Belkin RT3200/Linksys E8450 WiFi AX discussion

soxrok2212 · August 5, 2022, 3:36pm

Another issue I'm facing -- I have an RT3200 and an E8450 in WDS mode. E8450 is the client. When I put both into 160MHz on channel 100, the client device sees great RX speeds but the uplink speeds are cut to 136.1mbit/s. It's almost like its being cut at 802.11n speeds. Put it back to 80MHz and it does right back up to over 1gbit/s. Both are on snapshot RC6.

I have 2 MacBooks (albeit 80MHz) that have normal link rates (~1gbit) and an Intel AX200 (160MHz) on my Windows desktop that is reporting a 1.8gbit/s link rate no problem, so looks like an issue specifically for client mode in the MT7915.

Possibly related? https://github.com/openwrt/mt76/issues/683

cmonroe · August 5, 2022, 10:14pm

Are you using a DFS channel in a FCC regulatory domain (e.g. US, CA etc.) by chance? If so, that's the cause for the resource busy error. Since the radio has to monitor for radar pulses it's not allowed to do off channel scanning. This is standard behavior for all 5GHz WiFi chips operating on a DFS channel. Example from a unit I have here:

841-t6-B460-linux: ~ # iw reg get | grep country
country US: DFS-FCC
841-t6-B460-linux: ~ # iwinfo wifi5g info
wifi5g    ESSID: "Intellifi"
          Access Point: E8:2C:6D:81:B4:6A
          Mode: Master  Channel: 64 (5.320 GHz)
          Center Channel 1: 58 2: unknown
          Tx-Power: 24 dBm  Link Quality: 59/70
          Signal: -51 dBm  Noise: -91 dBm
          Bit Rate: 952.7 MBit/s
          Encryption: WPA2 PSK (CCMP)
          Type: nl80211  HW Mode(s): 802.11nacax
          Hardware: 14C3:7915 14C3:7915 [MediaTek MT7915E]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy1
841-t6-B460-linux: ~ # iw dev wifi5g scan
command failed: Resource busy (-16)
841-t6-B460-linux: ~ #

If I switch to a non-DFS channel (such as 44) then scanning works.

For ETSI country codes my memory is a bit hazy.. I can't recall if they adopt the same behavior or if they allow scanning. Maybe @nbd knows off the top of his head.

soxrok2212 · August 6, 2022, 2:26am

I am, I’m on channel one 100. I’ll have to make a point to test on a non-DFS channel at some point. Maybe 1/10 of the scans will actually go through.

RealImmortal · August 6, 2022, 3:30am

Can I update my firmware to rc6? Right now, my 2.4 ghz band wifi is sooo bad that even my mobile network is better than that.

efahl · August 6, 2022, 3:50am

Likewise, I'm using US DFS-FCC, channel 52. Am I correct in thinking this would also explain my observations back in May, when scanning did work, but it did so by killing the connection and just using a non-broadcasting radio?

Anteus · August 6, 2022, 5:27am

I think the drop out when you scan is because it only has one 5G radio. Some routers have an extra radio just for DFS scanning.

KOA · August 6, 2022, 7:15am

Any examples?

Anteus · August 6, 2022, 8:04am

Some call it zero-wait DFS.

alvin-chang · August 6, 2022, 2:03pm

Does anyone have the 2.4GHz channel with 802.11n providing 800MHz bandwidth? The best I could get is 600MHz by forcing 40MHz channels. Thanks,

efahl · August 6, 2022, 2:23pm

Sure enough. I just manually disabled my wlan1 interface, but left the radio on and now the 5G scan works fine. Turn the interface on, it's locked up again...

Gix · August 6, 2022, 2:33pm

Yes, TurboQAM it's working but you'll need supplemental patches for max80211, mt76 and hostapd.

alvin-chang · August 6, 2022, 2:52pm

Thanks... I see it's non-standard. Let me find/write the patches for mac802.11 then mt76, then hostapd.

lantis1008 · August 6, 2022, 11:07pm

Does anyone want to try HE80P80 on this device and see if it works?
I assume it’s capable but I haven’t unboxed mine

namidairo · August 7, 2022, 2:15am

I honestly don't think it's worth the time, throughput will be pretty anaemic on 2.4ghz regardless, just due to noise, neighbouring clients and ap's, etc. The signal level required where you would switch to VHT MCS 8/9 would probably just mean your client would see and (hopefully) roam to a better performing 5ghz signal anyway. Unless you possess a large amount of VHT256 capable single-band clients...

