Does anyone have the 2.4GHz channel with 802.11n providing 800MHz bandwidth? The best I could get is 600MHz by forcing 40MHz channels. Thanks,
Sure enough. I just manually disabled my wlan1 interface, but left the radio on and now the 5G scan works fine. Turn the interface on, it's locked up again...
Yes, TurboQAM it's working but you'll need supplemental patches for max80211, mt76 and hostapd.
2 Likes
Thanks... I see it's non-standard. Let me find/write the patches for mac802.11 then mt76, then hostapd.
Does anyone want to try HE80P80 on this device and see if it works?
I assume it’s capable but I haven’t unboxed mine 
I honestly don't think it's worth the time, throughput will be pretty anaemic on 2.4ghz regardless, just due to noise, neighbouring clients and ap's, etc. The signal level required where you would switch to VHT MCS 8/9 would probably just mean your client would see and (hopefully) roam to a better performing 5ghz signal anyway. Unless you possess a large amount of VHT256 capable single-band clients...
You may most likely need the mt7615 portion mentioned in the comments too, since mt7622 shares most of it's code. Although I'm not sure why the commentor masked in 160/80+80 capability on 2.4ghz.
2 Likes
Thanks. I’m not even sure if anything I have supports it. Perhaps Nintendo Switch? I do like to make the software unrestrictive. Thanks again,
Finally received one of those clamps.
Attached it to JTAG pads on router:
Checked continuity from pads to dupont connectors with multimeter and checked that there are no short circuits.
Patched and compiled OpenOCD from master branch.
Connected pins to Raspberry Pi 4B like this:
*ROUTER* *RPI*
TCK (11) => GPIO 11 (23 header)
TMS (7) => GPIO 25 (22 h)
TDI (5) => GPIO 10 (19 h)
TDO (13) => GPIO 9 (21 h)
RESET (15) => GPIO 24 (18 h)
GROUND (8) => Ground (6 h)
JTAG:
RPi:
I've got rpi4.cfg:
bcm2835gpio peripheral_base 0xFE000000
bcm2835gpio speed_coeffs 146203 36
# header pins: 23 22 19 21
bcm2835gpio jtag_nums 11 25 10 9
# ???? I am completely unsure about necessity of this lines here ????
bcm2835gpio srst_num 24
reset_config srst_only
adapter_nsrst_delay 100
# ????
transport select jtag
adapter speed 1000
and mt7622.cfg from here
running: sudo openocd -f rpi4.cfg -f mt7622.cfg:
Open On-Chip Debugger 0.11.0+dev-00782-g71bf71eec (2022-08-03-20:58)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter srst delay' not 'adapter_nsrst_delay'
adapter speed: 1000 kHz
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: mt7622.cpu: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (0) in DAP response
But when I'm changing GPIO 9 (connected to TDO) mode to pull-up by raspi-gpio set 9 pu I've got this output from OpenOCD:
Open On-Chip Debugger 0.11.0+dev-00782-g71bf71eec (2022-08-03-20:58)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter srst delay' not 'adapter_nsrst_delay'
adapter speed: 1000 kHz
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Info : JTAG tap: mt7622.cpu tap/device found: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Warn : JTAG tap: mt7622.cpu UNEXPECTED: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Error: JTAG tap: mt7622.cpu expected 1 of 1: 0x4ba00477 (mfg: 0x23b (ARM Ltd), part: 0xba00, ver: 0x4)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto1.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto2.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto3.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto4.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto5.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto6.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto7.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto8.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto9.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto10.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto11.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto12.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto13.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto14.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto15.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto16.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto17.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto18.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto19.tap does not have valid IDCODE (idcode=0x0)
Warn : Unexpected idcode after end of chain: 52 0x00000000
Warn : Unexpected idcode after end of chain: 84 0x00000000
Warn : Unexpected idcode after end of chain: 116 0x00000000
Warn : Unexpected idcode after end of chain: 148 0x00000000
Warn : Unexpected idcode after end of chain: 180 0x00000000
Warn : Unexpected idcode after end of chain: 212 0x00000000
Warn : Unexpected idcode after end of chain: 244 0x00000000
Warn : Unexpected idcode after end of chain: 276 0x00000000
Warn : Unexpected idcode after end of chain: 308 0x00000000
Warn : Unexpected idcode after end of chain: 340 0x00000000
Warn : Unexpected idcode after end of chain: 372 0x00000000
Warn : Unexpected idcode after end of chain: 404 0x00000000
Warn : Unexpected idcode after end of chain: 436 0x00000000
Warn : Unexpected idcode after end of chain: 468 0x00000000
Warn : Unexpected idcode after end of chain: 500 0x00000000
Warn : Unexpected idcode after end of chain: 532 0x00000000
Warn : Unexpected idcode after end of chain: 564 0x00000000
Warn : Unexpected idcode after end of chain: 596 0x00000000
Warn : Unexpected idcode after end of chain: 628 0x00000000
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000"
Error: auto0.tap: IR capture error; saw 0x0000 not 0x0001
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (3) in DAP response
I've tried switching RTCK with TCLK pin with changes like this:
adapter_nsrst_delay 10
adapter speed 10
and with the same output as above.
