Belkin RT3200/Linksys E8450 WiFi AX discussion

daniel · January 14, 2024, 11:54pm

@wavejumper00 How long has this device been running? Can you give us a short timeline (manufactoring date, if known, when did you initially flash OpenWrt, how long it has been running sice). I start getting the feeling this happens a bit too often now.

Old age of the flash chip could explain it, and as a countermeasure we could update the installer and move FIP into UBI instead of storing it at an offset in the raw flash. @hackpascal has recently added UBI support to MediaTek's ARM TrustedFirmware-A, and it works great. That will give us scrubbing, at least, and a CRC-32. On top of that we could add redundancy and store two copies of FIP image (would be easy to implement).

This will require a bump of COMPAT_VERSION and need everyone to re-run an updated installer to make the switch, but that will hopefully rescue a lot of devices which otherwise would sooner or later die in the same way as those reported dead by a couple of users already.

However, if the cause is a damage to RAM or the SoC itself, we have to find out what caused it. Just old age combined with low quality or have we been contributing to a premature death somehow? Replacing the RAM or even the SoC is surely possible, but by no means easy to accomplish and not feasible for most users.

wavejumper00 · January 15, 2024, 1:39am

Thanks for the reply @daniel.

I bought them on ebay from someone that has sold over a thousand of them and still have six left as of today:

https://www.ebay.com/itm/304334846904

I got them Oct 21, 2023. I don't know the manufacturing date. They looked brand new in the box when I opened them. The internal packaging didn't appear to have been opened and the wall wart cable was still perfectly coiled and wire-tied like it was new. I don't know if they were really new though.

They had stock firmware version 1.0 if I recall correctly. I flashed openWRT right away and have been running them 24/7 ever since until this brief power outage issue. So not quite three months of use. I find it quite odd that the same power outage made both devices fail.

If you know where to get the manufacturing date info, I'll try to find it for you. I didn't keep the boxes and the stickers on the bottom of the devices don't seem to show it. I can share serial numbers if helpful.

I'm trying to get a raspberry pi zero that I have setup to connect to the jtag port. Although this is not something I have previous experience with but have read a bunch about it. I also have a RPI 4B that I can try if I can't get the zero to work. I don't have any other devices like FTDI FT2232H that you've mentioned in other parts of the thread.

If I can recover uboot, I can try to flash an updated version you want to experiment with. Replacing the ram chip is likely beyond my soldering skills/equipment.

Thanks again,
Jason

hackpascal · January 15, 2024, 2:18am

All scripts in https://github.com/mtk-openwrt/openocd-scripts are tested with Bus Blaster v4 which is able to halt the CPU before running into BL2. I didn't use any retail devices for test. Instead, MediaTek RFBs are used.

If you can't halt the CPU before running into BL2, you can try to connect SPI-NAND's MISO pin to GND directly before reset halt and disconnect them before loading u-boot.

As for the error Failed to read ESR_EL3 register, you can re-compile openocd with patches I provide:

gssjshark · January 16, 2024, 6:30am

I had a similar issue arise. I ordered two RT3200s online from Ebay. One came with 1.0.x installed and the other came with 1.2.x installed. On the 1.2.x I had to use the signed installer version to perform the openwrt flash. I flashed both of them with openwrt and everything worked great. I put them back in the box to finish the setup up later. I tried to complete the setup two days later, I plug in the one that had 1.2.x before I flashed openwrt 23.05.2 and it booted up. While the one that had 1.0.x on it before the openwrt flash is no longer booting.

AmiSapphire · January 16, 2024, 12:34pm

Odd, the only recent thing that happened was that Sis's Belkin RT3200 factory reset out of the blue around New Year's Day 2024. (Though stuff like this is why I have config backups for both units.)

On "factory" backups, the supposed manufacturer date is stored in mtd5 (or mtd3 when dumped from OpenWRT). This is assuming the info in the dump is accurate.

With a hex editor on my own partition dumps:
Linksys E8450: manufacturer_date=2022/01/23
Belkin RT3200: manufacturer_date=2020/11/21

I looked at the routers and the boxes for such info... nope. Only present in the mtd5 partition. (Haven't bothered taking either unit apart for such info, but not expecting anything from that, however.)