You may most likely need the mt7615 portion mentioned in the comments too, since mt7622 shares most of it's code. Although I'm not sure why the commentor masked in 160/80+80 capability on 2.4ghz.

alvin-chang · August 7, 2022, 5:52am

Thanks. I’m not even sure if anything I have supports it. Perhaps Nintendo Switch? I do like to make the software unrestrictive. Thanks again,

vasilii · August 7, 2022, 9:31am

Finally received one of those clamps.
Attached it to JTAG pads on router:

Checked continuity from pads to dupont connectors with multimeter and checked that there are no short circuits.
Patched and compiled OpenOCD from master branch.
Connected pins to Raspberry Pi 4B like this:

*ROUTER*      *RPI*
TCK  (11)  => GPIO 11 (23 header)
TMS   (7)  => GPIO 25 (22 h)
TDI   (5)  => GPIO 10 (19 h)
TDO   (13) => GPIO 9  (21 h)
RESET (15) => GPIO 24 (18 h)
GROUND (8) => Ground (6 h)

JTAG:

RPi:

I've got rpi4.cfg:

bcm2835gpio peripheral_base 0xFE000000
bcm2835gpio speed_coeffs 146203 36
# header pins:        23 22 19 21
bcm2835gpio jtag_nums 11 25 10 9
# ???? I am completely unsure about necessity of this lines here ????
bcm2835gpio srst_num 24
reset_config srst_only
adapter_nsrst_delay 100
# ????

transport select jtag
adapter speed 1000

and mt7622.cfg from here

running: sudo openocd -f rpi4.cfg -f mt7622.cfg:

Open On-Chip Debugger 0.11.0+dev-00782-g71bf71eec (2022-08-03-20:58)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter srst delay' not 'adapter_nsrst_delay'
adapter speed: 1000 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: mt7622.cpu: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (0) in DAP response

But when I'm changing GPIO 9 (connected to TDO) mode to pull-up by raspi-gpio set 9 pu I've got this output from OpenOCD:

Open On-Chip Debugger 0.11.0+dev-00782-g71bf71eec (2022-08-03-20:58)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter srst delay' not 'adapter_nsrst_delay'
adapter speed: 1000 kHz

Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1001 kHz
Info : JTAG tap: mt7622.cpu tap/device found: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Warn : JTAG tap: mt7622.cpu       UNEXPECTED: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Error: JTAG tap: mt7622.cpu  expected 1 of 1: 0x4ba00477 (mfg: 0x23b (ARM Ltd), part: 0xba00, ver: 0x4)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto1.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto2.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto3.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto4.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto5.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto6.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto7.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto8.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto9.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto10.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto11.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto12.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto13.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto14.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto15.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto16.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto17.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto18.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto19.tap does not have valid IDCODE (idcode=0x0)
Warn : Unexpected idcode after end of chain: 52 0x00000000
Warn : Unexpected idcode after end of chain: 84 0x00000000
Warn : Unexpected idcode after end of chain: 116 0x00000000
Warn : Unexpected idcode after end of chain: 148 0x00000000
Warn : Unexpected idcode after end of chain: 180 0x00000000
Warn : Unexpected idcode after end of chain: 212 0x00000000
Warn : Unexpected idcode after end of chain: 244 0x00000000
Warn : Unexpected idcode after end of chain: 276 0x00000000
Warn : Unexpected idcode after end of chain: 308 0x00000000
Warn : Unexpected idcode after end of chain: 340 0x00000000
Warn : Unexpected idcode after end of chain: 372 0x00000000
Warn : Unexpected idcode after end of chain: 404 0x00000000
Warn : Unexpected idcode after end of chain: 436 0x00000000
Warn : Unexpected idcode after end of chain: 468 0x00000000
Warn : Unexpected idcode after end of chain: 500 0x00000000
Warn : Unexpected idcode after end of chain: 532 0x00000000
Warn : Unexpected idcode after end of chain: 564 0x00000000
Warn : Unexpected idcode after end of chain: 596 0x00000000
Warn : Unexpected idcode after end of chain: 628 0x00000000
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000"
Error: auto0.tap: IR capture error; saw 0x0000 not 0x0001
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (3) in DAP response

I've tried switching RTCK with TCLK pin with changes like this:

adapter_nsrst_delay 10
adapter speed 10

and with the same output as above.