According to this RPi has internal pull-up\pull-down resistors on pins, but I don't know which pins should be configured to make connections work.
2 Likes
Hi OpenWrt community,
Firstly let me thank all who have contributed to support this device!
I recently got a RT3200, and managed to to get it running with an image built from source (UBI r20212-beeb49740b). Everything looks hunky-dory except for a sharp drop in Wifi uplink speeds. It drops from 816Mb/s to just 34Mb/s moving just 2m. RSSI: -65dBm.
- Client: MBP 2021
- Mode: ax@5GHz 1200Mbps 80MHz MCS11 2SS
OpenWrt settings:
config wifi-device 'radio1'
option type 'mac80211'
option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '5g'
option country 'PT'
option htmode 'HE160'
option channel '36'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option encryption 'sae-mixed'
option wpa_disable_eapol_key_retries '1'
option ssid 'xxxxxx'
option key 'xxxxxxxxxxxx'
Location: 1m away
Station xx:xx:xx:xx:xx:xx (on wlan1)
inactive time: 0 ms
rx bytes: 1687624069
rx packets: 1155350
tx bytes: 2042584013
tx packets: 1392592
tx retries: 0
tx failed: 0
rx drop misc: 7
signal: -38 [-43, -39, -84, -79] dBm
signal avg: -38 [-43, -39, -84, -78] dBm
tx bitrate: 1134.2 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 1 HE-DCM 0
tx duration: 72665268 us
rx bitrate: 1200.9 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0
rx duration: 13642816 us
airtime weight: 256
authorized: yes
authenticated: yes
associated: yes
preamble: long
WMM/WME: yes
MFP: yes
TDLS peer: no
DTIM period: 2
beacon interval:100
short slot time:yes
Location: 5m, 1 wall
Station xx:xx:xx:xx:xx:xx (on wlan1)
inactive time: 0 ms
rx bytes: 9226260645
rx packets: 6137835
tx bytes: 2068267088
tx packets: 1683852
tx retries: 0
tx failed: 0
rx drop misc: 7
signal: -58 [-58, -65, -89, -86] dBm
signal avg: -58 [-58, -65, -88, -87] dBm
tx bitrate: 1020.6 MBit/s 80MHz HE-MCS 10 HE-NSS 2 HE-GI 1 HE-DCM 0
tx duration: 111784583 us
rx bitrate: 816.7 MBit/s 80MHz HE-MCS 8 HE-NSS 2 HE-GI 1 HE-DCM 0
rx duration: 91894151 us
airtime weight: 256
authorized: yes
authenticated: yes
associated: yes
preamble: long
WMM/WME: yes
MFP: yes
TDLS peer: no
DTIM period: 2
beacon interval:100
short slot time:yes
Location: 7m, 1 wall
Station xx:xx:xx:xx:xx:xx (on wlan1)
inactive time: 0 ms
rx bytes: 10100415959
rx packets: 6715914
tx bytes: 2074332814
tx packets: 1753372
tx retries: 0
tx failed: 0
rx drop misc: 7
signal: -65 [-66, -72, -89, -89] dBm
signal avg: -66 [-66, -73, -93, -93] dBm
tx bitrate: 408.3 MBit/s 80MHz HE-MCS 4 HE-NSS 2 HE-GI 1 HE-DCM 0
tx duration: 164421689 us
rx bitrate: 34.0 MBit/s 80MHz HE-MCS 0 HE-NSS 1 HE-GI 1 HE-DCM 0
rx duration: 129461459 us
airtime weight: 256
authorized: yes
authenticated: yes
associated: yes
preamble: long
WMM/WME: yes
MFP: yes
TDLS peer: no
DTIM period: 2
beacon interval:100
short slot time:yes
Is there a way to fix or mitigate this issue?
Many thanks!
I noticed the exact same issue. Would like to know if there's a fix.
2 meters from the router and station->AP (one way) speed drops significantly. RX rate stuck at MCS0 and NSS1
This happens only to iphone 12. Older macbooks, iphones, ipads (802.11ac) all work fine. AX200 on a PC also works fine. Changing DFS/non-DFS channels has no effect. (Now it seems to related to Apple and AX)
inactive time: 0 ms
rx bytes: 54300184
rx packets: 230799
tx bytes: 1299687224
tx packets: 877304
tx retries: 0
tx failed: 0
rx drop misc: 5
signal: -56 [-66, -57, -62, -65] dBm
signal avg: -56 [-66, -57, -61, -64] dBm
tx bitrate: 816.7 MBit/s 80MHz HE-MCS 8 HE-NSS 2 HE-GI 1 HE-DCM 0
tx duration: 21796989 us
rx bitrate: 34.0 MBit/s 80MHz HE-MCS 0 HE-NSS 1 HE-GI 1 HE-DCM 0
rx duration: 11595828 us
airtime weight: 256
authorized: yes
authenticated: yes
associated: yes
preamble: long
WMM/WME: yes
MFP: no
TDLS peer: no
DTIM period: 2
beacon interval:100
short slot time:yes
connected time: 115 seconds
associated at [boottime]: 587255.711s
associated at: 1659990269627 ms
current time: 1659990384586 ms
Where did you get that jtag clamp? Can you pm the info?
