfs"
[    2.060138] mtd: device 9 (rootfs) set to be root filesystem
[    2.066204] mtdsplit: no squashfs found in "rootfs"
[    2.070653] NET: Registered protocol family 10
[    2.075593] NET: Registered protocol family 17
[    2.078900] 8021q: 802.1Q VLAN Support v1.8
[    2.083209] Registering SWP/SWPB emulation handler
[   [    2.094091] List of all partitions:
[    2.094138] 1f00             256 mtdblock0 [    2.096385]  (driver?)
[    2.101598] 1f01             128 mtdblock1 [    2.102855]  (driver?)
[    2.107944] 1f02             384 mtdblock2 [    2.109163]  (driver?)
[    2.114290] 1f03              64 mtdblock3 [    2.115510]  (driver?)
[    2.120636] 1f04              64 mtdblock4 [    2.121854]  (driver?)
[    2.126982] 1f05              64 mtdblock5 [    2.128201]  (driver?)
[    2.133344] 1f06             960 mtdblock6 [    2.134547]  (driver?)
[    2.139673] 1f07              64 mtdblock7 [    2.140892]  (driver?)
[    2.146019] 1f08              64 mtdblock8 [    2.147238]  (driver?)
[    2.152364] 1f09           57344 mtdblock9 [    2.153603]  (driver?)
[    2.158706] No filesystem could mount root, tried: [    2.159932]  squashfs
[    2.165745] 
[    2.166973] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,9)
[    2.168549] CPU1: stopping
[    2.176611] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.82 #0
[    2.179388] Hardware name: Generic DT based system
[    2.185234] [<c0215530>] (unwind_backtrace) from [<c0211f1c>] (show_stack+0x10/0x14)
[    2.190082] [<c0211f1c>] (show_stack) from [<c03962a8>] (dump_stack+0x7c/0x9c)
[    2.197977] [<c03962a8>] (dump_stack) from [<c0214878>] (handle_IPI+0xcc/0x184)
[    2.205006] [<c0214878>] (handle_IPI) from [<c02093f8>] (gic_handle_irq+0x78/0x94)
[    2.212214] [<c02093f8>] (gic_handle_irq) from [<c021288c>] (__irq_svc+0x6c/0x90)
[    2.219845] Exception stack(0xcf86df90 to 0xcf86dfd8)
[    2.227396] df80:                                     00000001 00000000 00000000 c021a420
[    2.232438] dfa0: 00000000 cf86c000 c0760fe4 00000002 c075ba30 00000000 cf86dfe8 00000001
[    2.240594] dfc0: 00000000 cf86dfe0 c020f510 c020f514 60000013 ffffffff
[    2.248759] [<c021288c>] (__irq_svc) from [<c020f514>] (arch_cpu_idle+0x2c/0x38)
[    2.255184] [<c020f514>] (arch_cpu_idle) from [<c024f220>] (cpu_startup_entry+0xe8/0x198)
[    2.262821] [<c024f220>] (cpu_startup_entry) from [<802094ac>] (0x802094ac)
