I've tried to go back to stock. Changed flag for nandwrite from -m to -N:
root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/mtd0 /dev/mtd0
Unlocking /dev/mtd0 ...
Writing from /tmp/mtd0 to /dev/mtd0 ...
root@OpenWrt:~# nandwrite -N /dev/mtd1 /tmp/mtd1
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
root@OpenWrt:~# mtd write /tmp/mtd2 /dev/mtd2
Unlocking /dev/mtd2 ...
Writing from /tmp/mtd2 to /dev/mtd2 ...
root@OpenWrt:~# cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3
Unlocking /dev/mtd3 ...
Writing from <stdin> to /dev/mtd3 ...
root@OpenWrt:~# mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img /dev/mtd3
Unlocking /dev/mtd3 ...
Seeking on mtd device '/dev/mtd3' to: 2097152
Writing from /tmp/FW_RT3200_1.0.01.101415_prod.img to /dev/mtd3 ...
And after reboot I see this:
F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036D [000F]
Jump to BL
UNIVPLL_CON0 = 0xFE000000!!!
mt_pll_init: Set pll frequency for 25M crystal
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic_init] Preloader Start..................
[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2 0:E3
[pmic_init] Done...................
Chip part number:7622B
MT7622 Version: 1.2.8, (iPA)
SSC OFF
mt_pll_post_init: mt_get_cpu_freq = 1350000Khz
mt_pll_post_init: mt_get_mem_freq = 1600000Khz
mt_pll_post_init: mt_get_bus_freq = 1119920Khz
[PLFM] Init I2C: OK(0)
[BLDR] Build Time: 20200522-165358
==== Dump RGU Reg ========
RGU MODE: 4D
RGU LENGTH: FFE0
RGU STA: 0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
mtk_wdt_mode_config mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
WDT NONRST=0x20000000
WDT IRQ_EN=0x340003
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
[EMI] MDL number = 2
[EMI] DRAMC calibration start
[EMI] DRAMC calibration end
[EMI]rank size auto detect
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x48000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x50000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0xEDCBA987, test_addr[0x60000000]= 0xEDCBA987
[EMI]rank0 size: 0x20000000
[MEM] complex R/W mem test pass
RAM_CONSOLE wdt status (0x0)=0x0
nand: found bad block 0x7
[BBT] 79 available blocks in BMT pool
nand: Warning: the BMT table has not been initialized
write BMT at page: 0xFFC0
write BMT at page: 0xFFC1
write BMT at page: 0xFFC2
write BMT at page: 0xFFC3
write BMT at page: 0xFFC4
[BBT] BMT.v2 is written into PBA:0x3FF
[PLFM] Init Boot Device: OK(0)
[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000007FFFF] "PRELOADER" (256 blocks)
[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (128 blocks)
[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (256 blocks)
Device APC domain init setup:
Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x0)
Domain Setup (0x0)
snand: check bch error !
nand_read_data fail
load lk (ret=-1)
[BLDR] Second Bootloader Load Failed
PL fatal error...
Can you give me some links as a starting point for building this whole thing from scratch? Can I build it on arm64 RPi? Or I need x86 machine and cross-compiling toolchain etc?
Also, a big thanks for your replies and hints I'm very grateful to you!
You need to get familiar with the OpenWrt build system. Building works on x86, x86_64 and arm64 platforms (and should work on 32-bit ARMv7 as well, but I've never tested that). See
Once you understood all that and setup your build environment, clone the OpenWrt git repository into a local folder, run make menuconfig and select MediaTek/Ralink ARM target, MT7622 subtarget and (of course) the Linksys E8450 (UBI) board. This will automatically select building ARM Trusted Firmware as well as U-Boot for that board as well.
