Increasing EA8500 / EA7500 kernel size to enable builds?

The two culprit devices are EA8500 and EA7500-v1 due to their 3MiB KERNEL_SIZE limit.

Does this mean support for these devices will soon be reaching its end due to their size limitations?

Possibly.
It should be investigated, if similar solution could be done as we did for ipq806x R7800 and related: the kernel partition was enlarged to 4 MB in 2018. (The same was done for mvebu wrt32x and wrt1900acv1 recently.)

Disclaimer: I don't own any of these devices, so I'm guessing based on trying to help others with similar (non-ipq806x Linksys devices following a similar partitioning structure).

I would assume that the 3 MB limit is set in uboot-env, which makes it rather hard to change, as it would mean that only old factory image would be installable and the user having to modify uboot-env and then sysupgrading to a current OpenWrt (which also has some challenges, due to ubi on NAND). My guess is that these manual uboot-env changes would fix the problem, but it would require very careful experimentation (including where the actual size limits are).

Unfortunately the new builds won't help my EA8500 AP or anyone else with an EA8500 or EA7500v1.

These are very capable devices - sad to see them dropped right before 22.xx is tagged.

@slh @chunkeey - can the kernel be compressed to fit in 3 MB, or is that already done?

As you have one of those devices, you could test if you can modify the DTS and compile a version with 4 MB kernel partition (and 1 MB smaller rootfs space)

It succeeded well for R7800, and also for some Linksys mvebu devices.

(It is not always so tightly set in u-boot, but just an arbitrary selection in the OEM firmware and we have just taken the partitions from there. But like slh says, it is possible that it has been set in a more difficult way.)

I feel a little guilty suggesting this, but I would be happy to risk bricking my EA8500 trying a version someone else (See? There's that little guilty part :wink: ) compiles with a 4MB partition and report back success/fail? I've never compiled firmware before and fear it would be a long steep learning curve for me.

Check fw_printenv first.

@slh
Looks like somebody has put the ea8500 printenv output into wiki, and you were right: the u-boot variables so contain partition sizes/locations...

Edit:
But looking at the bootcmd, there is no reference to it.
The imgsize seems to be only used for the OEM flash commands.
I have no prior experience about this style, but from those variables I do not see direct harm from OpenWrt applying its own split.

1 Like

I can compile a modified image for you, but one difficulty is that both EA8500 and EA7500v1 are handled by the same .dtsi, so hopefully somebody else can test EA7500v1 ...

1 Like

Here your are, images for both EA8500 and EA7500v1 with 4 MB kernel.
Looking at the source code, the approach is somewhat different than with R7800, as the kernel size in DTS covers also the rootfs, so I only moved the rootfs to start 1 MB later and to be 1 MB smaller, and adjusted that also in the image recipe.

Note that you need to flash first the OpenWrt factory image.
(sysupgrade image does not modify the partitions.)

I have no idea if you need to revert to the OEM firmware for applying the factory image, or if you can use TFTP recovery or similar, or if the factory image can be flashed directly from OpenWrt. (hopefully you know your device...)

Later, once you have flashed the factory and you have the 4 MB partition structure, you should be able to normally sysupgrade further with the sysupgrade images.

Dropbox:
https://www.dropbox.com/sh/m4zqfevxhr9o3q7/AABOUr6FuJvWP5R1fm8CUneqa?dl=0

The commit with the changes is
https://github.com/hnyman/openwrt/commit/34bd1c5c6c1f39890512f60ed6986555be83544b

cc also to @chunkeey @slh

Ps. I do not have the devices, so image is 100% untested :wink:

3 Likes

I've installed the factory image from your dropbox and here are the results:

The output of fw_printenv on 21.02.1
BusyBox v1.33.1 (2021-11-07 18:21:40 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02.1, r16325-88151b8303
 -----------------------------------------------------
root@Burloga:~# fw_printenv
altkern=3780000
auto_recovery=yes
baudrate=115200
boot_ver=1.1.4
bootargs=console=ttyHSL1,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
ethaddr=xx
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=macan.bin
imgsize=2800000
ipaddr=192.168.1.1
loadaddr=42000000
machid=1260
netmask=255.255.255.0
partbootargs=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=14,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
partbootargs2=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=16,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
prikern=f80000
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial
boot_part_ready=3
boot_part=2
root@Burloga:~#
The output of fw_printenv on your image
login as: root
root@192.168.1.1's password:


BusyBox v1.35.0 (2022-02-22 17:50:22 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18949-c0849c1d9c
 -----------------------------------------------------
root@Burloga:~# fw_printenv
altkern=3780000
auto_recovery=yes
baudrate=115200
boot_ver=1.1.4
bootargs=console=ttyHSL1,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
ethaddr=xx
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=macan.bin
imgsize=2800000
ipaddr=192.168.1.1
loadaddr=42000000
machid=1260
netmask=255.255.255.0
partbootargs=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=14,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
partbootargs2=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=16,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
prikern=f80000
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial
boot_part_ready=3
boot_part=1
root@Burloga:~#

I've reverted back to 21.02 because I couldn't install any packages (kernel mismatches) and as this is my main router - I'll free it up for tomorrow so I could do additional tests if needed.