Hi again 
I've somehow managed to correctly start JTAG session and flashed(???) U-Boot using this instructions.
Here, UART logs from JTAG process before u-boot prompt:
F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!
NOTICE: BL2: v2.4(release):516c195bf-dirty
NOTICE: BL2: Built : 18:53:46, Feb 2 2021
INFO: BL2: Doing platform setup
INFO: PMIC: MediaTek MT6380 E3
INFO: EMI: DRAMC calibration done
INFO: EMI: Rank size auto detect
INFO: EMI: Rank size: 0x20000000
INFO: EMI: complex R/W mem test passed
INFO: BL2: Loading image id 3
INFO: Loading image id=3 at address 0x43001000
INFO: Image id=3 loaded: 0x43001000 - 0x4300c0dd
INFO: BL2: Loading image id 5
INFO: Loading image id=5 at address 0x41e00000
INFO: Image id=5 loaded: 0x41e00000 - 0x41e8b739
NOTICE: BL2: Booting BL31
INFO: Entry point address = 0x43001000
INFO: SPSR = 0x3cd
INFO: Secondary bootloader is AArch64
NOTICE: BL31: v2.4(release):638b6e19e
NOTICE: BL31: Built : 10:17:31, Feb 25 2021
INFO: ARM GICv2 driver initialized
INFO: BL31: Initializing runtime services
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x41e00000
INFO: SPSR = 0x3c9
serial_mtk serial@11002000: pinctrl_select_state_full: uclass_get_device_by_phandle_id: err=-19
U-Boot 2021.04-rc3-gdc001ffc7d-dirty (Mar 05 2021 - 17:10:16 +0800)
CPU: MediaTek MT7622
Model: mt7622-rfb
DRAM: 256 MiB
WDT: Started with servicing (60s timeout)
MMC: mmc@11230000: 0, mmc@11240000: 1
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@1b100000 (eth0) using random MAC address - 96:bf:08:4f:57:a6
eth0: ethernet@1b100000
MT7622>
Uploading openwrt-22.03-snapshot-r19338-ae64d0624c-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb as recinst.ibt via TFTP:
MT7622> tftpboot 192.168.1.254:recinst.itb
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'recinst.itb'.
Load address: 0x4007ff28
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###
7.9 MiB/s
done
Bytes transferred = 16252928 (f80000 hex)
MT7622> bootm
## Loading kernel from FIT Image at 4007ff28 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.10.113
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x40080028
Data Size: 3735509 Bytes = 3.6 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x44000000
Entry Point: 0x44000000
Hash algo: crc32
Hash value: 5c881f7a
Hash algo: sha1
Hash value: 7ef4c0e06692141a5cfa614d07099f9b8974b058
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 4007ff28 ...
Using 'config-1' configuration
Trying 'initrd-1' ramdisk subimage
Description: ARM64 OpenWrt linksys_e8450-ubi initrd
Type: RAMDisk Image
Compression: Unknown Compression
Data Start: 0x4041013c
Data Size: 12438612 Bytes = 11.9 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: crc32
Hash value: e39f4030
Hash algo: sha1
Hash value: 3b4ac115d6698d879f0a5a20c5b38d0f1e01bbce
Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 4007ff28 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt linksys_e8450-ubi device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x40fecea0
Data Size: 30087 Bytes = 29.4 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 2539846b
Hash algo: sha1
Hash value: aa6298dbaf39fcef294c1236081e4cdf1690cd54
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x40fecea0
Uncompressing Kernel Image
Loading Ramdisk to 4ec1e000, end 4f7fac54 ... OK
Loading Device Tree to 000000004ec13000, end 000000004ec1d586 ... OK
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.10.113 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19338-ae64d0624c) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri May 6 19:55:52 2022
[ 0.000000] Machine model: Linksys E8450 (UBI)
[ 0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[ 0.000000] printk: bootconsole [uart8250] enabled
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000040000000-0x000000004fffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000042ffffff]
[ 0.000000] node 0: [mem 0x0000000043000000-0x000000004302ffff]
[ 0.000000] node 0: [mem 0x0000000043030000-0x000000004fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[ 0.000000] On node 0 totalpages: 65536
[ 0.000000] DMA zone: 1024 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 65536 pages, LIFO batch:15
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.1 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.2
[ 0.000000] percpu: Embedded 20 pages/cpu s43864 r8192 d29864 u81920
[ 0.000000] pcpu-alloc: s43864 r8192 d29864 u81920 alloc=20*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: ARM erratum 845719
[ 0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[ 0.000000] CPU features: detected: ARM erratum 843419
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64512
[ 0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512
[ 0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 220720K/262144K available (8254K kernel code, 896K rwdata, 1440K rodata, 448K init, 302K bss, 41424K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
[ 0.000000] random: get_random_bytes called from 0xffffffc010980c4c with crng_init=0
[ 0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[ 0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[ 0.008496] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[ 0.019226] pid_max: default: 32768 minimum: 301
[ 0.024078] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.031564] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.040475] rcu: Hierarchical SRCU implementation.
