I am also experiencing the same issue. I tried mounting the MTD and created a UBI volume. I can successfully access this space, but I don’t know how to use it as extroot. One thing I’ve noticed is that after every reboot, the MTD block needs to be manually mounted.otherwise, I can’t access the UBI partition
Which device are you talking about? which mtd did you format ok (with ubiformat /dev/mtdX, where X is 10 for "data" and 11 for "fota" in case o MF286D)? If you have MF286D do you have a backup of mtd10("data")? I only have backup of mtd11("fota"), I don't seem to need it for anything and I failed to restore it with either mtd write /tmp/fota_backup.bin fota or dd if=/tmp/fota_backup.bin of=/dev/mtd11((
I think the strategy for using extra available space is to identify mtd that can be used (in my case preferable option is mtd11) -> then ubiformat /dev/mtdX and ubiattach -m X (this command will attach ubi1, since you already have ubi0) -> ubimkvol /dev/ubi1 -N extroot -m (creates volume with name extroot and maximum available space) -> format with mkfs.ubifs newly created volume ubi1_0 (I guess, I did not get this far) -> proceed with regular extroot article.
These are just my intuitive thoughts and what I found from AI suggestions, I have not done this before with NAND flash and ubi partition and also need guidence.
I have an AW1000 router, but I'm stuck with the same problem you're experiencing. With the custom firmware and some additional packages, I only have around 4 MB of free space left.
Since this device has a 1 GB NAND, I checked my MTD layout and noticed the following:
cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00040000 "0:sbl1"
mtd1: 00100000 00040000 "0:mibib"
mtd2: 00080000 00040000 "0:bootconfig"
mtd3: 00080000 00040000 "0:bootconfig1"
mtd4: 00300000 00040000 "0:qsee"
mtd5: 00300000 00040000 "0:qsee_1"
mtd6: 00080000 00040000 "0:devcfg"
mtd7: 00080000 00040000 "0:devcfg_1"
mtd8: 00080000 00040000 "0:apdp"
mtd9: 00080000 00040000 "0:apdp_1"
mtd10: 00080000 00040000 "0:rpm"
mtd11: 00080000 00040000 "0:rpm_1"
mtd12: 00080000 00040000 "0:cdt"
mtd13: 00080000 00040000 "0:cdt_1"
mtd14: 00080000 00040000 "0:appsblenv"
mtd15: 00100000 00040000 "0:appsbl"
mtd16: 00100000 00040000 "0:appsbl_1"
mtd17: 00080000 00040000 "0:art"
mtd18: 06400000 00040000 "rootfs"
mtd19: 01880000 00040000 "0:wififw"
mtd20: 06400000 00040000 "rootfs_1"
mtd21: 01880000 00040000 "0:wififw_1"
mtd22: 00240000 00040000 "0:ethphyfw"
mtd23: 00100000 00040000 "0:board_data"
mtd24: 00800000 00040000 "0:arc_datadump"
mtd25: 2cbc0000 00040000 "0:arc_data"
root@Telstra_5G:~#
mtd25: 2cbc0000 00040000 "0:arc_data"
approximately 716 MB appears to be unused.
I can format and mount this partition in OpenWrt without any issues. However, I haven’t been able to find any proper tutorial on how to use this partition as extroot, which seems to be the same issue you're facing.
Correct me if I’m wrong.
As far as I understand, OpenWrt uses the rootfs (SquashFS) as /rom, and the remaining writable space becomes /overlay. So, if we could somehow merge another MTD partition with the rootfs, we might be able to increase the available space for /overlay.
I saw that you previously merged the data and fota partitions, but you didn’t modify the rootfs. That might be why you still have only around 14.52 MiB available on /overlay, right?
It is similar, however in your case if you can format and attach mtd25 without any negative effects you should deffinitelly go with "extroot" approach! In my case, I get all bad blocks when trying of format mtd11, which is only 50MiB, and I would be glad if I could at lease use this 50MiB as extroot.
in my case merging my mtd10 and mtd11 took modifing DTS file and building custom sysupgrade file, as they are close together. However this procedure took me ages, fiddling with VBox Ubuntu and then Debian virtual machines, lots of failed attempts of building images (I guess due to allocating only fixed 40Gb of drive to linux virtual machine). Not to mention that it is rather risky - the reason I did not brick my router is perhaps due to the fact that I only merged mtd10 and mtd11, thinking that installation of openwrd resides in mtd10. However kernel, rootfs and rootfs_data (where, I guess, overlay resides) is actully written to mtd9!
I don't think MTD11 can be used in any way because it's full of bad blocks. I also have a few bad blocks.four, to be exact,but that's not a problem since UBI can handle them. However, in your case, MTD11 is filled with bad blocks. So, using only MTD10 along with MTD9 (rootfs) is your only option i think. You can get an extra 25 MB that way.