According to this RPi has internal pull-up\pull-down resistors on pins, but I don't know which pins should be configured to make connections work.

joaochainho · August 8, 2022, 8:14pm

Hi OpenWrt community,

Firstly let me thank all who have contributed to support this device!

I recently got a RT3200, and managed to to get it running with an image built from source (UBI r20212-beeb49740b). Everything looks hunky-dory except for a sharp drop in Wifi uplink speeds. It drops from 816Mb/s to just 34Mb/s moving just 2m. RSSI: -65dBm.

Client: MBP 2021
Mode: ax@5GHz 1200Mbps 80MHz MCS11 2SS

OpenWrt settings:

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option band '5g'
	option country 'PT'
	option htmode 'HE160'
	option channel '36'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option encryption 'sae-mixed'
	option wpa_disable_eapol_key_retries '1'
	option ssid 'xxxxxx'
	option key 'xxxxxxxxxxxx'

Location: 1m away

Station xx:xx:xx:xx:xx:xx (on wlan1)
	inactive time:	0 ms
	rx bytes:	1687624069
	rx packets:	1155350
	tx bytes:	2042584013
	tx packets:	1392592
	tx retries:	0
	tx failed:	0
	rx drop misc:	7
	signal:  	-38 [-43, -39, -84, -79] dBm
	signal avg:	-38 [-43, -39, -84, -78] dBm
	tx bitrate:	1134.2 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 1 HE-DCM 0
	tx duration:	72665268 us
	rx bitrate:	1200.9 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0
	rx duration:	13642816 us
	airtime weight: 256
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		yes
	TDLS peer:	no
	DTIM period:	2
	beacon interval:100
	short slot time:yes

Location: 5m, 1 wall

Station xx:xx:xx:xx:xx:xx (on wlan1)
	inactive time:	0 ms
	rx bytes:	9226260645
	rx packets:	6137835
	tx bytes:	2068267088
	tx packets:	1683852
	tx retries:	0
	tx failed:	0
	rx drop misc:	7
	signal:  	-58 [-58, -65, -89, -86] dBm
	signal avg:	-58 [-58, -65, -88, -87] dBm
	tx bitrate:	1020.6 MBit/s 80MHz HE-MCS 10 HE-NSS 2 HE-GI 1 HE-DCM 0
	tx duration:	111784583 us
	rx bitrate:	816.7 MBit/s 80MHz HE-MCS 8 HE-NSS 2 HE-GI 1 HE-DCM 0
	rx duration:	91894151 us
	airtime weight: 256
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		yes
	TDLS peer:	no
	DTIM period:	2
	beacon interval:100
	short slot time:yes

Location: 7m, 1 wall

Station xx:xx:xx:xx:xx:xx (on wlan1)
	inactive time:	0 ms
	rx bytes:	10100415959
	rx packets:	6715914
	tx bytes:	2074332814
	tx packets:	1753372
	tx retries:	0
	tx failed:	0
	rx drop misc:	7
	signal:  	-65 [-66, -72, -89, -89] dBm
	signal avg:	-66 [-66, -73, -93, -93] dBm
	tx bitrate:	408.3 MBit/s 80MHz HE-MCS 4 HE-NSS 2 HE-GI 1 HE-DCM 0
	tx duration:	164421689 us
	rx bitrate:	34.0 MBit/s 80MHz HE-MCS 0 HE-NSS 1 HE-GI 1 HE-DCM 0
	rx duration:	129461459 us
	airtime weight: 256
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		yes
	TDLS peer:	no
	DTIM period:	2
	beacon interval:100
	short slot time:yes

Is there a way to fix or mitigate this issue?

Many thanks!

gongtao0607 · August 8, 2022, 8:41pm

I noticed the exact same issue. Would like to know if there's a fix.