Bought the Linksys E8450 December 31, 2022 and the Belkin RT3200 on January 24, 2023... both from eBay.

wavejumper00 · January 16, 2024, 7:32pm

Thanks for the info @AmiSapphire.

It looks like I only saved the factory partitions from the first one I flashed. But using HxD on the mtd3 file, I see the following info that might be of interest:

sw_version=1.0.0.1
modelNumber=RT3200
cert_region=US
hw_revision=1
hw_version=48SAR601.0GB
manufacturer_date=2021/04/14

I also got the jtag interface wired up to the raspberry pi. I could connect with JTAGenum.sh script I found. But not with the openocd that I installed with apt on the raspberry pi.

So I downloaded the latest openocd and patched it per some instructions I found in previous replies from @daniel. It now connects to the jtag interface per the log. But it gets a segmentation violation when running the command from @daniel previously posted config file (I ran line by line to figure it out):

eval $_smp_command

And $_smp_command was:

target smp mt7622.core0 mt7622.core1

I downloaded, patched and compiled like this:

git clone https://repo.or.cz/openocd.git
cd openocd
curl https://raw.githubusercontent.com/mtk-openwrt/openocd-scripts/main/patch/0001-armv8-do-not-read-ESR_EL3-in-AArch32-state.patch | git am
apt install libtool
./bootstrap |tee -i my_bootstrap.log
./configure --enable-bcm2835gpio |tee -i my_configure.log
make -j 2 |tee -i my_make.log

Maybe I'm missing some other configure option(s). If anyone else can share the configure options they are using it might be helpful. I've been searching google and the couple of OpenWRT threads I've found related to this - but can't find any info on specifically how to compile openocd. I've only found the specifics of how to patch.

Thanks a lot,
Jason

ka2107 · January 17, 2024, 5:08pm

Does the USB port in the Belkin RT3200 support USB 3.0 speeds? I see kmod-usb3 included in the default packages list but the device specifications list only mentions USB 2.0 as supported.

odrt · January 17, 2024, 6:37pm

The external Port on my E8450 is USB 2.0.

MT7622 SoC has one USB 3.0 controller integrated: https://www.mediatek.com/products/home-networking/mt7622

USB
USB 2.0 Host/Device, USB 3.0 Host

It makes sense to me to have the USB 3.0 driver installed by default on all targets with MT7622. If you connect a device via the external USB port you can verify with lsusb from usbutils that it is served by the USB 2.0 host controller:

lsusb -t
/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci-mtk/1p, 5000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci-mtk/2p, 480M
|__ Port 1: Dev 3, If 0, Class=, Driver=, 1.5M

If you don't believe the specs: plug a USB 3.x device into the port and use lsusb -t to verify if it will be served by the 2.0 or 3.0 controller.

wavejumper00 · January 17, 2024, 11:54pm

I have made it further in my attempt to recover one of my devices. I can now get the uboot running in memory through openocd and jtag interface. And I can run the tftpboot command to load the two image files. But if I power cycle the device it goes back to the beginning as if nothing was flashed.

Below are details. I'm sure this will get long so apologies but want to be complete in case someone else may want the info.

I'm using raspberry pi zero W with the headers I soldered in. Then I wire-wrapped to the following raspberry pi gpio/pin and soldered the other end to the jtag interface pins on the RT3200.

signal, rpi gpio number, rpi header pin number, RT3200 jtag pin number
TRST, 7, 26, 3
TDI, 10, 19, 5
TMS, 8, 24, 7
TCK, 11, 23, 9
TDO, 9, 21, 13
SRST, 24, 18, 15
GND, NA, 6, 20