I don't actually care much about the fw_printenv, as we are not modifying them. (That was mostly for background info for checking the possible difficulties there, as suggested by slh)

The main question is that did you boot successfully? Apparently yes ( r18949-c0849c1d9c :wink:
Could you sysupgrade from that (with my sysupgrade image of r18949)?

What does the partition structure looks like ? The output of

  • df -h
  • cat /proc/mtd
  • ubinfo -a

(is there a difference compared to 21.02.1? There should be...)

Ps. and was your router 8500 or 7500v1?

@hnyman - outstanding! Thank you for building those images. I've got your factory and upgrade EA8500 files downloaded.

After reviewing how I did the initial EA8500 OpenWrt install, my plan is to coax the case open again and flash OEM version 1.1.3 (an older version that accepts OpenWrt factory) via USB to serial dongle and tftp.

Then I will flash the OpenWrt factory image that you graciously built from the old OEM firmware followed by sysupgrade and see how it goes. After confirming success and posting the before and after you requested, I'll leave the case open and your build on the device until the hopefully happy day I see your commit land in master.

With that, I'm going to leave you (and me) in suspense until tomorrow. It's getting late in my evening to start this tonight after a longer than expected day.

Thank you again for your efforts, plus moving this topic to its own thread.

EDIT:
It occurs to me that if OpenWrt can flash its own factory image, it would be superfluous to reinstall the OEM firmware first (I already have OpenWrt installed on the EA8500 in question, as would most users). Reflashing the OEM via tftp first seems safest to me, as that is how I originally installed OpenWrt factory, but if someone can comment on whether this is unnecessary, I could instead test a straight flash of the new OpenWrt factory with a larger kernel partition from the presently installed OpenWrt with the smaller 3MB kernel partition. I'd rather test and demonstrate a process that will be simpler for many other users than test a more complicated approach that re flashes OEM, if that is unnecessary. Comments welcome.

The Ubiquiti Edgerouter X has a 3MB MTD device and due to the size check with KERNEL_SIZE, the "factory" image is not built as the kernel has gotten to be ~4.8MB.

A solution with that device is to build a slimmed down kernel, build the factory file, flash the factory file, then sysupgrade to the full kernel. Details about the build options I used can be found here: https://github.com/openwrt/openwrt/issues/5090 I got it down to ~2.7MB.

TBH I don't quite understand why the full kernel is able to be used when the MTD size is still 3MB, but it seems to work.

Looking at the images with a hex editor, the factory image does not start with the OEM header (like e.g. Netgear firmware formats typically do), but starts directly with the kernel partition. That makes is easier to use the OpenWrt sysupgrade for flashing. (The same is true with Linksys WRT1900AC, WRT3200ACM etc., so you can use sysupgrade -F for factory)

You could try sysupgrade force without settings for the factory image.
Use sysupgrade -F -n or in LuCI uncheck "keep settings" and say yes to "force" once the image check fails.

Alternatively, using the OEM TFTP or (old) OEM firmware to flash should work.

Note that @t3hn00b was able to flash somehow...

I just loaded the factory image from the ui forcing the upgrade

The output of the commands on 21.02
root@Burloga:~# cat /etc/banner
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02.1, r16325-88151b8303
 -----------------------------------------------------
root@Burloga:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                   106.6M    304.0K    106.3M   0% /tmp
/dev/ubi0_1              25.3M    404.0K     23.6M   2% /overlay
overlayfs:/overlay       25.3M    404.0K     23.6M   2% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@Burloga:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02500000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02500000 00020000 "rootfs2"
mtd17: 00100000 00020000 "sysdiag"
mtd18: 01f80000 00020000 "syscfg"
root@Burloga:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     296 (37584896 bytes, 35.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            246:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        30 LEBs (3809280 bytes, 3.6 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 246:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        242 LEBs (30728192 bytes, 29.3 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 246:2
root@Burloga:~#
Just the factory image
BusyBox v1.35.0 (2022-02-22 17:50:22 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18949-c0849c1d9c
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 6.3M      6.3M         0 100% /rom
tmpfs                   105.9M    252.0K    105.6M   0% /tmp
/dev/ubi0_1              22.2M     52.0K     21.0M   0% /overlay
overlayfs:/overlay       22.2M     52.0K     21.0M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02400000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02400000 00020000 "rootfs2"
mtd17: 00100000 00020000 "sysdiag"
mtd18: 01f80000 00020000 "syscfg"
root@OpenWrt:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     288 (36569088 bytes, 34.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            247:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        50 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 247:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        214 LEBs (27172864 bytes, 25.9 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 247:2
root@OpenWrt:~#
After the sysupgrade
BusyBox v1.35.0 (2022-02-22 17:50:22 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18949-c0849c1d9c
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 6.3M      6.3M         0 100% /rom
tmpfs                   105.9M    248.0K    105.6M   0% /tmp
/dev/ubi0_1              22.2M     60.0K     20.9M   0% /overlay
overlayfs:/overlay       22.2M     60.0K     20.9M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02400000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02400000 00020000 "rootfs2"
mtd17: 00100000 00020000 "sysdiag"
mtd18: 01f80000 00020000 "syscfg"
root@OpenWrt:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     288 (36569088 bytes, 34.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            247:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        50 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 247:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        214 LEBs (27172864 bytes, 25.9 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 247:2
root@OpenWrt:~#

(Edited to have code blocks)
Edit: It's a Linksys EA7500v1 as I have forgotten to write that

Good to know.