2 meters from the router and station->AP (one way) speed drops significantly. RX rate stuck at MCS0 and NSS1

This happens only to iphone 12. Older macbooks, iphones, ipads (802.11ac) all work fine. AX200 on a PC also works fine. Changing DFS/non-DFS channels has no effect. (Now it seems to related to Apple and AX)

	inactive time:	0 ms
	rx bytes:	54300184
	rx packets:	230799
	tx bytes:	1299687224
	tx packets:	877304
	tx retries:	0
	tx failed:	0
	rx drop misc:	5
	signal:  	-56 [-66, -57, -62, -65] dBm
	signal avg:	-56 [-66, -57, -61, -64] dBm
	tx bitrate:	816.7 MBit/s 80MHz HE-MCS 8 HE-NSS 2 HE-GI 1 HE-DCM 0
	tx duration:	21796989 us
	rx bitrate:	34.0 MBit/s 80MHz HE-MCS 0 HE-NSS 1 HE-GI 1 HE-DCM 0
	rx duration:	11595828 us
	airtime weight: 256
	authorized:	yes
	authenticated:	yes
	associated:	yes
	preamble:	long
	WMM/WME:	yes
	MFP:		no
	TDLS peer:	no
	DTIM period:	2
	beacon interval:100
	short slot time:yes
	connected time:	115 seconds
	associated at [boottime]:	587255.711s
	associated at:	1659990269627 ms
	current time:	1659990384586 ms

mTek · August 8, 2022, 8:58pm

Where did you get that jtag clamp? Can you pm the info?

vasilii · August 9, 2022, 12:43am

Hi again
I've somehow managed to correctly start JTAG session and flashed(???) U-Boot using this instructions.
Here, UART logs from JTAG process before u-boot prompt:

F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!

NOTICE:  BL2: v2.4(release):516c195bf-dirty
NOTICE:  BL2: Built : 18:53:46, Feb  2 2021
INFO:    BL2: Doing platform setup
INFO:    PMIC: MediaTek MT6380 E3
INFO:    EMI: DRAMC calibration done
INFO:    EMI: Rank size auto detect
INFO:    EMI: Rank size: 0x20000000
INFO:    EMI: complex R/W mem test passed
INFO:    BL2: Loading image id 3
INFO:    Loading image id=3 at address 0x43001000
INFO:    Image id=3 loaded: 0x43001000 - 0x4300c0dd
INFO:    BL2: Loading image id 5
INFO:    Loading image id=5 at address 0x41e00000
INFO:    Image id=5 loaded: 0x41e00000 - 0x41e8b739
NOTICE:  BL2: Booting BL31
INFO:    Entry point address = 0x43001000
INFO:    SPSR = 0x3cd
INFO:    Secondary bootloader is AArch64
NOTICE:  BL31: v2.4(release):638b6e19e
NOTICE:  BL31: Built : 10:17:31, Feb 25 2021
INFO:    ARM GICv2 driver initialized
INFO:    BL31: Initializing runtime services
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x41e00000
INFO:    SPSR = 0x3c9
serial_mtk serial@11002000: pinctrl_select_state_full: uclass_get_device_by_phandle_id: err=-19


U-Boot 2021.04-rc3-gdc001ffc7d-dirty (Mar 05 2021 - 17:10:16 +0800)

CPU:   MediaTek MT7622
Model: mt7622-rfb
DRAM:  256 MiB
WDT:   Started with servicing (60s timeout)
MMC:   mmc@11230000: 0, mmc@11240000: 1
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@1b100000 (eth0) using random MAC address - 96:bf:08:4f:57:a6
eth0: ethernet@1b100000
MT7622>

Uploading openwrt-22.03-snapshot-r19338-ae64d0624c-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb as recinst.ibt via TFTP:

MT7622> tftpboot 192.168.1.254:recinst.itb
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'recinst.itb'.
Load address: 0x4007ff28
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
         7.9 MiB/s
done
Bytes transferred = 16252928 (f80000 hex)
MT7622> bootm
## Loading kernel from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.10.113
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x40080028
     Data Size:    3735509 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   5c881f7a
     Hash algo:    sha1
     Hash value:   7ef4c0e06692141a5cfa614d07099f9b8974b058
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x4041013c
     Data Size:    12438612 Bytes = 11.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   e39f4030
     Hash algo:    sha1
     Hash value:   3b4ac115d6698d879f0a5a20c5b38d0f1e01bbce
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x40fecea0
     Data Size:    30087 Bytes = 29.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   2539846b
     Hash algo:    sha1
     Hash value:   aa6298dbaf39fcef294c1236081e4cdf1690cd54
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x40fecea0
   Uncompressing Kernel Image
   Loading Ramdisk to 4ec1e000, end 4f7fac54 ... OK
   Loading Device Tree to 000000004ec13000, end 000000004ec1d586 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.10.113 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19338-ae64d0624c) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri May 6 19:55:52 2022
[    0.000000] Machine model: Linksys E8450 (UBI)
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] On node 0 totalpages: 65536
[    0.000000]   DMA zone: 1024 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 65536 pages, LIFO batch:15
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 20 pages/cpu s43864 r8192 d29864 u81920
[    0.000000] pcpu-alloc: s43864 r8192 d29864 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 220720K/262144K available (8254K kernel code, 896K rwdata, 1440K rodata, 448K init, 302K bss, 41424K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
[    0.000000] random: get_random_bytes called from 0xffffffc010980c4c with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.008496] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.019226] pid_max: default: 32768 minimum: 301
[    0.024078] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.031564] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.040475] rcu: Hierarchical SRCU implementation.
[    0.045565] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.053791] smp: Bringing up secondary CPUs ...
[    0.058855] Detected VIPT I-cache on CPU1
[    0.058862] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x00000000bebc20, CPU1: 0x00000000000000
[    0.058879] CPU features: Unsupported CPU feature variation detected.
[    0.058909] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.058975] smp: Brought up 1 node, 2 CPUs
[    0.092959] SMP: Total of 2 processors activated.
[    0.097826] CPU features: detected: 32-bit EL0 Support
[    0.103148] CPU features: detected: CRC32 instructions
[    0.108579] CPU: All CPU(s) started at EL2
[    0.112822] alternatives: patching kernel code
[    0.120878] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.131097] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.138210] pinctrl core: initialized pinctrl subsystem
[    0.144729] NET: Registered protocol family 16
[    0.149747] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.157100] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.165137] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.173698] thermal_sys: Registered thermal governor 'fair_share'
[    0.173708] thermal_sys: Registered thermal governor 'bang_bang'
[    0.180022] thermal_sys: Registered thermal governor 'step_wise'
[    0.186269] thermal_sys: Registered thermal governor 'user_space'
[    0.192777] ASID allocator initialised with 65536 entries
[    0.205217] pstore: Registered ramoops as persistent store backend
[    0.211652] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.246534] cryptd: max_cpu_qlen set to 1000
[    0.253296] SCSI subsystem initialized
[    0.257798] libata version 3.00 loaded.
[    0.262048] usbcore: registered new interface driver usbfs
[    0.267765] usbcore: registered new interface driver hub
[    0.273367] usbcore: registered new device driver usb
[    0.280714] clocksource: Switched to clocksource arch_sys_counter
[    0.287696] NET: Registered protocol family 2
[    0.292346] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.300221] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.308909] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.316962] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.324382] TCP: Hash tables configured (established 2048 bind 2048)
[    0.331048] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.337818] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.345134] NET: Registered protocol family 1
[    0.349658] PCI: CLS 0 bytes, default 64
[    0.353975] Unpacking initramfs...
[    1.536178] Freeing initrd memory: 12144K
[    1.542934] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    1.552266] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.558314] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.601087] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
[    1.609270] mtk-tphy 1a0c4000.usb-phy: failed to get ref_clk(id-1)
[    1.620079] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    1.634624] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.643367] printk: console [ttyS0] disabled
[    1.667996] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 22, base_baud = 1562500) is a ST16650V2
[    1.677497] printk: console [ttyS0] enabled
[    1.677497] printk: console [ttyS0] enabled
[    1.685869] printk: bootconsole [uart8250] disabled
[    1.685869] printk: bootconsole [uart8250] disabled
[    1.716322] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 23, base_baud = 1562500) is a ST16650V2
[    1.726334] 1100c000.serial: ttyS2 at MMIO 0x1100c000 (irq = 27, base_baud = 17499995) is a MediaTek BTIF
[    1.736050] serial serial0: tty port ttyS2 registered
[    1.741847] mtk_rng 1020f000.rng: registered RNG driver
[    1.741860] hwrng: no data available
[    1.750676] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.759273] loop: module loaded
[    1.762488] Loading iSCSI transport class v2.0-870.