[ 0.045565] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.053791] smp: Bringing up secondary CPUs ...
[ 0.058855] Detected VIPT I-cache on CPU1
[ 0.058862] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x00000000bebc20, CPU1: 0x00000000000000
[ 0.058879] CPU features: Unsupported CPU feature variation detected.
[ 0.058909] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.058975] smp: Brought up 1 node, 2 CPUs
[ 0.092959] SMP: Total of 2 processors activated.
[ 0.097826] CPU features: detected: 32-bit EL0 Support
[ 0.103148] CPU features: detected: CRC32 instructions
[ 0.108579] CPU: All CPU(s) started at EL2
[ 0.112822] alternatives: patching kernel code
[ 0.120878] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.131097] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.138210] pinctrl core: initialized pinctrl subsystem
[ 0.144729] NET: Registered protocol family 16
[ 0.149747] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[ 0.157100] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.165137] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.173698] thermal_sys: Registered thermal governor 'fair_share'
[ 0.173708] thermal_sys: Registered thermal governor 'bang_bang'
[ 0.180022] thermal_sys: Registered thermal governor 'step_wise'
[ 0.186269] thermal_sys: Registered thermal governor 'user_space'
[ 0.192777] ASID allocator initialised with 65536 entries
[ 0.205217] pstore: Registered ramoops as persistent store backend
[ 0.211652] ramoops: using 0x10000@0x42ff0000, ecc: 0
[ 0.246534] cryptd: max_cpu_qlen set to 1000
[ 0.253296] SCSI subsystem initialized
[ 0.257798] libata version 3.00 loaded.
[ 0.262048] usbcore: registered new interface driver usbfs
[ 0.267765] usbcore: registered new interface driver hub
[ 0.273367] usbcore: registered new device driver usb
[ 0.280714] clocksource: Switched to clocksource arch_sys_counter
[ 0.287696] NET: Registered protocol family 2
[ 0.292346] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.300221] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.308909] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.316962] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[ 0.324382] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.331048] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.337818] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.345134] NET: Registered protocol family 1
[ 0.349658] PCI: CLS 0 bytes, default 64
[ 0.353975] Unpacking initramfs...
[ 1.536178] Freeing initrd memory: 12144K
[ 1.542934] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[ 1.552266] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.558314] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.601087] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
[ 1.609270] mtk-tphy 1a0c4000.usb-phy: failed to get ref_clk(id-1)
[ 1.620079] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[ 1.634624] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 1.643367] printk: console [ttyS0] disabled
[ 1.667996] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 22, base_baud = 1562500) is a ST16650V2
[ 1.677497] printk: console [ttyS0] enabled
[ 1.677497] printk: console [ttyS0] enabled
[ 1.685869] printk: bootconsole [uart8250] disabled
[ 1.685869] printk: bootconsole [uart8250] disabled
[ 1.716322] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 23, base_baud = 1562500) is a ST16650V2
[ 1.726334] 1100c000.serial: ttyS2 at MMIO 0x1100c000 (irq = 27, base_baud = 17499995) is a MediaTek BTIF
[ 1.736050] serial serial0: tty port ttyS2 registered
[ 1.741847] mtk_rng 1020f000.rng: registered RNG driver
[ 1.741860] hwrng: no data available
[ 1.750676] cacheinfo: Unable to detect cache hierarchy for CPU 0
[ 1.759273] loop: module loaded
[ 1.762488] Loading iSCSI transport class v2.0-870.
[ 1.769148] mtk-snand 1100d000.snfi: chip is FM35Q1GA, size 128MB, page size 2048, oob size 64
[ 1.781563] 4 fixed-partitions partitions found on MTD device 1100d000.snfi
[ 1.788527] Creating 4 MTD partitions on "1100d000.snfi":
[ 1.793955] 0x000000000000-0x000000080000 : "bl2"
[ 1.799576] 0x000000080000-0x0000001c0000 : "fip"
[ 1.806073] 0x0000001c0000-0x0000002c0000 : "factory"
[ 1.812671] 0x000000300000-0x000008000000 : "ubi"
[ 1.846182] random: fast init done
[ 1.980067] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc0113c0000, irq 37
[ 1.990896] i2c /dev entries driver
[ 1.995696] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[ 2.007223] NET: Registered protocol family 10
[ 2.012550] Segment Routing with IPv6
[ 2.016252] NET: Registered protocol family 17
[ 2.020750] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.033839] 8021q: 802.1Q VLAN Support v1.8
[ 2.039169] pstore: Using crash dump compression: deflate
[ 2.054408] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[ 2.060992] mtk-pcie 1a143000.pcie: Parsing ranges property...
