sysupgrade: add NAND flash support#2012
Closed
widgetii wants to merge 2 commits into
Closed
Conversation
The sysupgrade script previously hardcoded NOR/squashfs firmware downloads and used flashcp for all flash types. This bricks NAND cameras which boot with rootfstype=ubifs, since flashing squashfs to a UBI volume produces an unmountable rootfs. Changes: - download_firmware: select nand package when ipcinfo -F reports nand - do_update_kernel: use flash_eraseall + nandwrite for NAND partitions - do_update_rootfs_nand: new function that pivot_roots to tmpfs, detaches UBI, erases the MTD partition, and writes the UBI image with nandwrite before rebooting - do_wipe_overlay: use ubiupdatevol -t for NAND overlay wipe instead of flash_eraseall -j which is JFFS2-specific Tested on hi3516av200 with 128MB SPI NAND, upgrading from OpenIPC 2.2 (Nov 2022) to 2.6 (Apr 2026) successfully. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Re-attaching UBI after nandwrite to restore overlay data causes image_seq mismatch — the rootfs_data autoresize writes PEBs with a different sequence number than the original rootfs.ubi image, resulting in kernel panic on boot (UBI attach fails). Add a warning that NAND rootfs update erases overlay data. Overlay preservation would require ubiupdatevol with a bare UBIFS image, which is not currently included in release packages. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ZigFisher
reviewed
Apr 16, 2026
ZigFisher
left a comment
ZigFisher
left a comment
Collaborator
There was a problem hiding this comment.
I think this will break sigmastar nand devices, the old solution was utilizing gluebi as compatibility layer to overwrite the partitions without ubi tools.
Member
Author
|
Are you comfortable making these changes only for HiSilicon devices, which I can currently test? |
7 tasks
Member
Author
|
Superseded by #2022, which is a comprehensive rework that addresses the data-loss issue called out in review:
See #2022 for the full design rationale and upgrade steps. |
widgetii
pushed a commit
that referenced
this pull request
Jun 19, 2026
Existing NAND sysupgrade was destructive: every -r wiped the entire UBI
MTD and the overlay with it. Adopt OpenWrt's nand.sh pattern and let
HiSilicon NAND survive upgrades the same way NOR does.
Flow on a NAND camera with ubiformat available (= post-this-PR firmware):
1. Build a tarball of /etc/passwd, /etc/dropbear, /etc/network,
/etc/majestic.yaml, /root, ... — defaults plus anything in
/etc/sysupgrade.conf or /lib/upgrade/keep.d/*.
2. Compute migrated bootargs (root=/dev/ubiblock0_0 rootfstype=squashfs
ubi.block=0,0 ubi.mtd=N,2048). Idempotent — empty result if already
migrated.
3. Pivot to a tmpfs new-root carrying busybox, ubiformat, fw_setenv,
/etc/fw_env.config, the new rootfs.ubi, and the user-data tarball.
4. ubidetach + 'ubiformat -y -f rootfs.ubi /dev/mtdN'. ubiformat is
the only primitive that handles erase-counter preservation and
writes a single fresh image_seq across every PEB, including the
ones autoresize will later claim. nandwrite fails this on reboot
with 'bad image sequence number' panics.
5. fw_setenv bootargs (post-flash, so a flash failure cannot brick
the env).
6. ubiattach, wait for autoresize to materialise rootfs_data, mount
it, drop /sysupgrade.tgz, ubidetach, reboot.
On first boot of the new firmware /init mounts rootfs_data, finds the
tarball, extracts it onto the overlay upper, removes the file, and
proceeds normally.
Existing UBIFS-rootfs cameras have no ubiformat. For that one-time
hop we fall back to flash_eraseall+nandwrite (the path PR #2012
introduced) and warn that user data is erased; subsequent upgrades on
the new firmware preserve it.
The previous PR-#2012 'overlay erased' warning is dropped — overlay is
preserved by default now. -n / --wipe_overlay opts in to wiping (it
skips the tarball step so rootfs_data is left empty after flash).