[    1.769148] mtk-snand 1100d000.snfi: chip is FM35Q1GA, size 128MB, page size 2048, oob size 64
[    1.781563] 4 fixed-partitions partitions found on MTD device 1100d000.snfi
[    1.788527] Creating 4 MTD partitions on "1100d000.snfi":
[    1.793955] 0x000000000000-0x000000080000 : "bl2"
[    1.799576] 0x000000080000-0x0000001c0000 : "fip"
[    1.806073] 0x0000001c0000-0x0000002c0000 : "factory"
[    1.812671] 0x000000300000-0x000008000000 : "ubi"
[    1.846182] random: fast init done
[    1.980067] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc0113c0000, irq 37
[    1.990896] i2c /dev entries driver
[    1.995696] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    2.007223] NET: Registered protocol family 10
[    2.012550] Segment Routing with IPv6
[    2.016252] NET: Registered protocol family 17
[    2.020750] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.033839] 8021q: 802.1Q VLAN Support v1.8
[    2.039169] pstore: Using crash dump compression: deflate
[    2.054408] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    2.060992] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    2.066827] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    2.091385] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    2.097570] pci_bus 0000:00: root bus resource [bus 00-ff]
[    2.103065] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    2.109932] pci_bus 0000:00: scanning bus
[    2.113988] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    2.120015] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    2.128990] pci_bus 0000:00: fixups for bus
[    2.133190] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    2.139884] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.147895] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    2.154734] pci_bus 0000:01: scanning bus
[    2.158958] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    2.165146] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    2.172469] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    2.179788] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    2.187749] pci 0000:01:00.0: supports D1 D2
[    2.192014] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    2.198643] pci 0000:01:00.0: PME# disabled
[    2.203126] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.242106] pci_bus 0000:01: fixups for bus
[    2.246294] pci_bus 0000:01: bus scan returning with max=01
[    2.251880] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    2.258491] pci_bus 0000:00: bus scan returning with max=01
[    2.264078] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    2.271731] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    2.279726] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    2.286512] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    2.294341] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    2.302166] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    2.309984] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.314949] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    2.321828] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
[    2.328433] pcieport 0000:00:00.0: assign IRQ: got 0
[    2.333406] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    2.339508] pcieport 0000:00:00.0: enabling bus mastering
[    2.345451] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    2.351998] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    2.357830] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    2.466037] mtk-pcie 1a145000.pcie: Port1 link down
[    2.471049] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    2.477226] pci_bus 0001:00: root bus resource [bus 00-ff]
[    2.482716] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    2.489582] pci_bus 0001:00: scanning bus
[    2.494818] pci_bus 0001:00: fixups for bus
[    2.498993] pci_bus 0001:00: bus scan returning with max=00
[    2.504910] mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
[    2.513188] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    2.590248] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=145)
[    2.610120] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=146)
[    2.630002] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=147)
[    2.649864] mt7530 mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=148)
[    2.669897] mt7530 mdio-bus:00 wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=149)
[    2.681800] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
[    2.688886] DSA: tree 0 setup
[    2.689047] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.692657] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    2.704351] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[    2.713417] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000210010
[    2.722506] xhci-mtk 1a0c0000.usb: irq 31, io mem 0x1a0c0000
[    2.728626] hub 1-0:1.0: USB hub found
[    2.732427] hub 1-0:1.0: 2 ports detected
[    2.736707] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    2.741964] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[    2.749362] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
[    2.755677] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    2.764091] hub 2-0:1.0: USB hub found
[    2.767869] hub 2-0:1.0: 1 port detected
[    2.772908] UBI: auto-attach mtd3
[    2.776236] ubi0: attaching mtd3
[    3.162596] ubi0: scanning is finished
[    3.170434] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[    3.175946] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.182824] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.189603] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.196559] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[    3.202646] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[    3.209858] ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 344449439
[    3.218897] ubi0: available PEBs: 825, total reserved PEBs: 175, PEBs reserved for bad PEB handling: 20
[    3.228299] ubi0: background thread "ubi_bgt0d" started, PID 844
[    3.234671] Freeing unused kernel memory: 448K
[    3.270756] Run /init as init process
[    3.274408]   with arguments:
[    3.277364]     /init
[    3.279626]   with environment:
[    3.282771]     HOME=/
[    3.285121]     TERM=linux
[    3.465338] init: Console is alive
[    3.468860] init: - watchdog -
[    3.475617] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.485989] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.502717] init: - preinit -