[ 2.066827] mtk-pcie 1a143000.pcie: MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[ 2.091385] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[ 2.097570] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 2.103065] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[ 2.109932] pci_bus 0000:00: scanning bus
[ 2.113988] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[ 2.120015] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[ 2.128990] pci_bus 0000:00: fixups for bus
[ 2.133190] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[ 2.139884] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 2.147895] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[ 2.154734] pci_bus 0000:01: scanning bus
[ 2.158958] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[ 2.165146] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[ 2.172469] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[ 2.179788] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[ 2.187749] pci 0000:01:00.0: supports D1 D2
[ 2.192014] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[ 2.198643] pci 0000:01:00.0: PME# disabled
[ 2.203126] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[ 2.242106] pci_bus 0000:01: fixups for bus
[ 2.246294] pci_bus 0000:01: bus scan returning with max=01
[ 2.251880] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 2.258491] pci_bus 0000:00: bus scan returning with max=01
[ 2.264078] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[ 2.271731] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[ 2.279726] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[ 2.286512] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[ 2.294341] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[ 2.302166] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[ 2.309984] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 2.314949] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
[ 2.321828] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
[ 2.328433] pcieport 0000:00:00.0: assign IRQ: got 0
[ 2.333406] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[ 2.339508] pcieport 0000:00:00.0: enabling bus mastering
[ 2.345451] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[ 2.351998] mtk-pcie 1a145000.pcie: Parsing ranges property...
[ 2.357830] mtk-pcie 1a145000.pcie: MEM 0x0028000000..0x002fffffff -> 0x0028000000
[ 2.466037] mtk-pcie 1a145000.pcie: Port1 link down
[ 2.471049] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[ 2.477226] pci_bus 0001:00: root bus resource [bus 00-ff]
[ 2.482716] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[ 2.489582] pci_bus 0001:00: scanning bus
[ 2.494818] pci_bus 0001:00: fixups for bus
[ 2.498993] pci_bus 0001:00: bus scan returning with max=00
[ 2.504910] mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
[ 2.513188] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[ 2.590248] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=145)
[ 2.610120] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=146)
[ 2.630002] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=147)
[ 2.649864] mt7530 mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=148)
[ 2.669897] mt7530 mdio-bus:00 wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=149)
[ 2.681800] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
[ 2.688886] DSA: tree 0 setup
[ 2.689047] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[ 2.692657] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[ 2.704351] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[ 2.713417] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000210010
[ 2.722506] xhci-mtk 1a0c0000.usb: irq 31, io mem 0x1a0c0000
[ 2.728626] hub 1-0:1.0: USB hub found
[ 2.732427] hub 1-0:1.0: 2 ports detected
[ 2.736707] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[ 2.741964] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[ 2.749362] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
[ 2.755677] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[ 2.764091] hub 2-0:1.0: USB hub found
[ 2.767869] hub 2-0:1.0: 1 port detected
[ 2.772908] UBI: auto-attach mtd3
[ 2.776236] ubi0: attaching mtd3
[ 3.162596] ubi0: scanning is finished
[ 3.170434] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[ 3.175946] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 3.182824] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 3.189603] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 3.196559] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[ 3.202646] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[ 3.209858] ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 344449439
[ 3.218897] ubi0: available PEBs: 825, total reserved PEBs: 175, PEBs reserved for bad PEB handling: 20
[ 3.228299] ubi0: background thread "ubi_bgt0d" started, PID 844
[ 3.234671] Freeing unused kernel memory: 448K
[ 3.270756] Run /init as init process
[ 3.274408] with arguments:
[ 3.277364] /init
[ 3.279626] with environment:
[ 3.282771] HOME=/
[ 3.285121] TERM=linux
[ 3.465338] init: Console is alive
[ 3.468860] init: - watchdog -
[ 3.475617] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.485989] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 3.502717] init: - preinit -
OpenWrt UBI installer
preparing backup of relevant flash areas...
4+0 records in
4+0 records out
10+0 records in
10+0 records out
8+0 records in
8+0 records out
16+0 records in
16+0 records out
Found MAC addresses block LAN: e8:9f:80:e9:53:c6 WAN: e8:9f:80:e9:53:c5
1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...
Seeking on mtd device '/dev/mtd2' to: 393216
Writing from /tmp/macs-fixed to /dev/mtd2 ...
found factory partition at offset 00000000, rewriting...1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...
Writing from /tmp/factory-fixed to /dev/mtd2 ...
redundantly write bl2 into the first 4 blocks
Unlocking /dev/mtd0 ...
Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 131072
Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 262144
Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 393216
Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
write FIP to NAND
Unlocking /dev/mtd1 ...