Yes, but the problem I’m having is that I tried using the extroot approach, and it didn’t work.
it is not just full of bad blocks it is only bad blocks now!!! AI suggests that it could be due to "bad memory mapping/allocation", but I am back on openwrt official FW, the same FW I previouly used to make a dump of mtd11 via GUI. I looked inside file with Notepad++ and there is sensible content there. I definitelly could not physically damage the chip! @frollic, @Leo-PL, why do you think this might have happened?
@Leo-PL suggests that this way I will surely brick router, so I would like to avoid this approach, although I don't mind disassambly the unit and solder three wires to get serial connection, I definitelly don't want to desolder the NAND chip, besides I don't have the its full dump and don't know where to get it.
I can try to use my mtd10(25MiB) for extroot, it is of little use to me but in case of success I will document it and share it here...
1 Like
ad 1: probably just needs to be erased before formatting as separate UBI partition
ad 2: if we can compile upstream U-boot to replace vendor one, then we can merge both partitions, so U-boot and OpenWrt are on the same page and share the layout.
I hope this clears up the understanding.
Here is what I get, when I try to erase flash by all commands suggested by AI:
root@OpenWrt:~# flash_erase /dev/mtd11 0 0
-ash: flash_erase: not found
root@OpenWrt:~# mtd erase /dev/mtd11
Unlocking /dev/mtd11 ...
Erasing /dev/mtd11 ...
Skipping bad block at 0x0
Skipping bad block at 0x20000
Skipping bad block at 0x40000
...
Skipping bad block at 0x31c0000
Skipping bad block at 0x31e0000 root@OpenWrt:~#
Or should I do the erase procedure under different environment?
I don't even have an idea where to start there, but if anyone more competent can help or guide I will participate to most of my abilities.
no luck so far guys, after formating mtd10, attaching it to ubi and making volume:
ubiformat /dev/mtd10
ubiattach -m 10
ubimkvol /dev/ubi1 -N extroot m
I get this volume:
ubi1
Volumes count: 1
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 200 (25395200 bytes, 24.2 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 20
Current maximum erase counter value: 11
Minimum input/output unit size: 2048 bytes
Character device major/minor: 244:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 176 LEBs (22347776 bytes, 21.3 MiB)
State: OK
Name: extroot
Character device major/minor: 244:1
However it disappears upon reboot(((
@frollic, any idea what am I doing wrong?
I took a look at implementation of ZTE MF269 and it gave me an idea… partition@23c0000 {
label = "ubi_kernel";
reg = <0x23c0000 0x3400000>;
};
partition@57c0000 {
label = "0:wififw";
reg = <0x57c0000 0x0800000>;
read-only;
};
/* rootfs partition is the result of squashing
* consecutive stock partitions:
* - openwrt_data (25 MiB)
* - data (30 MiB)
* - fota (99 MiB)
*/
partition@5fc0000 {
label = "rootfs";
reg = <0x5fc0000 0x9a00000>;
Stay tuned.
Now likely you just need to attach it manually during startup using some script calling ubiattach, then mount a volume - OpenWrt relies on special names given to partitions in device tree to attach filesystems, and I know of no definition for overlay here, at least at the time being.
1 Like
As you earlier warned substituting:
partition@1800000 {
label = "rootfs";
reg = <0x1800000 0x1d00000>;
};
partition@3500000 {
label = "data";
reg = <0x3500000 0x1900000>;
};
partition@4e00000 {
label = "fota";
reg = <0x4e00000 0x3200000>;
};
for:
partition@1800000 {
label = "rootfs";
reg = <0x1800000 0x6800000>;
};
did not give any desirable result. After running:
setenv serverip 192.168.1.3
setenv ipaddr 192.168.1.72
set fdt_high 0x85000000
tftp openwrt-24.10.2-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb
bootm $loadaddr
I was able to log in, but after running sysupgrade image OPENWRT would not start:
[ 178.927563] ubi0: attaching mtd9
[ 179.228507] ubi0 error: 0xc078a898: bad image sequence number 958018122 in PEB 232, expected 1082061698
[ 179.228581] Erase counter header dump:
[ 179.236788] magic 0x55424923
[ 179.240584] version 1
[ 179.244288] ec 11
[ 179.247324] vid_hdr_offset 2048
[ 179.250300] data_offset 4096
[ 179.253662] image_seq 958018122
[ 179.256872] hdr_crc 0xd463771a
[ 179.260456] erase counter header hexdump:
[ 179.264325] ubi0 error: 0xc077f360: failed to attach mtd9, error -22
[ 179.746658] ubi0: attaching mtd9
[ 180.048032] ubi0 error: 0xc078a898: bad image sequence number 958018122 in PEB 232, expected 1082061698
[ 180.048106] Erase counter header dump:
[ 180.056306] magic 0x55424923
[ 180.060109] version 1
[ 180.063813] ec 11
[ 180.066848] vid_hdr_offset 2048
[ 180.069825] data_offset 4096
[ 180.073189] image_seq 958018122
[ 180.076398] hdr_crc 0xd463771a
[ 180.079979] erase counter header hexdump:
[ 180.083849] ubi0 error: 0xc077f360: failed to attach mtd9, error -22
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Thu Jan 1 00:03:00 UTC 1970 upgrade: Sending TERM to remaining processes ...