Other changes:
- general/overlay/init: regex broadened to also enter the UBI overlay
branch on squashfs+ubi.block= cmdlines, and a one-shot
/overlay/sysupgrade.tgz extractor added. The tarball is rm -f'd
after extraction so subsequent boots are no-ops.
- general/overlay/etc/sysupgrade.conf: new empty file so users can
drop additional paths to preserve without modifying the upgrader.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
widgetii
pushed a commit
that referenced
this pull request
Jun 19, 2026
Existing NAND sysupgrade was destructive: every -r wiped the entire UBI
MTD and the overlay with it. Adopt OpenWrt's nand.sh pattern and let
HiSilicon NAND survive upgrades the same way NOR does.
Flow on a NAND camera with ubiformat available (= post-this-PR firmware):
1. Build a tarball of /etc/passwd, /etc/dropbear, /etc/network,
/etc/majestic.yaml, /root, ... — defaults plus anything in
/etc/sysupgrade.conf or /lib/upgrade/keep.d/*.
2. Compute migrated bootargs (root=/dev/ubiblock0_0 rootfstype=squashfs
ubi.block=0,0 ubi.mtd=N,2048). Idempotent — empty result if already
migrated.
3. Pivot to a tmpfs new-root carrying busybox, ubiformat, fw_setenv,
/etc/fw_env.config, the new rootfs.ubi, and the user-data tarball.
4. ubidetach + 'ubiformat -y -f rootfs.ubi /dev/mtdN'. ubiformat is
the only primitive that handles erase-counter preservation and
writes a single fresh image_seq across every PEB, including the
ones autoresize will later claim. nandwrite fails this on reboot
with 'bad image sequence number' panics.
5. fw_setenv bootargs (post-flash, so a flash failure cannot brick
the env).
6. ubiattach, wait for autoresize to materialise rootfs_data, mount
it, drop /sysupgrade.tgz, ubidetach, reboot.
On first boot of the new firmware /init mounts rootfs_data, finds the
tarball, extracts it onto the overlay upper, removes the file, and
proceeds normally.
Existing UBIFS-rootfs cameras have no ubiformat. For that one-time
hop we fall back to flash_eraseall+nandwrite (the path PR #2012
introduced) and warn that user data is erased; subsequent upgrades on
the new firmware preserve it.
The previous PR-#2012 'overlay erased' warning is dropped — overlay is
preserved by default now. -n / --wipe_overlay opts in to wiping (it
skips the tarball step so rootfs_data is left empty after flash).
Other changes:
- general/overlay/init: regex broadened to also enter the UBI overlay
branch on squashfs+ubi.block= cmdlines, and a one-shot
/overlay/sysupgrade.tgz extractor added. The tarball is rm -f'd
after extraction so subsequent boots are no-ops.
- general/overlay/etc/sysupgrade.conf: new empty file so users can
drop additional paths to preserve without modifying the upgrader.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sysupgradepreviously hardcoded NOR/squashfs firmware downloads and usedflashcpfor all flash types, which bricks NAND cameras (boot expectsubifs, notsquashfs)download_firmware()now selects the correct NAND package ($soc-nand-$osr) whenipcinfo -Freportsnanddo_update_kernel()usesflash_eraseall+nandwrite -pfor NAND instead offlashcpdo_update_rootfs_nand()function: pivot_roots to tmpfs, detaches UBI, erases the MTD partition, writes the UBI image withnandwrite, and rebootsdo_wipe_overlay()usesubiupdatevol -tfor NAND overlay wipe instead offlash_eraseall -j(JFFS2-specific)Known limitation
NAND rootfs update erases the entire UBI partition, which includes both rootfs and rootfs_data (overlay). This means overlay data (settings, SSH keys, etc.) is lost during rootfs update. Preserving overlay would require
ubiupdatevolwith a bare UBIFS image, which is not currently included in release packages. Re-attaching UBI afternandwriteto restore overlay data is unsafe — it causesimage_seqmismatch and kernel panic.Test log (hi3516av200, 128MB SPI NAND)
sysupgrade -k -r -f -z output
Post-upgrade verification
Test plan
pivot_rootworks reliably/overlayafter upgrade)sysupgrade -n) on NAND🤖 Generated with Claude Code