I compiled openocd like this:

cd /usr/src
curl -L http://github.com/mtk-openwrt/openocd-scripts/archive/main.tar.gz | tar zxf -
#to make match Daniel's locations:
mv openocd-scripts-main mtk-openocd-scripts

git clone https://repo.or.cz/openocd.git
cd openocd
#curl https://raw.githubusercontent.com/mtk-openwrt/openocd-scripts/main/patch/0001-armv8-do-not-read-ESR_EL3-in-AArch32-state.patch | git am

cat /usr/src/mtk-openocd-scripts/patch/0001-armv8-do-not-read-ESR_EL3-in-AArch32-state.patch | git am
cat /usr/src/mtk-openocd-scripts/patch/0002-target-aarch64-enable-disable-mmu-new-commands.patch | git am

apt install build-essential git autoconf libtool make pkg-config libusb-1.0-0 libusb-1.0-0-dev tcl
./bootstrap |tee -i my_bootstrap.log
./configure --enable-sysfsgpio --enable-bcm2835gpio |tee -i my_configure.log
make -j 2 |tee -i my_make.log

Then once built, I ran the following to start openocd:

./src/openocd -f openocd.cfg -f /usr/src/mtk-openocd-scripts/mt7622/mt7622.cfg

Here is the content of my openocd.cfg file (which was modified from openocd tcl/interface/raspberrypi-native.cfg file):

# SPDX-License-Identifier: GPL-2.0-or-later

# Config for Raspberry Pi used as a bitbang adapter.
# https://www.raspberrypi.com/documentation/computers/raspberry-pi.html

# Supports all models with 40-pin or 26-pin GPIO connector up to Raspberry Pi 4 
B
# also supports Raspberry Pi Zero, Zero W and Zero 2 W.

# Adapter speed calibration is computed from cpufreq/scaling_max_freq.
# Adjusts automatically if CPU is overclocked.

adapter driver bcm2835gpio
adapter speed 50

proc read_file { name } {
        if {[catch {open $name r} fd]} {
                return ""
        }
        set result [read $fd]
        close $fd
        return $result
}

proc measure_clock {} {
        set result [exec vcgencmd measure_clock arm]
        set clock_hz [lindex [split $result "="] 1]
        expr { $clock_hz / 1000 }
}

proc get_max_cpu_clock { default } {
        set clock [read_file /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq]
        if { $clock > 100000 } {
                return $clock
        }

        # cpufreq not available. As the last resort try Broadcom's proprietary utility
        if {![catch measure_clock clock] && $clock > 100000} {
                return $clock
        }

        echo "WARNING: Host CPU clock unknown."
        echo "WARNING: Using the highest possible value $default kHz as a safe default."
        echo "WARNING: Expect JTAG/SWD clock significantly slower than requested."

        return $default
}

set compat [read_file /proc/device-tree/compatible]
set clocks_per_timing_loop 4

if {[string match *bcm2711* $compat]} {
        set speed_offset 52
} elseif {[string match *bcm2837* $compat] || [string match *bcm2710* $compat]} {
        set speed_offset 34
} elseif {[string match *bcm2836* $compat] || [string match *bcm2709* $compat]} {
        set speed_offset 36
} elseif {[string match *bcm2835* $compat] || [string match *bcm2708* $compat]} {
        set clocks_per_timing_loop 6
        set speed_offset 32
} else {
        set speed_offset 32
        echo "WARNING: Unknown type of the host SoC. Expect JTAG/SWD clock slower than requested."
}

set clock [get_max_cpu_clock 2000000]
set speed_coeff [expr { $clock / $clocks_per_timing_loop }]

# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
# The coefficients depend on system clock and CPU frequency scaling.
bcm2835gpio speed_coeffs $speed_coeff $speed_offset

source raspberrypi-gpio-connector.cfg

#https://forum.openwrt.org/t/need-help-with-a-bricked-linksys-e8450/144836/16
adapter speed 10000
transport select jtag
#ftdi_tdo_sample_edge falling

#adapter srst delay 750
#jtag_ntrst_assert_width 100
#jtag_ntrst_delay 50

#reset_config trst_and_srst separate srst_gates_jtag srst_open_drain

# reset_config trst_only

# reset_config srst_only srst_push_pull

# or if you have both connected,
reset_config trst_and_srst srst_push_pull

Here is the content of my modified version of raspberrypi-gpio-connector.cfg file:

