sysupgrade: point a kernel-volume NAND camera at ipctool nand-migrate

[widgetii]

Problem

A NAND camera on the first FIT layout (kernel FIT volume + UBIFS rootfs + rootfs_data, gk7205v500 family, from #2526) is refused by sysupgrade since #2537. The only advice is "reinstall it from U-Boot", which needs a serial console. That isn't necessary: its U-Boot is a FIT NAND build of u-boot-xmedia that can ubifsload. OpenIPC/ipctool#243 adds ipctool nand-migrate, which moves such a camera to the current layout in place. It rewrites the rootfs, switches bootcmd to the current stock one and drops the kernel volume, keeping U-Boot and the settings.

This changes the ubifs-kvol refusal to name that command, with the U-Boot reinstall kept as the other option. A ubiblock camera on a SoC that moved keeps the old message unchanged: its U-Boot predates FIT, and nand-migrate refuses it. scr_version 1.0.71 → 1.0.72.

The command it names is available: OpenIPC/ipctool#243 is merged, and the latest release (2026-10-12 20:20 UTC), which the camera's ipctool stub (extutils) downloads, carries nand-migrate.

Hardware tested on

The one camera that was on this layout, Zenointel SD-2N-4G (gk7205v510, 10.216.128.86), was migrated with ipctool nand-migrate on real hardware: the evidence is in OpenIPC/ipctool#243. It has since been upgraded with sysupgrade on the new layout (its rootfs volume is now image-sized, and rootfs_data was recreated). So no camera is left on the old layout to print this message.

This change only alters what an already-refused run prints. The refusal conditions and the "nothing was written" path are unchanged. I exercised it on a QEMU replica (qemu-hisilicon gk7205v510) of that camera's own pre-migration flash: its U-Boot, env and three UBI volumes. Following the message there, with the released ipctool, completes the migration (below).

Evidence

bash .github/scripts/test_sysupgrade.sh: all checks pass. The two refusal tests now also assert which advice each layout gets:

ok   ubifs-kvol: refused before anything is touched, nand-migrate and reinstall link given
ok   ubiblock on gk7205v500: refused before anything is touched, reinstall link given
ok   ubiblock on gk7205v500 without ::restart: is refused too, not written through gluebi
All sysupgrade verification checks passed.

STRICT=1 test_shell_parse.sh: all parsed clean under busybox ash. STRICT=1 test_strip_shell_comments.sh: all checks passed.

Before (sysupgrade 1.0.71 from master, sysupgrade -r -z on the kvol replica):

This camera uses the retired NAND layout with a separate kernel volume; current images carry the kernel inside the rootfs. Reinstall it from U-Boot with the current NAND instructions: https://openipc.org/cameras/vendors/goke/socs/gk7205v500 -- nothing was written. Aborting.

After (1.0.72, same replica):

OpenIPC System Updater v1.0.72
This camera uses the retired NAND layout with a separate kernel volume; current images carry the kernel inside the rootfs. Move it over without a serial console: copy rootfs.ubifs.* from its -nand- package to /tmp and run 'ipctool nand-migrate /tmp/rootfs.ubifs.<soc>' (it keeps U-Boot and the settings, and reboots), or reinstall it from U-Boot: https://openipc.org/cameras/vendors/goke/socs/gk7205v500 -- nothing was written. Aborting.
# ubinfo -a | grep Name:
Name:        kernel
Name:        rootfs
Name:        rootfs_data

Following it, with the released ipctool (UPX build, fetched by the ipctool stub):

# ipctool nand-migrate /tmp/rootfs.ubifs.gk7205v500
Camera: retired NAND layout, UBI device ubi0 on mtd2
  kernel ubi0_0 (FIT), rootfs ubi0_1 (32860 KB), rootfs_data ubi0_2
  bootcmd: the kernel-volume stock one; env at mtd1, 65536 bytes
...
nand-migrate: running as PID 1 from RAM
nand-migrate: writing the rootfs volume ubi0_1 (14348288 bytes)
nand-migrate: rootfs written and read back: SHA-1 matches
nand-migrate: bootcmd now loads the kernel from /boot in the rootfs
nand-migrate: kernel volume removed
nand-migrate: done, rebooting
Loading file '/boot/fitImage' to addr 0x42000000...
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Verifying Hash Integrity ... crc32+ sha1+ OK
gk7205v510-mis2008 login:
# ubinfo -a | grep Name:
Name:        rootfs
Name:        rootfs_data

Scope

• No kernel patches under general/package/all-patches/linux/ (those go to OpenIPC/linux)
• No files specific to a single retail camera model (those go to OpenIPC/builder)
• No probing or bring-up tooling (that goes to OpenIPC/ipctool)
• Nothing under general/overlay/ or in a shared load_<vendor> script hardcodes a value specific to my board
• Package sources come from an OpenIPC repository, and any version bump keeps at least the specificity of the pin it replaces (a new package should pin a full 40-character SHA)
• No LD_PRELOAD, and no binaries that cannot be rebuilt from source
• New code is selected by a defconfig, so CI actually builds it

[openipc-ai]

/review

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. The firmware change lacks camera proof 📘 Rule violation ☼ Reliability

Description

The shipped sysupgrade script changes the user-facing refusal behavior for ubifs-kvol cameras,
but the change was not tested on a real camera. Because this overlay runs on affected cameras in the
field, the new migration guidance reaches hardware without the required symptom and board-specific
hardware evidence.

Code

general/overlay/usr/sbin/sysupgrade[R2967-2968]

+if { [ "1" = "$update_kernel" ] || [ "1" = "$update_rootfs" ]; } && [ "$ubi_layout" = "ubifs-kvol" ]; then
+	die "This camera uses the retired NAND layout with a separate kernel volume; current images carry the kernel inside the rootfs. Move it over without a serial console: copy rootfs.ubifs.* from its -nand- package to /tmp and run 'ipctool nand-migrate /tmp/rootfs.ubifs.<soc>' (it keeps U-Boot and the settings, and reboots), or reinstall it from U-Boot: https://openipc.org/cameras/vendors/$vendor/socs/$model -- nothing was written."

Evidence

The compliance rule requires hardware evidence for changes that can alter firmware behavior and
explicitly treats a stated lack of hardware testing as a failure. The changed shipped script adds a
new migration instruction to the refusal path, altering what affected cameras print.

Rule 3: Hardware evidence is present and honest
general/overlay/usr/sbin/sysupgrade[2962-2968]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The shipped updater changes the refusal message for kernel-volume NAND cameras, but the PR states that this change was not tested on real hardware.
## Fix Focus Areas
- general/overlay/usr/sbin/sysupgrade[2967-2968]
## Recommended Fix
Test the changed updater behavior on an affected real camera, recording the board, symptom, and before/after output, or revise the change so it does not alter firmware behavior on cameras.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