OpenWrt UBI installer

preparing backup of relevant flash areas...
4+0 records in
4+0 records out
10+0 records in
10+0 records out
8+0 records in
8+0 records out
16+0 records in
16+0 records out
Found MAC addresses block LAN: e8:9f:80:e9:53:c6 WAN: e8:9f:80:e9:53:c5
1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...
Seeking on mtd device '/dev/mtd2' to: 393216

Writing from /tmp/macs-fixed to /dev/mtd2 ...
found factory partition at offset 00000000, rewriting...1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...

Writing from /tmp/factory-fixed to /dev/mtd2 ...
redundantly write bl2 into the first 4 blocks
Unlocking /dev/mtd0 ...

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 131072

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 262144

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 393216

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
write FIP to NAND
Unlocking /dev/mtd1 ...

Writing from /installer/mt7622_linksys_e8450-u-boot.fip to /dev/mtd1 ...  [e]
Skipping bad block at 0x0006000
[    5.232722] ubi0: detaching mtd3
[    5.236598] random: procd: uninitialized urandom read (4 bytes read)
[    5.236769] ubi0: mtd3 is detached
ubiformat: mtd3 (nand), size 131072000 bytes (125.0 MiB), 1000 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 999 -- 100 % complete
ubiformat: 1000 eraseblocks have valid erase counter, mean value is 2
ubiformat: formatting erasebloc[   10.019895] random: crng init done
ubiformat: formatting eraseblock 999 -- 100 % complete
[   15.598102] ubi0: attaching mtd3
[   15.984863] ubi0: scanning is finished
[   15.992539] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[   15.998025] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   16.004931] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   16.011726] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[   16.018678] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[   16.024768] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[   16.031985] ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 1578943962
[   16.041112] ubi0: available PEBs: 976, total reserved PEBs: 24, PEBs reserved for bad PEB handling: 20
[   16.050418] ubi0: background thread "ubi_bgt0d" started, PID 911
UBI device number 0, total 1000 LEBs (126976000 bytes, 121.0 MiB), available 976 LEBs (123928576 bytes, 118.1 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv", alignment 1
Volume ID 1, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv2", alignment 1
write recovery ubi volume
Volume ID 2, size 66 LEBs (8380416 bytes, 7.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "recovery", alignment 1
writing backup files to ubi volume...
Volume ID 3, size 67 LEBs (8507392 bytes, 8.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "boot_backup", alignment 1
[   18.998237] UBIFS (ubi0:3): default file-system created
[   19.003775] UBIFS (ubi0:3): Mounting in unauthenticated mode
[   19.009541] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 942
[   19.042430] UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "boot_backup"
[   19.050263] UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   19.060192] UBIFS (ubi0:3): FS size: 7237632 bytes (6 MiB, 57 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[   19.070281] UBIFS (ubi0:3): reserved for root: 341850 bytes (333 KiB)
[   19.076719] UBIFS (ubi0:3): media format: w5/r0 (latest is w5/r0), UUID 50B7B990-170E-416F-900E-0606E8AA1B5B, small LPT model
[   19.462087] UBIFS (ubi0:3): un-mount UBI device 0
[   19.466806] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" stops
[   24.479447] reboot: Restarting system

F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!

I've tried this for 2 times with the same result at the end in logs: System halt!. And after power-cycling a device I have the same logs like I had in the starting point of all story

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02B0 [000F]
Jump to BL

NOTICE:  BL2: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE:  BL2: Built : 19:55:52, May  6 2022
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE:  BL31: Built : 19:55:52, May  6 2022

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02B0 [000F]
Jump to BL

NOTICE:  BL2: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE:  BL2: Built : 19:55:52, May  6 2022
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.4(release):OpenWrt v2021-05-08-d2c75b21-2 (mt7622-snand-1ddr)
NOTICE:  BL31: Built : 19:55:52, May  6 2022

Am I missing something?