[    2.270886] CPU3: stopping
[    2.277651] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.9.82 #0
[    2.280429] Hardware name: Generic DT based system
[    2.286259] [<c0215530>] (unwind_backtrace) from [<c0211f1c>] (show_stack+0x10/0x14)
[    2.291121] [<c0211f1c>] (show_stack) from [<c03962a8>] (dump_stack+0x7c/0x9c)
[    2.299016] [<c03962a8>] (dump_stack) from [<c0214878>] (handle_IPI+0xcc/0x184)
[    2.306048] [<c0214878>] (handle_IPI) from [<c02093f8>] (gic_handle_irq+0x78/0x94)
[    2.313253] [<c02093f8>] (gic_handle_irq) from [<c021288c>] (__irq_svc+0x6c/0x90)
[    2.320884] Exception stack(0xcf871f90 to 0xcf871fd8)
[    2.328438] 1f80:                                     00000001 00000000 00000000 c021a420
[    2.333478] 1fa0: 00000000 cf870000 c0760fe4 00000008 c075ba30 00000000 cf871fe8 00000001
[    2.341638] 1fc0: 00000000 cf871fe0 c020f510 c020f514 60000013 ffffffff
[    2.349799] [<c021288c>] (__irq_svc) from [<c020f514>] (arch_cpu_idle+0x2c/0x38)
[    2.356223] [<c020f514>] (arch_cpu_idle) from [<c024f220>] (cpu_startup_entry+0xe8/0x198)
[    2.363862] [<c024f220>] (cpu_startup_entry) from [<802094ac>] (0x802094ac)
[    2.371928] CPU2: stopping
[    2.378693] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.82 #0
[    2.381471] Hardware name: Generic DT based system
[    2.387298] [<c0215530>] (unwind_backtrace) from [<c0211f1c>] (show_stack+0x10/0x14)
[    2.392161] [<c0211f1c>] (show_stack) from [<c03962a8>] (dump_stack+0x7c/0x9c)
[    2.400058] [<c03962a8>] (dump_stack) from [<c0214878>] (handle_IPI+0xcc/0x184)
[    2.407088] [<c0214878>] (handle_IPI) from [<c02093f8>] (gic_handle_irq+0x78/0x94)
[    2.414295] [<c02093f8>] (gic_handle_irq) from [<c021288c>] (__irq_svc+0x6c/0x90)
[    2.421927] Exception stack(0xcf86ff90 to 0xcf86ffd8)
[    2.429478] ff80:                                     00000001 00000000 00000000 c021a420
[    2.434522] ffa0: 00000000 cf86e000 c0760fe4 00000004 c075ba30 00000000 cf86ffe8 00000001
[    2.442678] ffc0: 00000002 cf86ffe0 c020f510 c020f514 60000013 ffffffff
[    2.450840] [<c021288c>] (__irq_svc) from [<c020f514>] (arch_cpu_idle+0x2c/0x38)
[    2.457264] [<c020f514>] (arch_cpu_idle) from [<c024f220>] (cpu_startup_entry+0xe8/0x198)
[    2.464901] [<c024f220>] (cpu_startup_entry) from [<802094ac>] (0x802094ac)
[    2.472973] Rebooting in 1 seconds..