# SPDX-License-Identifier: GPL-2.0-or-later

#
# Config for Raspberry Pi GPIO header
#
# This is best used with a fast enough buffer but also
# is suitable for direct connection if the target voltage
# matches RPi's 3.3V and the cable is short enough.
#
# Do not forget the GND connection, e.g. pin 20 of the GPIO header.
#

# GPIO 25 (pin 22) previously used for TMS/SWDIO is pulled-down by default.
# The JTAG/SWD specification requires pull-up at the target board
# for either signal. Connecting the signal pulled-up on the target
# to the pull-down on the adapter is not a good idea.
# GPIO 8 is pulled-up by default.
echo "Warn : TMS/SWDIO moved to GPIO 8 (pin 24). Check the wiring please!"

# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
# Header pin numbers: 23 24 19 21
adapter gpio tck -chip 0 11
adapter gpio tms -chip 0 8
adapter gpio tdi -chip 0 10
adapter gpio tdo -chip 0 9

# Each of the SWD lines need a gpio number set: swclk swdio
# Header pin numbers: 23 24
adapter gpio swclk -chip 0 11
adapter gpio swdio -chip 0 8

# If you define trst or srst, use appropriate reset_config
# Header pin numbers: TRST - 26, SRST - 18

adapter gpio trst -chip 0 7
# reset_config trst_only

adapter gpio srst -chip 0 24
# reset_config srst_only srst_push_pull

# or if you have both connected,
reset_config trst_and_srst srst_push_pull

Here is the content of the mt7622.cfg file (unmodified from mtk-openwrt):

#
# The MediaTek MT7622 is a highly integrated wireless network router SoC for
# for high wireless performance, home entertainment and home automation.
#
# Product page:
# https://www.mediatek.com/products/homenetworking/mt7622
#
# Specifications:
# - Dual-core ARM Cortex-A53 MPCoreTM @ 1.35GHz
# − 32KB L1 I-Cache and 32KB L1 D-Cache
# − 512KB unified L2 Cache
# − NEON/FPU
#

if { [info exists CHIPNAME] } {
    set _CHIPNAME $CHIPNAME
} else {
    set _CHIPNAME mt7622
}

if { [info exists DAP_TAPID] } {
   set _DAP_TAPID $DAP_TAPID
} else {
   set _DAP_TAPID 0x4ba00477
}

set _COREBASE {0x80810000 0x80910000}
set _CTIBASE  {0x80820000 0x80920000}
set _CORES 2

# declare the one JTAG tap to access the DAP
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_DAP_TAPID -ignore-version -enable
dap create $_CHIPNAME.dap -chain-position $_CHIPNAME.cpu

# declare the main application cores
set _TARGETNAME $_CHIPNAME.cpu
set _smp_command ""

for { set _core 0 } { $_core < $_CORES } { incr _core 1 } {

    cti create cti$_core -dap $_CHIPNAME.dap -baseaddr [lindex $_CTIBASE $_core] -ap-num 1

    set _command "target create ${_TARGETNAME}$_core aarch64 \
                         -dap $_CHIPNAME.dap -coreid $_core \
                         -cti cti$_core -dbgbase [lindex $_COREBASE $_core]"

    if { $_core != 0 } {
        # non-boot core examination may fail
        set _command "$_command -defer-examine"
        set _smp_command "$_smp_command ${_TARGETNAME}$_core"
    } else {
        set _smp_command "target smp ${_TARGETNAME}$_core"
    }

    eval $_command
}

eval $_smp_command

targets ${_TARGETNAME}0

Then in another window, start the telnet session:

telnet localhost 4444

Here are the commands I used in the telnet session. They are mainly from /usr/src/mtk-openocd-scripts/mt7622/readme.txt file:

halt
mww 0x10212000 0x22000000
mt7622.cpu0 configure -work-area-phys 0x101000 -work-area-size 8096

set cp [aarch64 mrc 15 0 1 0 0]
#Had to change expr syntax due to jimtcl 0.81 change included in openocd:
set cp [expr {$cp & ~1}]
aarch64 mcr 15 0 1 0 0 $cp

reg cpsr

reg cpsr 0x1d3

load_image /usr/src/mtk-openocd-scripts/mt7622/switch_mode_32_64.bin 0x100000 bin
load_image /usr/src/mtk-openocd-scripts/mt7622/aarch64_stall.bin 0x100100 bin
reg pc 0x100000
resume

halt
load_image /usr/src/mtk-openocd-scripts/mt7622/bl2-1c.bin 0x201000 bin
reg pc 0x201000
resume

halt
load_image /usr/src/mtk-openocd-scripts/mt7622/fip-snand-no-bmt.bin 0x40020000 bin
mww 0x100200 1
resume