UPD: I made an attempt to restore from complete backup (mtd[0123] files). I flashed *recovery.itb file first via TFTP, it boots, shows LUCI interface at 192.168.1.1 and allows to login over ssh and copy backup files, but mtd3 file was too big for a /tmp dir, I think that because a kernel does not see more than 256 MB of memory, I've noticed that only later from the bootlogs above

...
DRAM:  256 MiB
...

and

[    0.000000] Memory: 220720K/262144K available (8254K kernel code, 896K rwdata, 1440K rodata, 448K init, 302K bss, 41424K reserved, 0K cma-reserved)

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
tmpfs                   113.9M     70.6M     43.3M  62% /
tmpfs                   113.9M     92.5M     21.4M  81% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev

My poor-man's plan was to split mtd3 file into two parts, one goes to /tmp and another to / and run cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3 as it seems that mtd command supports reading from stdin.
So, recovery process logs:

root@OpenWrt:~# ubidetach -d 0
root@OpenWrt:~# insmod mtd-rw i_want_a_brick=1
root@OpenWrt:~# mtd write /tmp/mtd0 /dev/mtd0
Unlocking /dev/mtd0 ...

Writing from /tmp/mtd0 to /dev/mtd0 ...
root@OpenWrt:~# mtd write /tmp/mtd1 /dev/mtd1
Unlocking /dev/mtd1 ...

Writing from /tmp/mtd1 to /dev/mtd1 ...  [e]
Skipping bad block at 0x00060000[e]Failed to get erase block status

root@OpenWrt:~# mtd write /tmp/mtd2 /dev/mtd2
Unlocking /dev/mtd2 ...

Writing from /tmp/mtd2 to /dev/mtd2 ...
root@OpenWrt:~# cat /tmp/mtd3_part1 /mtd3_part2 | mtd write - /dev/mtd3
Unlocking /dev/mtd3 ...

Writing from <stdin> to /dev/mtd3 ...
root@OpenWrt:~# mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img  /dev/mtd3
Unlocking /dev/mtd3 ...
Seeking on mtd device '/dev/mtd3' to: 2097152

Writing from /tmp/FW_RT3200_1.0.01.101415_prod.img to /dev/mtd3 ...

Looks like it has some sort of bad block error when writing mtd1
And after reboot I have this in UART:

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036D [000F]
Jump to BL

UNIVPLL_CON0 = 0xFE000000!!!
mt_pll_init: Set pll frequency for 25M crystal
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic_init] Preloader Start..................
[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2  0:E3
[pmic_init] Done...................
Chip part number:7622B
MT7622 Version: 1.2.8, (iPA)
SSC OFF
mt_pll_post_init: mt_get_cpu_freq = 1350000Khz
mt_pll_post_init: mt_get_mem_freq = 1600000Khz
mt_pll_post_init: mt_get_bus_freq = 1119920Khz
[PLFM] Init I2C: OK(0)

[BLDR] Build Time: 20200522-165358
==== Dump RGU Reg ========
RGU MODE:     4D
RGU LENGTH:   FFE0
RGU STA:      0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
 mtk_wdt_mode_config  mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
WDT NONRST=0x20000000
WDT IRQ_EN=0x340003
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
[EMI] MDL number = 2
[EMI] DRAMC calibration start

[EMI] DRAMC calibration end

[EMI]rank size auto detect
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x48000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x50000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0xEDCBA987, test_addr[0x60000000]= 0xEDCBA987
[EMI]rank0 size: 0x20000000
[MEM] complex R/W mem test pass
RAM_CONSOLE wdt status (0x0)=0x0
[BBT] BMT.v2 is found at 0x3FF
[PLFM] Init Boot Device: OK(0)

[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000007FFFF] "PRELOADER" (256 blocks)
[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (128 blocks)
[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (256 blocks)

Device APC domain init setup:

Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x0)
Domain Setup (0x0)
[PART] Image with part header
[PART] name : U-Boot
[PART] addr : 41E00000h mode : -1
[PART] size : 342676
[PART] magic: 58881688h

[PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS]
[PART] load speed: 16731KB/s, 342676 bytes, 20ms
load lk (ret=0)
[PART] Image with part header
[PART] name : atf
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 57936
[PART] magic: 58881688h

[PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS]
[PART] load speed: 14144KB/s, 57936 bytes, 4ms
load tee1 (ret=0)
[BLDR] bldr load tee part ret=0x0, addr=0x43001000
[BLDR] boot part. not found
[BLDR] part_load_images ret=0x0
[BLDR] Others, jump to ATF

[BLDR] jump to 0x41E00000
[BLDR] <0x41E00000>=0xEA00000F
[BLDR] <0x41E00004>=0xE59FF014

And nothing... It allows me to make another round of JTAG-thing recovery and getting into U-Boot console with MT7622> prompt, but I don't know what do next in this situation.