Tim

So, how do you tell the OpenWrt kernel that it's rootfs is on a UBI volume within an MTD partition?

My UBI volumes are in MTD9. One is called 'kernel' which I can boot, the other is called 'rootfs'.

Do I need extra kernel modules for the kernel to see the UBI volumes for the rootfs?

So close!!

Tim

That means that you will need to modify partition layout and split kernel and ubi partitions.
That way kernel will be loaded from it and rootfs from ubi.
Now I just used ubi as standard single partition for kernel and rootfs.
Look at the example:
https://github.com/openwrt/openwrt/blob/master/target/linux/ipq806x/files-4.9/arch/arm/boot/dts/qcom-ipq8065-r7800.dts#L358

I got a little further by adding some bootargs like this:
setenv bootargs ubi.mtd=rootfs

And the kernel logs look more promising.. It looks more like it can't find a UBIFS driver? I'll try modifying the partitions in the DTS as well..

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.9.86 (tim@ITDept002) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6473-63dc6ba) ) #0 SMP Wed Mar 14 09:20:28
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt:Machine model: Netgear WAC510
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 13 pages/cpu @cfda9000 s20940 r8192 d24116 u53248
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63744
[    0.000000] Kernel command line: ubi.mtd=rootfs root=ubiblock0_2
[    0.000000] Bootloader command line not present
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 248456K/257024K available (3839K kernel code, 246K rwdata, 1240K rodata, 244K init, 242K bss, 8568K reserved,)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xd0800000 - 0xff800000   ( 752 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc05c7f78   (3840 kB)
[    0.000000]       .init : 0xc071f000 - 0xc075c000   ( 244 kB)
[    0.000000]       .data : 0xc075c000 - 0xc0799a40   ( 247 kB)
[    0.000000]        .bss : 0xc079b000 - 0xc07d78e8   ( 243 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] arm_arch_timer: Architected cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000007] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000021] Switching to timer-based delay loop, resolution 20ns
[    0.000403] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000421] pid_max: default: 32768 minimum: 301
[    0.000520] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000532] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.001117] CPU: Testing write buffer coherency: ok
[    0.001427] Setting up static identity map for 0x80208280 - 0x802082d8
[    0.005402] Brought up 4 CPUs
[    0.005421] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.005429] CPU: All CPU(s) started in SVC mode.
[    0.017400] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.017595] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.017624] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.017786] pinctrl core: initialized pinctrl subsystem
[    0.019077] NET: Registered protocol family 16
[    0.019352] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.049985] cpuidle: using governor ladder
[    0.080013] cpuidle: using governor menu
[    0.120897] msm_bus_fabric_init_driver
[    0.121165] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[    0.121181] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[    0.121200] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1
[    0.121241] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
[    0.121254] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
[    0.121269] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1
[    0.180041] usbcore: registered new interface driver usbfs
[    0.180124] usbcore: registered new interface driver hub
[    0.180238] usbcore: registered new device driver usb
[    0.180341] pps_core: LinuxPPS API ver. 1 registered
[    0.180352] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.180380] PTP clock support registered
[    0.181655] clocksource: Switched to clocksource arch_sys_counter
[    0.182663] NET: Registered protocol family 2
[    0.183297] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.183344] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.183392] TCP: Hash tables configured (established 2048 bind 2048)
