UBI, UBIFS, and NAND layout

Partition table

Observed from /proc/mtd:

Device	Name	Size	Erase block
mtd0	bootloader	2 MiB	128 KiB
mtd1	tpl	8 MiB	128 KiB
mtd2	misc	2 MiB	128 KiB
mtd3	boot_a	16.25 MiB	128 KiB
mtd4	boot_b	16 MiB	128 KiB
mtd5	system_a	64 MiB	128 KiB
mtd6	system_b	64 MiB	128 KiB
mtd7	data	77.5 MiB	128 KiB

The DTB reports a physical data span of 78 MiB. U-Boot store size reports 77.25 MiB of logical capacity. Six PEBs are excluded between the DTB span and logical size. These differences matter when erasing and writing images: erase uses physical ranges, while NAND read/write lengths use logical skip-bad space.

Volumes

The live system has two independent UBI volumes:

• rootfs: stock read-only root filesystem, mounted by S02/OTA tools.
• data: writable settings, sessions, and overlay upper/work directories.

UBI handles bad-block mapping, EC headers, volume tables, image sequence numbers, and dynamic/autoresize behavior. A valid UBIFS tree alone is insufficient: the UBI volume table, free PEB headers, and erase/write arithmetic must also be correct.

Data integrity

The third-party RAM installer mounts stock rootfs read-only and uses chk_data_crc when mounting data. It also detaches and remounts UBI after publication to verify that files persist. This avoids treating an image that only passes an offline reader as proof of a successful boot.

A full-image writer should similarly verify the actual NAND after writing, then verify boot behavior. Byte-for-byte readback proves the write, not the mount or subsequent userspace outcome.

Recovery implications

S02datamount.sh formats data if it cannot attach a matching UBI device. Consequently a malformed UBI layout or incompatible volume table can cause a factory-mode reset before any overlay file is reachable. Early failures cannot be diagnosed by an S89 log alone: S89 runs much later.

Failed-write postmortem

The failed jailbreak experiment's post-boot UBIFS contained only newly created overlay/system files. It did not retain telemetry_dump or the prior voice-agent state. S03 would have preserved telemetry_dump, crashes, permanent, and update metadata, so the observed tree is evidence of the earlier S02/UBI recovery format, not the S03 file-level factory reset.

The write-side defect was the erase/write arithmetic mismatch: U-Boot writes lengths in logical skip-bad space but erases a physical range. An image-sized erase left stale tail PEBs with an old UBI image sequence, and UBI rejected the partition. A byte-for-byte readback proves that the intended image reached NAND; it cannot prove that the volume table is accepted or that S02 will not reformat it. The writer must erase the full physical partition range before writing.

The pre-jailbreak capture had no do_factory_reset, so marker replay does not explain this particular wipe. The reset-marker and full-volume recovery paths must remain distinct in later diagnostics.