Here is copy/paste of the telnet session output which looks like it worked:

root@raspberrypi:~# telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
> set cp [aarch64 mrc 15 0 1 0 0]
0xc50838
> set cp [expr {$cp & ~1}]
12912696
> aarch64 mcr 15 0 1 0 0 $cp
> reg cpsr
cpsr (/32): 0x600001f3
> poll
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x600001f3 pc: 0x0000b9d8
MMU: disabled, D-Cache: disabled, I-Cache: disabled
background polling: on
TAP: mt7622.cpu (enabled)
> reg cpsr 0x1d3
cpsr (/32): 0x000001d3
> poll
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000001d3 pc: 0x0000b9d8
MMU: disabled, D-Cache: disabled, I-Cache: disabled
background polling: on
TAP: mt7622.cpu (enabled)
> load_image /usr/src/mtk-openocd-scripts/mt7622/switch_mode_32_64.bin 0x100000 bin
68 bytes written at address 0x00100000
downloaded 68 bytes in 0.009850s (6.742 KiB/s)
> load_image /usr/src/mtk-openocd-scripts/mt7622/aarch64_stall.bin 0x100100 bin
4 bytes written at address 0x00100100
downloaded 4 bytes in 0.006032s (0.648 KiB/s)
> reg pc 0x100000
pc (/64): 0x0000000000100000
> resume
mt7622.cpu0: Timeout waiting for resumex

> halt
mt7622.cpu0 halted in AArch64 state due to debug-request, current mode: EL3H
cpsr: 0x000003cd pc: 0x100100
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> load_image /usr/src/mtk-openocd-scripts/mt7622/bl2-1c.bin 0x201000 bin
46133 bytes written at address 0x00201000
downloaded 46133 bytes in 0.356745s (126.286 KiB/s)
> reg pc 0x201000
pc (/64): 0x0000000000201000
> resume
> halt
mt7622.cpu0 halted in AArch64 state due to debug-request, current mode: EL3T
cpsr: 0x200002cc pc: 0x207d38
MMU: disabled, D-Cache: disabled, I-Cache: enabled
> load_image /usr/src/mtk-openocd-scripts/mt7622/fip-snand-no-bmt.bin 0x40020000 bin
616606 bytes written at address 0x40020000
downloaded 616606 bytes in 3.993011s (150.802 KiB/s)
> mww 0x100200 1
> resume

And the serial output looks like it works to get to the uboot prompt:

F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!

NOTICE:  BL2: v2.4(release):516c195bf-dirty
NOTICE:  BL2: Built : 18:53:46, Feb  2 2021
INFO:    BL2: Doing platform setup
INFO:    PMIC: MediaTek MT6380 E3
INFO:    EMI: DRAMC calibration done
INFO:    EMI: Rank size auto detect
INFO:    EMI: Rank size: 0x20000000
INFO:    EMI: complex R/W mem test passed
INFO:    BL2: Loading image id 3
INFO:    Loading image id=3 at address 0x43001000
INFO:    Image id=3 loaded: 0x43001000 - 0x4300c0dd
INFO:    BL2: Loading image id 5
INFO:    Loading image id=5 at address 0x41e00000
INFO:    Image id=5 loaded: 0x41e00000 - 0x41e8b739
NOTICE:  BL2: Booting BL31
INFO:    Entry point address = 0x43001000
INFO:    SPSR = 0x3cd
INFO:    Secondary bootloader is AArch64
NOTICE:  BL31: v2.4(release):638b6e19e
NOTICE:  BL31: Built : 10:17:31, Feb 25 2021
INFO:    ARM GICv2 driver initialized
INFO:    BL31: Initializing runtime services
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x41e00000
INFO:    SPSR = 0x3c9
serial_mtk serial@11002000: pinctrl_select_state_full: uclass_get_device_by_phandle_id: err=-19