[    0.183458] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.183491] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.183677] NET: Registered protocol family 1
[    0.184927] No memory allocated for crashlog
[    0.185167] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    0.191140] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.191155] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.195650] io scheduler noop registered
[    0.195666] io scheduler deadline registered (default)
[    0.199771] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.199840] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.199894] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.199944] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.200092] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.200853] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.200898] msm_serial 78af000.serial: uartclk = 1843200
[    0.200944] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 125, base_baud = 115200) is a MSM
[    0.200969] msm_serial: console setup on port #0
[    0.732417] console [ttyMSM0] enabled
[    0.737445] msm_serial: driver initialized
[    0.747900] loop: module loaded
[    0.749022] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.750731] m25p80 spi0.0: found s25fl016k, expected mx25l1606e
[    0.762698] random: fast init done
[    0.766125] m25p80 spi0.0: s25fl016k (2048 Kbytes)
[    0.766297] 9 ofpart partitions found on MTD device spi0.0
[    0.771031] Creating 9 MTD partitions on "spi0.0":
[    0.776526] 0x000000000000-0x000000040000 : "0:SBL1"
[    0.782298] 0x000000040000-0x000000060000 : "0:MIBIB"
[    0.787325] 0x000000060000-0x0000000c0000 : "0:QSEE"
[    0.792282] 0x0000000c0000-0x0000000d0000 : "0:CDT"
[    0.797198] 0x0000000d0000-0x0000000e0000 : "0:DDRPARAMS"
[    0.801879] 0x0000000e0000-0x0000000f0000 : "0:APPSBLENV"
[    0.807387] 0x0000000f0000-0x0000001e0000 : "0:APPSBL"
[    0.812826] 0x0000001e0000-0x0000001f0000 : "0:MANUDATA"
[    0.817870] 0x0000001f0000-0x000000200000 : "0:ART"
[    0.824329] libphy: ipq40xx_mdio: probed
[    0.861100] ESS reset ok!
[    0.894098] ESS reset ok!
[    1.322165] libphy: Fixed MDIO Bus: probed
[    1.322190] libphy: mdio_driver_register: qca8k
[    1.422378] i2c /dev entries driver
[    1.424251] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 666000 KHz
[    1.424741] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 716800 KHz
[    1.432516] sdhci: Secure Digital Host Controller Interface driver
[    1.440646] sdhci: Copyright(c) Pierre Ossman
[    1.447030] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.503699] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
[    1.503933] nand: Winbond W25N01GV 1G 3.3V 8-bit
[    1.509356] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.514414] Scanning device for bad blocks
[    1.932425] random: crng init done
[    2.036913] 1 ofpart partitions found on MTD device spi0.1
[    2.036938] Creating 1 MTD partitions on "spi0.1":
[    2.041293] 0x000000000000-0x000003800000 : "rootfs"
[    2.047385] mtd: device 9 (rootfs) set to be root filesystem
[    2.053425] mtdsplit: no squashfs found in "rootfs"
[    2.057883] NET: Registered protocol family 10
[    2.062867] NET: Registered protocol family 17
[    2.066148] 8021q: 802.1Q VLAN Support v1.8
[    2.070430] Registering SWP/SWPB emulation handler
[    2.078314] ubi0: attaching mtd9
[    4.346192] ubi0: scanning is finished
[    4.403657] ubi0: attached mtd9 (name "rootfs", size 56 MiB)
[    4.403689] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.408385] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.415105] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.421945] ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
[    4.428697] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[    4.434964] ubi0: max/mean erase counter: 3/0, WL threshold: 4096, image sequence number: 1011195579
[    4.442010] ubi0: available PEBs: 0, total reserved PEBs: 448, PEBs reserved for bad PEB handling: 20
[    4.451288] ubi0: background thread "ubi_bgt0d" started, PID 105
[    4.455442] block ubiblock0_2: created from ubi0:2�[    4.472218] VFS: Cannot open root device "ubiblock0_2" or unknown-block(31,2
[    4.472250] Please append a correct "root=" boot option; here are the available partitions:
[    4.479045] 1f00             256 mtdblock0 [    4.487391]  (driver?)