Writing from /installer/mt7622_linksys_e8450-u-boot.fip to /dev/mtd1 ... [e]
Skipping bad block at 0x0006000
[ 5.232722] ubi0: detaching mtd3
[ 5.236598] random: procd: uninitialized urandom read (4 bytes read)
[ 5.236769] ubi0: mtd3 is detached
ubiformat: mtd3 (nand), size 131072000 bytes (125.0 MiB), 1000 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 999 -- 100 % complete
ubiformat: 1000 eraseblocks have valid erase counter, mean value is 2
ubiformat: formatting erasebloc[ 10.019895] random: crng init done
ubiformat: formatting eraseblock 999 -- 100 % complete
[ 15.598102] ubi0: attaching mtd3
[ 15.984863] ubi0: scanning is finished
[ 15.992539] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[ 15.998025] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 16.004931] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 16.011726] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 16.018678] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[ 16.024768] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 16.031985] ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1578943962
[ 16.041112] ubi0: available PEBs: 976, total reserved PEBs: 24, PEBs reserved for bad PEB handling: 20
[ 16.050418] ubi0: background thread "ubi_bgt0d" started, PID 911
UBI device number 0, total 1000 LEBs (126976000 bytes, 121.0 MiB), available 976 LEBs (123928576 bytes, 118.1 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv", alignment 1
Volume ID 1, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv2", alignment 1
write recovery ubi volume
Volume ID 2, size 66 LEBs (8380416 bytes, 7.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "recovery", alignment 1
writing backup files to ubi volume...
Volume ID 3, size 67 LEBs (8507392 bytes, 8.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "boot_backup", alignment 1
[ 18.998237] UBIFS (ubi0:3): default file-system created
[ 19.003775] UBIFS (ubi0:3): Mounting in unauthenticated mode
[ 19.009541] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 942
[ 19.042430] UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "boot_backup"
[ 19.050263] UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 19.060192] UBIFS (ubi0:3): FS size: 7237632 bytes (6 MiB, 57 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[ 19.070281] UBIFS (ubi0:3): reserved for root: 341850 bytes (333 KiB)
[ 19.076719] UBIFS (ubi0:3): media format: w5/r0 (latest is w5/r0), UUID 50B7B990-170E-416F-900E-0606E8AA1B5B, small LPT model
[ 19.462087] UBIFS (ubi0:3): un-mount UBI device 0
[ 19.466806] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" stops
[ 24.479447] reboot: Restarting system
F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!
I've tried this for 2 times with the same result at the end in logs: System halt!. And after power-cycling a device I have the same logs like I had in the starting point of all story 
F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02B0 [000F]
Jump to BL
NOTICE: BL2: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE: BL2: Built : 19:55:52, May 6 2022
NOTICE: SPI-NAND: FM35Q1GA (128MB)
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE: BL31: Built : 19:55:52, May 6 2022
F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02B0 [000F]
Jump to BL
NOTICE: BL2: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE: BL2: Built : 19:55:52, May 6 2022
NOTICE: SPI-NAND: FM35Q1GA (128MB)
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE: BL31: Built : 19:55:52, May 6 2022
Am I missing something?
UPD: I made an attempt to restore from complete backup (mtd[0123] files). I flashed *recovery.itb file first via TFTP, it boots, shows LUCI interface at 192.168.1.1 and allows to login over ssh and copy backup files, but mtd3 file was too big for a /tmp dir, I think that because a kernel does not see more than 256 MB of memory, I've noticed that only later from the bootlogs above
...
DRAM: 256 MiB
...
and
[ 0.000000] Memory: 220720K/262144K available (8254K kernel code, 896K rwdata, 1440K rodata, 448K init, 302K bss, 41424K reserved, 0K cma-reserved)
root@OpenWrt:~# df -h
Filesystem Size Used Available Use% Mounted on
tmpfs 113.9M 70.6M 43.3M 62% /
tmpfs 113.9M 92.5M 21.4M 81% /tmp
tmpfs 512.0K 0 512.0K 0% /dev
My poor-man's plan was to split mtd3 file into two parts, one goes to /tmp and another to / and run cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3 as it seems that mtd command supports reading from stdin.
So, recovery process logs:
root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/mtd0 /dev/mtd0
Unlocking /dev/mtd0 ...
Writing from /tmp/mtd0 to /dev/mtd0 ...
root@OpenWrt:~# mtd write /tmp/mtd1 /dev/mtd1
Unlocking /dev/mtd1 ...
Writing from /tmp/mtd1 to /dev/mtd1 ... [e]
Skipping bad block at 0x00060000[e]Failed to get erase block status
root@OpenWrt:~# mtd write /tmp/mtd2 /dev/mtd2
Unlocking /dev/mtd2 ...
Writing from /tmp/mtd2 to /dev/mtd2 ...
root@OpenWrt:~# cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3
Unlocking /dev/mtd3 ...
Writing from <stdin> to /dev/mtd3 ...
root@OpenWrt:~# mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img /dev/mtd3
Unlocking /dev/mtd3 ...
Seeking on mtd device '/dev/mtd3' to: 2097152
Writing from /tmp/FW_RT3200_1.0.01.101415_prod.img to /dev/mtd3 ...