I'd suggest to once build everything using make -j$(nproc), then prepare to patch ARM Trusted Firmware bl2 to be able to skip bad blocks:
TOPDIR=$(pwd)
make package/arm-trusted-firmware-mediatek/{clean,prepare} QUILT=1
cd build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-*
quilt new 100-bl2-skip-badblocks.patch
quilt add plat/mediatek/mt7622/bl2_boot_snand.c
# now edit plat/mediatek/mt7622/bl2_boot_snand.c and make changes
quilt refresh
cd $TOPDIR
make package/arm-trusted-firmware-mediatek/{update,compile} QUILT=1
# check if it compiles fine, then
make -j$(nproc)
cd bin/targets/mediatek/mt7622
# find generated binaries here
I've tried to build on RPi Raspbian (arm64) and Debian 10 (arm64) under Parallels on Apple M1 CPU, there is an issue with build dependencies with obtaining gcc-multilib it looks like it is absent from arm64 distros, and likely OpenWRT does not using arm64 buildbots at the moment.
I've clones openwrt repo, switched to openwrt-22.03 branch. configured by make menuconfig and started building,
and this line:
...
make package/arm-trusted-firmware-mediatek/{update,compile} QUILT=1
...
resulted in an error:
...
make -C /home/pi/sources/openwrt/build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-2021-05-08-d2c75b21 CROSS_COMPILE=aarch64-openwrt-linux-musl- OPENSSL_DIR=/home/pi/sources/openwrt/staging_dir/host PLAT=mt7622 BUILD_STRING="OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)" BOOT_DEVICE=snand USE_MKIMAGE=1 MKIMAGE=/home/pi/sources/openwrt/staging_dir/host/bin/mkimage all
make[3]: Entering directory '/home/pi/sources/openwrt/build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-2021-05-08-d2c75b21'
/bin/sh: 1: aarch64-openwrt-linux-musl-gcc: not found
CC common/desc_image_load.c
make[3]: aarch64-openwrt-linux-musl-gcc: No such file or directory
make[3]: *** [Makefile:1125: /home/pi/sources/openwrt/build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-2021-05-08-d2c75b21/build/mt7622/release/bl2/desc_image_load.o] Error 127
Ooook, I thought, let's try x86-64 machine (laptop) with Windows and WSL then, install Ubuntu 20.40 via WSL2, install deps as described in docs (now, finally with gcc-multilib).
But the outcome was the same:
make[3]: Entering directory '/home/developer/sources/openwrt/build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-2021-05-08-d2c75b21'
/bin/sh: 1: aarch64-openwrt-linux-musl-gcc: not found
CC common/desc_image_load.c
make[3]: aarch64-openwrt-linux-musl-gcc: Command not found
make[3]: *** [Makefile:1125: /home/developer/sources/openwrt/build_dir/target-aarch64_cortex-a53_musl/arm-trusted-firmware-mediatek-mt7622-snand-1ddr/arm-trusted-firmware-mediatek-2021-05-08-d2c75b21/build/mt7622/release/bl2/desc_image_load.o] Error 127
Looks like the toolchain's not built. Could you potentially just build a full image for this device and extract the packages (well, copy them from the output directory)?
My bad, didn't noticed that first time Thanks to you and @shenghaoyang !
Now I have patched build, and two files:
openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin goes to /dev/mtd0
openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip goes to /dev/mtd1
What should go to /dev/mtd2 and /dev/mtd3? I only have my backup files from complete backup procedure. Are they good to go? Or I need to use some files from the build?
+ if (ret < 0) {
+ off += chunksize;
+ continue;
+ }
Because if you just want to skip the bad block you should not increment the destination pointer ptr -- if you do you'll have a gap there.
We could argue about decrementing the remaining size or not, but I'd not do it -- if there are soooo many read errors that this would actually start to matter the best chance would still be to try reading after all those errors instead of not doing so.
And yes, you only need to write /dev/mtd0 and /dev/mtd1 just like you described, and write them using nandwrite. If that doesn't work, try nandwrite -m ....
This should give you a U-Boot with a menu, from there you can then load the main (recovery and production) OpenWrt images via TFTP.
By recovery and production images you mean openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb and openwrt-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb correspondingly?
I'm a bit confused because i will run nandwrite commands from TFTPD'ed and bootm'ed images of openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb.
Is this correct?