[    4.492581] 1f01             128 mtdblock1 [    4.493786]  (driver?)
[    4.498914] 1f02             384 mtdblock2 [    4.500131]  (driver?)
[    4.505260] 1f03              64 mtdblock3 [    4.506478]  (driver?)
[    4.511606] 1f04              64 mtdblock4 [    4.512836]  (driver?)
[    4.517951] 1f05              64 mtdblock5 [    4.519168]  (driver?)
[    4.524301] 1f06             960 mtdblock6 [    4.525517]  (driver?)
[    4.530648] 1f07              64 mtdblock7 [    4.531878]  (driver?)
[    4.536993] 1f08              64 mtdblock8 [    4.538208]  (driver?)
[    4.543338] 1f09           57344 mtdblock9 [    4.544555]  (driver?)
[    4.549685] fe00            2480 ubiblock0_2 [    4.550902]  (driver?)
[    4.556204] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,9)
[    4.557440] CPU2: stopping
[    4.565674] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.86 #0
[    4.568452] Hardware name: Generic DT based system
[    4.574300] [<c0215618>] (unwind_backtrace) from [<c0212010>] (show_stack+0x10/0x14)
[    4.579146] [<c0212010>] (show_stack) from [<c0394dd4>] (dump_stack+0x7c/0x9c)
[    4.587043] [<c0394dd4>] (dump_stack) from [<c021498c>] (handle_IPI+0xdc/0x184)
[    4.594073] [<c021498c>] (handle_IPI) from [<c0209424>] (gic_handle_irq+0x80/0x8c)
[    4.601279] [<c0209424>] (gic_handle_irq) from [<c021298c>] (__irq_svc+0x6c/0x90)
[    4.608908] Exception stack(0xcf86df90 to 0xcf86dfd8)
[    4.616460] df80:                                     00000001 00000000 00000000 c021a4c0
[    4.621503] dfa0: ffffe000 00000000 c075efe4 00000004 00000000 c075f034 c0758a30 00000001
[    4.629662] dfc0: 00000002 cf86dfe0 c020f5b4 c020f5a4 60000013 ffffffff
[    4.637825] [<c021298c>] (__irq_svc) from [<c020f5a4>] (arch_cpu_idle+0x1c/0x38)
[    4.644248] [<c020f5a4>] (arch_cpu_idle) from [<c024f5c8>] (cpu_startup_entry+0x108/0x1ac)
[    4.651886] [<c024f5c8>] (cpu_startup_entry) from [<802094cc>] (0x802094cc)
[    4.659949] CPU3: stopping
[    4.666803] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.9.86 #0
[    4.669579] Hardware name: Generic DT based system
[    4.675414] [<c0215618>] (unwind_backtrace) from [<c0212010>] (show_stack+0x10/0x14)
[    4.680272] [<c0212010>] (show_stack) from [<c0394dd4>] (dump_stack+0x7c/0x9c)
[    4.688168] [<c0394dd4>] (dump_stack) from [<c021498c>] (handle_IPI+0xdc/0x184)
[    4.695198] [<c021498c>] (handle_IPI) from [<c0209424>] (gic_handle_irq+0x80/0x8c)
[    4.702405] [<c0209424>] (gic_handle_irq) from [<c021298c>] (__irq_svc+0x6c/0x90)
[    4.710034] Exception stack(0xcf86ff90 to 0xcf86ffd8)
[    4.717588] ff80:                                     00000001 00000000 00000000 c021a4c0
[    4.722634] ffa0: ffffe000 00000000 c075efe4 00000008 00000000 c075f034 c0758a30 00000001
[    4.730789] ffc0: 00000003 cf86ffe0 c020f5b4 c020f5a4 60000013 ffffffff
[    4.738954] [<c021298c>] (__irq_svc) from [<c020f5a4>] (arch_cpu_idle+0x1c/0x38)
[    4.745374] [<c020f5a4>] (arch_cpu_idle) from [<c024f5c8>] (cpu_startup_entry+0x108/0x1ac)
[    4.753012] [<c024f5c8>] (cpu_startup_entry) from [<802094cc>] (0x802094cc)
[    4.761077] CPU0: stopping
[    4.767930] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.86 #0
[    4.770706] Hardware name: Generic DT based system
[    4.776540] [<c0215618>] (unwind_backtrace) from [<c0212010>] (show_stack+0x10/0x14)
[    4.781403] [<c0212010>] (show_stack) from [<c0394dd4>] (dump_stack+0x7c/0x9c)
[    4.789296] [<c0394dd4>] (dump_stack) from [<c021498c>] (handle_IPI+0xdc/0x184)
[    4.796328] [<c021498c>] (handle_IPI) from [<c0209424>] (gic_handle_irq+0x80/0x8c)
[    4.803536] [<c0209424>] (gic_handle_irq) from [<c021298c>] (__irq_svc+0x6c/0x90)
[    4.811162] Exception stack(0xc075df60 to 0xc075dfa8)
[    4.818722] df60: 00000001 00000000 00000000 c021a4c0 ffffe000 00000000 c075efe4 00000001
[    4.823760] df80: 00000000 c075f034 c0758a30 00000001 00000000 c075dfb0 c020f5b4 c020f5a4
[    4.831911] dfa0: 60000013 ffffffff
[    4.840076] [<c021298c>] (__irq_svc) from [<c020f5a4>] (arch_cpu_idle+0x1c/0x38)
[    4.843379] [<c020f5a4>] (arch_cpu_idle) from [<c024f5c8>] (cpu_startup_entry+0x108/0x1ac)
[    4.851023] [<c024f5c8>] (cpu_startup_entry) from [<c071fc0c>] (start_kernel+0x368/0x3ec)
[    4.859092] [<c071fc0c>] (start_kernel) from [<8020807c>] (0x8020807c)
[    4.867332] Rebooting in 1 seconds..