U-Boot 2021.04-rc3-gdc001ffc7d-dirty (Mar 05 2021 - 17:10:16 +0800)

CPU:   MediaTek MT7622
Model: mt7622-rfb
DRAM:  256 MiB
WDT:   Started with servicing (60s timeout)
MMC:   mmc@11230000: 0, mmc@11240000: 1
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@1b100000 (eth0) using random MAC address - ae:54:c2:5d:13:d1
eth0: ethernet@1b100000
MT7622>

If I run the tftpboot to load the two files and it looks like works:

MT7622> tftpboot openwrt_recovery.itb
Using ethernet@1b100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt_recovery.itb'.
Load address: 0x4007ff28
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############################################################
         6.7 MiB/s
done
Bytes transferred = 7602176 (740000 hex)

MT7622> tftpboot openwrt_sysupgrade.itb
Using ethernet@1b100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt_sysupgrade.itb'.
Load address: 0x4007ff28
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################
         6.8 MiB/s
done
Bytes transferred = 9863475 (968133 hex)
MT7622>

BTW - the file names above were shortened when i put them on the tftp server so it was easier for me to type into the serial console. The original files I used were:

openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb

openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

But if I power cycle, it doesn't work. It comes back to "System halt!" or the "failed to load BL2" message again.

Is there anything else I can check from the uboot menu to see if the flash chip is working? I'm new to this and have experimented with some commands but nothing seems to show a working SPI flash chip.

MT7622> sf read
No SPI flash selected. Please run `sf probe'


MT7622> sf probe
spi frequency: 46666653 Hz
jedec_spi_nor spi-flash@0: unrecognized JEDEC id bytes: ff, e5, 71
Failed to initialize SPI flash at 0:0 (error -2)

MT7622> bdinfo
boot_params = 0x0000000040000100
DRAM bank   = 0x0000000000000000
-> start    = 0x0000000040000000
-> size     = 0x0000000010000000
flashstart  = 0x0000000000000000
flashsize   = 0x0000000000000000
flashoffset = 0x0000000000000000
baudrate    = 115200 bps
relocaddr   = 0x000000004ff5c000
reloc off   = 0x000000000e15c000
Build       = 64-bit
current eth = ethernet@1b100000
ethaddr     = (not set)
IP addr     = 192.168.1.1
fdt_blob    = 0x000000004f7fd3e0
new_fdt     = 0x000000004f7fd3e0
fdt_size    = 0x00000000000029c0
lmb_dump_all:
    memory.cnt             = 0x1
    memory.size            = 0x0
    memory.reg[0x0].base   = 0x40000000
                   .size   = 0x10000000

    reserved.cnt           = 0x1
    reserved.size          = 0x0
    reserved.reg[0x0].base = 0x4f7fb8e0
                     .size = 0x804720
arch_number = 0x0000000000000000
TLB addr    = 0x000000004fff0000
irq_sp      = 0x000000004f7fd3d0
sp start    = 0x000000004f7fd3d0
Early malloc usage: 5b0 / 4000

Thanks,
Jason

callmesteve · January 18, 2024, 12:26am

The reboot-of-death thing is getting sincerely concerning. I'd like to use one of these as my main router so, ah, yeah.

Any ETA on the updated installer? I like the sound of moving more stuff inside UBI and having backups, and I've got my first two (allegedly new) units on order from a hopefully not-too-sketchy Amazon reseller. I can wait for an update to the tool, but I'd rather like to make sure I know when it's ready.

Is the general consensus otherwise still to add a line to rc.local disabling the automatic CPU speed switch for now, or limiting how low it can drop?
(Though, given that this was most recently experienced after a power outage, this theory gets slightly less likely to me as that would hard-reset the CPU where the previous speed-step could no longer apply, compared to a reboot where it could conceivably persist in a register.)