When using the bootmenu to write the recovery (just recovery, not-installer) and production (yes, *sysupgrade.itb) image it will automatically request the right filename. Just launch TFTP server with address 192.168.1.254/24 in /home/user/openwrt/bin/targets/mediatek/mt7622 and use the U-Boot menu.
Edit: and yes, it may be confusing but sounds correct: to initially now write your patched bl2 and fip to the flash you need to use openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb loaded via TFTP.
I've used your patch variant with simple offset increment.
While flashing openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip to /dev/mtd1nandwrite failed due to unaligned input file and as error suggested I have added -p option for padding:
root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin /dev/mtd0
Unlocking /dev/mtd0 ...
Writing from /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin to /dev/mtd0 ...
root@OpenWrt:~# nandwrite -m /dev/mtd1 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
error 0 (No error information)
root@OpenWrt:~# nandwrite -mp /dev/mtd1 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Bad block at 60000, 1 block(s) will be skipped
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
I've made another attempt, but this time I used -N flag instead of -m and used nandwrite for /dev/mtd0 flashing too:
root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# nandwrite /dev/mtd0 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin
Input file is not page-aligned. Use the padding option.
nandwrite: error!: Data was only partially written due to error
error 0 (No error information)
Input file is not page-aligned. Use the padding option.
root@OpenWrt:~# nandwrite -p /dev/mtd0 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin
Writing data to block 0 at offset 0x0
root@OpenWrt:~# nandwrite -Np /dev/mtd1 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Oh that all doesn't look well. Actually looks more like this flash chip is further deteriorating because now even bl2 doesn't come up any more. Give it another round of writing bl2 using JTAG-loaded U-Boot and see if that at least bring bl2 back to life.
If not: recommended replacement part is Winbond W25N01GV
instead of
I guess, since you'd typically do a single-pass upon accepting the part at factory to map out bad blocks and reallocate in order to guarantee that your first thousand blocks or so are good. If it's degrading well before the rated read/erase endurance, that's not great.
I believe replacing the part here would require a hot-air station, some kapton or similar tape for the surrounding components, and some patience.
One could also argue that you could probably slap in an even larger capacity part if you can find one supported by both current ATF and kernel. (Noting the madness that is seeing Micron 2gbit parts being 3 cents cheaper than the 1gbit one on element14, although I'm very unsure that it would boot without making sure that various quirks were handled in ATF or not)
Another round (this time mtd was used for /dev/mtd0 flashing and -m flag for /dev/mt1):
root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin /dev/mtd0
Unlocking /dev/mtd0 ...
Writing from /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin to /dev/mtd0 ...
root@OpenWrt:~# nandwrite -mp /dev/mtd1 /tmp/openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Bad block at 60000, 1 block(s) will be skipped
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Using -N to write the fip image is for sure wrong, because it does need to skip the bad block(s).
I'm afraid that nandwrite still doesn't work well with MediaTek's ECC engine OOB format. This has been a problem with earlier iterations of the SNFI driver in Linux, I thought that the final version of the driver now had fixed that issue -- but maybe using nandwrite and nanddump still doesn't work even with the current driver.
So you will have to write using mtd util and manually skip the bad 4th block in the fip partition, I'd try this:
Wow, that looks actually like you are progressing somewhere! If this line shows it means the fip image was loaded and started. It's weird that from there you don't see lines of U-Boot (which is BL32 which should come after BL31) starting or anything like that.
So yes, writing everything with mtd tool and not using nandwrite at all is the way.
You forgot to copy&paste the final 0 maybe?
Because it even looks like mtd write ... would also skip the bad block @0x00060000 and that may then be taken into account for the offset to seek on /dev/mtd1.
Actually try this now that bl2 seems to correctly skip bad blocks as well:
Looks like bl2 is still reading the fip image somehow truncated, but already getting further. You could add additional debugging printf's in bl2_boot_snand.c to see what's actually going on, for example how many bytes in total are read from flash into buffer and stuff like that.
I'm very grateful to you!
Thanks to you and 