Tim

That didn't work either. I don't see a reflection of those DTS changes in the running system (I did a 'make clean' first).

I made the partition layout like this:
partition0@0 {
label = "kernel";
reg = <0x00000000 0x03800000>;
};
partition1@3800000 {
label = "ubi";
reg = <0x03800000 0x07000000>;
};
partition2@7000000 {
label = "var_config";
reg = <0x07000000 0x00f00000>;
read-only;
};
partition3@7f00000 {
label = "Oops_log";
reg = <0x07f00000 0x000c0000>;
read-only;
};

The kernel doesn't seem to see the UBI volumes. The UBI driver see's that there are 4 volumes, but the next step just lists them all as 'ubiblock0_2', under all the mtdblocks.

The fact it says 'driver?' there could possibly mean it doesn't have a driver for those filesystems?

The relevant parts (I think) in my bootlog are:

[    2.037274] 1 ofpart partitions found on MTD device spi0.1
[    2.037299] Creating 1 MTD partitions on "spi0.1":
[    2.041677] 0x000000000000-0x000003800000 : "rootfs"
[    2.047779] mtd: device 9 (rootfs) set to be root filesystem
[    2.053787] mtdsplit: no squashfs found in "rootfs"
[    2.058243] NET: Registered protocol family 10
[    2.063205] NET: Registered protocol family 17
[    2.066516] 8021q: 802.1Q VLAN Support v1.8
[    2.070776] Registering SWP/SWPB emulation handler
[    2.078672] ubi0: attaching mtd9
[    4.346550] ubi0: scanning is finished
[    4.404083] ubi0: attached mtd9 (name "rootfs", size 56 MiB)
[    4.404116] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.408812] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.415534] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.422385] ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
[    4.429124] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[    4.435394] ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1011195579
[    4.442427] ubi0: available PEBs: 0, total reserved PEBs: 448, PEBs reserved for bad PEB handling: 20
[    4.451738] ubi0: background thread "ubi_bgt0d" started, PID 105
[    4.456222] block ubiblock0_2: created from ubi0:2�[    4.478696] List of all partitions:
[    4.478742] 1f00             256 mtdblock0 [    4.480989]  (driver?)
[    4.486204] 1f01             128 mtdblock1 [    4.487421]  (driver?)
[    4.492570] 1f02             384 mtdblock2 [    4.493769]  (driver?)
[    4.498896] 1f03              64 mtdblock3 [    4.500114]  (driver?)
[    4.505242] 1f04              64 mtdblock4 [    4.506460]  (driver?)
[    4.511600] 1f05              64 mtdblock5 [    4.512805]  (driver?)
[    4.517933] 1f06             960 mtdblock6 [    4.519151]  (driver?)
[    4.524279] 1f07              64 mtdblock7 [    4.525496]  (driver?)
[    4.530624] 1f08              64 mtdblock8 [    4.531859]  (driver?)
[    4.536969] 1f09           57344 mtdblock9 [    4.538188]  (driver?)
[    4.543316] fe00            2480 ubiblock0_2 [    4.544535]  (driver?)
[    4.549831] No filesystem could mount root, tried: [    4.551055]  squashfs
[    4.556868] 
[    4.558097] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,9)

Then change it back to layout before.
It has the driver,but it does not see where to load kernel and rootfs.

Why dont you just change default bootcmd to bootm and kernel location?
That would bypass bootipq completely,and also bootipq should be in GPL

I am using bootm. I'm loading the kernel from the 'kernel' UBI volume, then booting the address it's loaded to.

'bootipq' is indeed a Netgear script, which I can't find anywhere, but I've managed to replicate the messages I see in uboot.

This is what I'm doing in uboot (which can be turned into a script and saved in the environment):
Associate NAND1 chip with mtd:
setenv mtdids nand1=mtd0

Set the partition layout in variable mtdparts:
setenv mtdparts mtdparts=mtd0:56m(rootfs),56m(rootfs_1),15m(var_config),768k(Oops_log)

Initialise the UBI volumes on mtd with label 'rootfs', with VID header offset 2048:
ubi part rootfs 2048

Read ubi volume 'kernel' into RAM address 0x84000000
ubi read 0x84000000 kernel

Set kernel bootargs to load UBI device on mtd partition 'rootfs'
setenv bootargs ubi.mtd=rootfs

Load the application at start of free RAM (0x84000000):
bootm

Then the kernel loads, along with it's DTS. I think (like you imply), my bootargs variable needs to have the exact location of the rootfs. I think it has that, so now I'm trying to see what's on the other UBI volumes to make sure there is an actual rootfs there, and something else hasn't gone wrong..

Tim

You really dont need to chang mtdparts since kernel ignores those.
Can you simply try using bootm 0x84000000
That should load the kernel and kernel will find rootfs

The 0x84000000 address is the RAM, not the flash. That's where I've been tftpboot'ing my initramfs images. It's not where the kernel is stored. The kernel and rootfs are in UBI volumes.

I need to assign mtdparts and mtdids because otherwise uboot doesn't see the UBI partition, and the ubi commands to load the kernel do not work.

My suspicion is that the rootfs isn't being written to where I think it is... I'm still investigating..

I'll make my previous post more verbose about why I'm running those commands..

Tim

Interestingly, using my method above I cannot get the secondary Netgear failsafe firmware to boot. It fails with the same error. But, if I run the normal 'bootipq', it boots up the failsafe normally.

That means I'm missing a step in uboot which the bootipq script is running.

All I can find in the GPL source from Netgear is a uboot patch to add some tweaks to the bootipq function. The files the patch applies to do not exist. The file which the patch mentions is cmd_bootqca.c. Have you come across this file before? I cannot find it anywhere..

Tim