Looks like it has some sort of bad block error when writing mtd1 
And after reboot I have this in UART:
F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036D [000F]
Jump to BL
UNIVPLL_CON0 = 0xFE000000!!!
mt_pll_init: Set pll frequency for 25M crystal
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic_init] Preloader Start..................
[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2 0:E3
[pmic_init] Done...................
Chip part number:7622B
MT7622 Version: 1.2.8, (iPA)
SSC OFF
mt_pll_post_init: mt_get_cpu_freq = 1350000Khz
mt_pll_post_init: mt_get_mem_freq = 1600000Khz
mt_pll_post_init: mt_get_bus_freq = 1119920Khz
[PLFM] Init I2C: OK(0)
[BLDR] Build Time: 20200522-165358
==== Dump RGU Reg ========
RGU MODE: 4D
RGU LENGTH: FFE0
RGU STA: 0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
mtk_wdt_mode_config mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
WDT NONRST=0x20000000
WDT IRQ_EN=0x340003
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
[EMI] MDL number = 2
[EMI] DRAMC calibration start
[EMI] DRAMC calibration end
[EMI]rank size auto detect
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x48000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x50000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0xEDCBA987, test_addr[0x60000000]= 0xEDCBA987
[EMI]rank0 size: 0x20000000
[MEM] complex R/W mem test pass
RAM_CONSOLE wdt status (0x0)=0x0
[BBT] BMT.v2 is found at 0x3FF
[PLFM] Init Boot Device: OK(0)
[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000007FFFF] "PRELOADER" (256 blocks)
[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (128 blocks)
[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (256 blocks)
Device APC domain init setup:
Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x0)
Domain Setup (0x0)
[PART] Image with part header
[PART] name : U-Boot
[PART] addr : 41E00000h mode : -1
[PART] size : 342676
[PART] magic: 58881688h
[PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS]
[PART] load speed: 16731KB/s, 342676 bytes, 20ms
load lk (ret=0)
[PART] Image with part header
[PART] name : atf
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 57936
[PART] magic: 58881688h
[PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS]
[PART] load speed: 14144KB/s, 57936 bytes, 4ms
load tee1 (ret=0)
[BLDR] bldr load tee part ret=0x0, addr=0x43001000
[BLDR] boot part. not found
[BLDR] part_load_images ret=0x0
[BLDR] Others, jump to ATF
[BLDR] jump to 0x41E00000
[BLDR] <0x41E00000>=0xEA00000F
[BLDR] <0x41E00004>=0xE59FF014
And nothing... It allows me to make another round of JTAG-thing recovery and getting into U-Boot console with MT7622> prompt, but I don't know what do next in this situation. 
Does it get better after changing to 802.11ac mode?
Yes it does.
Results @ the same location (7m 1 wall)
signal: -64 [-67, -66, -89, -89] dBm
signal avg: -64 [-67, -67, -93, -92] dBm
tx bitrate: 780.0 MBit/s VHT-MCS 8 80MHz short GI VHT-NSS 2
rx bitrate: 585.0 MBit/s VHT-MCS 7 80MHz VHT-NSS 2
2 Likes
Very nice you managed to get JTAG working!
Yes this is a bad-block in the boot area of the NAND flash
I reckon the best thing you can do at this point is to replace the SPI-NAND chip with a working one (e.g. Winbond 1024Mbit).
You can also try to experiment more with this situation (it is a very rare opportunity after all!), probably you just need to skip this block while writing, ie. try using nandwrite tool instead of mtd write which offers this option.
Yep, I've tried that:
root@OpenWrt:~# ubidetach -d 0
ubidetach: error!: cannot remove ubi0
error 22 (Invalid argument)
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/mtd0 /dev/mtd0
Unlocking /dev/mtd0 ...
Writing from /tmp/mtd0 to /dev/mtd0 ...
root@OpenWrt:~# nandwrite -m /dev/mtd1 /tmp/mtd1
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Bad block at 60000, 1 block(s) will be skipped
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
nandwrite: error!: Data was only partially written due to error
error 0 (No error information)
root@OpenWrt:~# mtd write /tmp/mtd2 /dev/mtd2
Unlocking /dev/mtd2 ...
Writing from /tmp/mtd2 to /dev/mtd2 ...
root@OpenWrt:~# cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3
Unlocking /dev/mtd3 ...
Writing from <stdin> to /dev/mtd3 ...
root@OpenWrt:~# mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img /dev/mtd3
Unlocking /dev/mtd3 ...
Seeking on mtd device '/dev/mtd3' to: 2097152
Writing from /tmp/FW_RT3200_1.0.01.101415_prod.img to /dev/mtd3 ...
root@OpenWrt:/# reboot
Don't know why but ubidetach is failing now...