Thu Jan 1 00:03:04 UTC 1970 upgrade: Sending KILL to remaining processes ...
[ 190.913564] stage2 (2828): drop_caches: 3
Thu Jan 1 00:03:10 UTC 1970 upgrade: Switching to ramdisk...
Thu Jan 1 00:03:13 UTC 1970 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
[ 193.909075] ubi0: attaching mtd9
[ 194.210861] ubi0 error: 0xc078a898: bad image sequence number 958018122 in PEB 232, expected 1082061698
[ 194.210940] Erase counter header dump:
[ 194.219094] magic 0x55424923
[ 194.222959] version 1
[ 194.226645] ec 11
[ 194.229704] vid_hdr_offset 2048
[ 194.232634] data_offset 4096
[ 194.236021] image_seq 958018122
[ 194.239233] hdr_crc 0xd463771a
[ 194.242808] erase counter header hexdump:
[ 194.246688] ubi0 error: 0xc077f360: failed to attach mtd9, error -22
ubiattach: error!: cannot attach mtd9
error 22 (Invalid argument)
ubiformat: mtd9 (nand), size 109051904 bytes (104.0 MiB), 832 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
ubiformat: formatting eraseblock[ 195.529268] ubi0: attaching mtd9
ubiformat: formatting e[ 196.295979] ubi0: scanning is finished
[ 196.309198] ubi0 warning: 0xc07846d8: number of bad PEBs (398) is above the expected limit (20), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)
[ 196.310040] ubi0: attached mtd9 (name "rootfs", size 104 MiB)
[ 196.323715] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 196.329490] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 196.336275] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 196.343134] ubi0: good PEBs: 434, bad PEBs: 398, corrupted PEBs: 0
[ 196.349898] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 196.356141] ubi0: max/mean erase counter: 12/3, WL threshold: 4096, image sequence number: 875680335
[ 196.363361] ubi0: available PEBs: 430, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 196.372667] ubi0: background thread "ubi_bgt0d" started, PID 3549
UBI device number 0, total 434 LEBs (55107584 bytes, 52.5 MiB), available 430 LEBs (54599680 bytes, 52.0 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 27 LEBs (3428352 bytes, 3.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
[ 196.484259] block ubiblock0_1: created from ubi0:1(rootfs)
Volume ID 1, size 34 LEBs (4317184 bytes, 4.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 46854144
Volume ID 2, size 369 LEBs (46854144 bytes, 44.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[ 199.626166] reboot: Restarting system
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00126
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B - 262 - PBL, Start
B - 1342 - bootable_media_detect_entry, Start
B - 1684 - bootable_media_detect_success, Start
B - 1698 - elf_loader_entry, Start
B - 5105 - auth_hash_seg_entry, Start
B - 7270 - auth_hash_seg_exit, Start
B - 582910 - elf_segs_hash_verify_entry, Start
B - 701923 - PBL, End
B - 701947 - SBL1, Start
B - 792875 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 794348 - boot_flash_init, Start
D - 53149 - boot_flash_init, Delta
B - 851648 - boot_config_data_table_init, Start
D - 3858 - boot_config_data_table_init, Delta - (419 Bytes)
B - 858826 - clock_init, Start
D - 7552 - clock_init, Delta
B - 870854 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 874267 - sbl1_ddr_set_params, Start
B - 879363 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 883745 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13175 - sbl1_ddr_set_params, Delta
B - 897058 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 967304 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 982889 - Image Load, Start
D - 153147 - QSEE Image Loaded, Delta - (299560 Bytes)
B - 1136465 - Image Load, Start
D - 1445 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1146753 - Image Load, Start
D - 247647 - APPSBL Image Loaded, Delta - (507051 Bytes)
B - 1394797 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 1401001 - SBL1, End
D - 701161 - SBL1, Delta
S - Flash Throughput, 2012 KB/s (809078 Bytes, 402067 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Chaos Calmer 15.05.1,IPQ4019.ILQ.6.1.0.r2-00006-P-1] (Apr 19 2021 - 23:50:05)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
machid : 0x8010001
NAND: ID = 302012c
Vendor = 2c
Device = 1
ONFI device found
SF: Detected GD25Q16 with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 0
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0xff from 0x0
Press ESC to abort autoboot in 0 seconds
Creating 1 MTD partitions on "nand0":
0x000001800000-0x000003500000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI error: vtbl_check: volume table check failed: record 2, error 9
UBI error: ubi_init: cannot attach mtd2
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
UBI init error 22
(IPQ40xx) #
Luckaly, I was able to revert back to stock or to OWRT official sysupgrade image after.