There's a config file I'm missing somewhere that bootipq is using.
If I try running the stock 'bootipq' against the new kernel/rootfs, it bails out like this:
(IPQ40xx) # bootipq
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done
Boot count=1
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000003800000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 56 MiB
UBI: number of good PEBs: 448
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 4
UBI: available PEBs: 16
UBI: total number of reserved PEBs: 432
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 3/1
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (2920448)
Config not availabale
bootipq failed!!
resetting ...
That config file crops up when I try booting the recovery firmware:
(IPQ40xx) # bootipq
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done
Boot count=2
Creating 1 MTD partitions on "nand1":
0x000003800000-0x000007000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 56 MiB
UBI: number of good PEBs: 448
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 2
UBI: available PEBs: 210
UBI: total number of reserved PEBs: 238
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 1/0
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (3682304)
Booting kernel from FIT Image at 84000000 ...
Using 'config@5' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-3.14.43
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3280614 Bytes = 3.1 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: d45cb75b
Hash algo: sha1
Hash value: 7d0f77af6009e920da10a169d0ed1b62793326d2
Verifying Hash Integrity ... crc32+ sha1+ OK
Flattened Device Tree from FIT Image at 84000000
Using 'config@5' configuration
Trying 'fdt@5' FDT blob subimage
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84345b90
Data Size: 32664 Bytes = 31.9 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 12ad0337
Hash algo: sha1
Hash value: a0f533bcbdc5eea1bfd8afe488d5c6e33617d5be
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x84345b90
Uncompressing Kernel Image ... OK
Loading Device Tree to 86ff5000, end 86ffff97 ... OK
Using machid 0x8010100 from environment
Starting kernel ...
That's the part I'm missing - that 'config@5' part. If I try manually booting the recovery firmware, it fails because it's using the wrong config file:
(IPQ40xx) # ubi read 0x84000000 kernel
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (2920448)
(IPQ40xx) # bootm
Booting kernel from FIT Image at 84000000 ...
Using 'config@1' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-4.9.86
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 2763349 Bytes = 2.6 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: 2250ad7e
Hash algo: sha1
Hash value: 422cdbe798cc33a8f5a341e6526b152d2f870cc9
Verifying Hash Integrity ... crc32+ sha1+ OK
Flattened Device Tree from FIT Image at 84000000
Using 'config@1' configuration
Trying 'fdt@1' FDT blob subimage
Description: ARM OpenWrt netgear_wac510 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842a2c74
Data Size: 34034 Bytes = 33.2 KiB
Architecture: ARM
Hash algo: crc32
Hash value: c9cee5a1
Hash algo: sha1
Hash value: 56fcd1b6cbee8e6f9b61d6c4bacea03b3cd5b5c5
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x842a2c74
Uncompressing Kernel Image ... OK
Loading Device Tree to 86ff4000, end 86fff4f1 ... OK
Using machid 0x8010100 from environment
Starting kernel ...
More digging...
Tim