The partitions looks ok to me, both after the factory flash and the sysupgrade flash.

And good that your device is 7500v1, so if @eginnc tests 8500, we should be good to go.

Looks like we are good to go then.

I flashed the new factory image on my spare EA8500 command line with "sysupgrade -F -n". The EA8500 was connected by Ethernet cable to another router on my home lan subnet (not 192.168.x.x) at time of flashing.

After a good long wait profitably used getting a cup of coffee, I could not ssh into the device at 192.168.1.1 after connecting it by ethernet cable to a PC (tried plugging it in again) that was also on my home wireless lan, so I powered the EA8500 off, then back on. After which, I could ssh into the device at 192.168.1.1 just fine from the PC without having to set a static 192.168.1.x IP on the PC. For clarity, it did boot up the new test r18949-c0849c1d9c factory image, not a different older image left on a second backup recovery partition.

Next I scp'd the new sysupgrade to the device, flashed it with "sysupgrade -v" and ssh'd back into the EA8500 without incident (no power down or Ethernet cable re-plugging needed), which again reported version r18949-c0849c1d9c. Success!

Results of requested commands on my other EA8500 running the last compiled snapshot image (not yours):

BusyBox v1.35.0 (2022-02-11 22:17:40 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18795-c391dcdf86
 -----------------------------------------------------
root@EA8500:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                   232.6M      1.3M    231.3M   1% /tmp
/dev/ubi0_1              25.3M     10.8M     13.2M  45% /overlay
overlayfs:/overlay       25.3M     10.8M     13.2M  45% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@EA8500:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02500000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02500000 00020000 "rootfs2"
mtd17: 02080000 00020000 "syscfg"
root@EA8500:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     296 (37584896 bytes, 35.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     35
Minimum input/output unit size:          2048 bytes
Character device major/minor:            246:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        30 LEBs (3809280 bytes, 3.6 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 246:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        242 LEBs (30728192 bytes, 29.3 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 246:2
root@EA8500:~#  

After flashing the new sysupgrade image:

BusyBox v1.35.0 (2022-02-22 17:50:22 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18949-c0849c1d9c
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# df-h
-ash: df-h: not found
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 6.3M      6.3M         0 100% /rom
tmpfs                   232.7M     72.0K    232.6M   0% /tmp
/dev/ubi0_1              22.2M     60.0K     20.9M   0% /overlay
overlayfs:/overlay       22.2M     60.0K     20.9M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02400000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02400000 00020000 "rootfs2"
mtd17: 02080000 00020000 "syscfg"
root@OpenWrt:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     288 (36569088 bytes, 34.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     10
Minimum input/output unit size:          2048 bytes
Character device major/minor:            247:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        50 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 247:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        214 LEBs (27172864 bytes, 25.9 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 247:2
root@OpenWrt:~#

And just to be complete, after just flashing the new factory image:

BusyBox v1.35.0 (2022-02-22 17:50:22 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18949-c0849c1d9c
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 6.3M      6.3M         0 100% /rom
tmpfs                   232.7M     80.0K    232.6M   0% /tmp
/dev/ubi0_1              22.2M     52.0K     21.0M   0% /overlay
overlayfs:/overlay       22.2M     52.0K     21.0M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02400000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02400000 00020000 "rootfs2"
mtd17: 02080000 00020000 "syscfg"
root@OpenWrt:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     288 (36569088 bytes, 34.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            247:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        50 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 247:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        214 LEBs (27172864 bytes, 25.9 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 247:2
root@OpenWrt:~# 

Hi Guys
not sure how the duel boot side of this all works
but if there is going to be partitions changes for v22
i'll throw this out there as idea atm

is it conceivable as UBI has it's own error correction
that both areas of rootfs1 & rootfs2 can be concatenated
so we would end up with 2x36M (72M)
even if flash file size is limited to 4+36M
can leave the 2 copy of the kernels & boot from ether
but would both access the same fixed location UBI concatenation

not sure how this will effect sysupgrade & making sure both kernels are the same
but the good thing would be with the same UBI's no matter witch kernel booted
the config would be the same with double the space for programs like Samba4 etc

That would not work.
It is not only about kernel, but also the installed add-on packages and settings are release-specific. All those are in the rootfs. If there is dual-boot with two different kernels, you also need two separate rootfs instances for them.