And logs from UART while rebooting after flash:
root@OpenWrt:/# [ 1654.194214] device wlan0 left promiscuous mode
[ 1654.198736] br-lan: port 5(wlan0) entered disabled state
[ 1654.378601] br-lan: port 3(lan3) entered disabled state
[ 1654.386079] device lan1 left promiscuous mode
[ 1654.390511] br-lan: port 1(lan1) entered disabled state
[ 1654.457198] device lan2 left promiscuous mode
[ 1654.461731] br-lan: port 2(lan2) entered disabled state
[ 1654.514400] device lan3 left promiscuous mode
[ 1654.518823] br-lan: port 3(lan3) entered disabled state
[ 1654.572225] mt7530 mdio-bus:00 lan3: Link is Down
[ 1654.578956] device lan4 left promiscuous mode
[ 1654.583341] device eth0 left promiscuous mode
[ 1654.587766] br-lan: port 4(lan4) entered disabled state
[ 1654.771841] mtk_soc_eth 1b100000.ethernet eth0: Link is Down
[ 1658.847667] reboot: Restarting system
F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!
Powering device off\on
Boot logs after that:
F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036D [000F]
Jump to BL
UNIVPLL_CON0 = 0xFE000000!!!
mt_pll_init: Set pll frequency for 25M crystal
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic_init] Preloader Start..................
[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2 0:E3
[pmic_init] Done...................
Chip part number:7622B
MT7622 Version: 1.2.8, (iPA)
SSC OFF
mt_pll_post_init: mt_get_cpu_freq = 1350000Khz
mt_pll_post_init: mt_get_mem_freq = 1600000Khz
mt_pll_post_init: mt_get_bus_freq = 1119920Khz
[PLFM] Init I2C: OK(0)
[BLDR] Build Time: 20200522-165358
==== Dump RGU Reg ========
RGU MODE: 4D
RGU LENGTH: FFE0
RGU STA: 0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
mtk_wdt_mode_config mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
WDT NONRST=0x20000000
WDT IRQ_EN=0x340003
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
[EMI] MDL number = 2
[EMI] DRAMC calibration start
[EMI] DRAMC calibration end
[EMI]rank size auto detect
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x48000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x50000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0xEDCBA987, test_addr[0x60000000]= 0xEDCBA987
[EMI]rank0 size: 0x20000000
[MEM] complex R/W mem test pass
RAM_CONSOLE wdt status (0x0)=0x0
[BBT] 80 available blocks in BMT pool
nand: Warning: the BMT table has not been initialized
write BMT at page: 0xFFC0
write BMT at page: 0xFFC1
write BMT at page: 0xFFC2
write BMT at page: 0xFFC3
write BMT at page: 0xFFC4
[BBT] BMT.v2 is written into PBA:0x3FF
[PLFM] Init Boot Device: OK(0)
[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000007FFFF] "PRELOADER" (256 blocks)
[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (128 blocks)
[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (256 blocks)
Device APC domain init setup:
Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x0)
Domain Setup (0x0)
[PART] Image with part header
[PART] name : U-Boot
[PART] addr : 41E00000h mode : -1
[PART] size : 342676
[PART] magic: 58881688h
[PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS]
[PART] load speed: 16731KB/s, 342676 bytes, 20ms
load lk (ret=0)
[PART] Image with part header
[PART] name : atf
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 57936
[PART] magic: 58881688h
[PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS]
[PART] load speed: 14144KB/s, 57936 bytes, 4ms
load tee1 (ret=0)
[BLDR] bldr load tee part ret=0x0, addr=0x43001000
[BLDR] boot part. not found
[BLDR] part_load_images ret=0x0
[BLDR] Others, jump to ATF
[BLDR] jump to 0x41E00000
[BLDR] <0x41E00000>=0xEA00000F
[BLDR] <0x41E00004>=0xE59FF014
No luck?
UPD: And I'm worried about issue with 256mb DRAM. Is memory also corrupted?
I checked in ARM Trusted Firmware sources and it's a bit stupid: When a read error on SNFI interface occurs it just returns an error and doesn't skip and continue to read 
We will have to implement that in plat/mediatek/mt7622/bl2_boot_snand.c to support this case of bad block in the middle of fip image. It's not very difficult to do, just instead of the break instruction ending the read loop we will need to increment the block number and use the continue instruction instead, so the read loop just skips the bad blocks.
Edit: It's right here: https://github.com/mtk-openwrt/arm-trusted-firmware/blob/mtksoc/plat/mediatek/mt7622/bl2_boot_snand.c#L59
You can try writing openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin to /dev/mtd0 and openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip to /dev/mtd1 using the recovery image made for the UBI variant.
If you want to return to stock firmware you will also need to use the non-UBI initramfs image (as that contains the correct MTD partition layout matching the stock firmware).
DRAM size limitation is normal as some part is reserved for use by ARM Trusted Firmware and another small bit for pstore/ramoops.
Looks like 802.11ax on mt76 it's still far from being ready for prime time
1 Like
... or Apple's 802.11ax implementation is not what's written in the standard. But as they are Apple that won't matter as everyone else will have to adapt.
5 Likes
Unfortunately I didn't document the performance with the stock firmware. Went straight from unpacking to OpenWrt 
2 Likes