Also, I was reading the documentation about the installer, and it states that it backs everything up to "a dedicated UBI volume boot_backup." Once I've copied those files to my computer (ideally in a few places), should I delete this volume?

I didn't see anything either way in the guide and I was wondering if this would free up significant space or leave more unused nand for UBI to wear-level. (Or it could just increase the chances of breaking stuff if I resize volumes wrong, something I've not done before, assuming that resizing them wouldn't break assumptions from the bootloader.)

ricky92 · January 18, 2024, 1:12pm

I have recently gone through the process of restoring my BT3200 through JTAG and I had to put together various pieces of the puzzle from different sources in order to succeed.
@wavejumper00 Once you've loaded your image through the tftpboot command, you need to boot the image by running bootm and use the web interface to flash a sysupgrade image.

I bricked my device after an attempted upgrade to 23.05.2 (using the attended-sysupgrade method mentioned on the installer's github page).
The device wouldn't boot and after connecting a serial adapter I was getting the same ERROR: BL2: Failed to load image id 5 (-2) message. Even after all the JTAG recovery process, if I attempted to flash anything, I would still get that error. What solved it was reflashing the 23.05.0 installer image which I suppose reformatted the NAND.

wavejumper00 · January 18, 2024, 4:41pm

@ricky92 - Thank you very much!!

bootm was certainly a part I was missing. I had tried it before but got nothing. But I think I ran it before the tftpboot when I had tried it (IIRC), so there was no in memory image to boot from at the time.

BTW - I did find a command that shows my flash is present:

MT7622> mtd list
List of MTD devices:
* spi-nand0
  - device: snand@1100d000
  - parent: root_driver
  - driver: mtk-snand
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 64 bytes
  - OOB available: 28 bytes
  - ECC strength: 16 bits
  - ECC step size: 512 bytes
  - bitflip threshold: 12 bits
  - 0x000000000000-0x000008000000 : "spi-nand0"

And I can read from it. For example:

MT7622> mtd dump spi-nand0
Reading 2048 byte(s) (1 page(s)) at offset 0x00000000

Dump 2048 data bytes from 0x00000000:
0x00000000:     42 4f 4f 54 4c 4f 41 44  45 52 21 00 56 30 30 36
0x00000010:     4e 46 49 49 4e 46 4f 00  00 00 00 08 03 00 40 00
0x00000020:     40 00 00 08 10 00 16 00  00 00 00 00 00 00 00 00
<snipped>

I also was able to use the recovery installer image with tftpboot and after bootm it got farther, but still not quite far enough:

MT7622> tftpboot openwrt_recovery_installer.itb
Using ethernet@1b100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt_recovery_installer.itb'.
Load address: 0x4007ff28
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################

         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####
         6.4 MiB/s
done
Bytes transferred = 15335424 (ea0000 hex)
MT7622> bootm
## Loading kernel from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.134
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x40080028
     Data Size:    3755115 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   4ec70e58
     Hash algo:    sha1
     Hash value:   278bb02b7fb27a69384e0d25856697503e4a6955
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x40414dd0
     Data Size:    11465660 Bytes = 10.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   a7d4d31c
     Hash algo:    sha1
     Hash value:   7865e4fb8edb7ea975521c7e10e0f3dca16ca7c6
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x40f0429c
     Data Size:    30437 Bytes = 29.7 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   7d2c225b
     Hash algo:    sha1
     Hash value:   ac8cc5835e8b2480ddf31f8eec8d12950ad44674
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x40f0429c
   Uncompressing Kernel Image
   Loading Ramdisk to 4ed0c000, end 4f7fb3bc ... OK
   Loading Device Tree to 000000004ed01000, end 000000004ed0b6e4 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.134 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23497-6637af95aa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Oct 9 21:45:35 2023
[    0.000000] Machine model: Linksys E8450 (UBI)
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 17 pages/cpu s30040 r8192 d31400 u69632
[    0.000000] pcpu-alloc: s30040 r8192 d31400 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 233708K/262144K available (8384K kernel code, 904K rwdata, 1416K rodata, 448K init, 308K bss, 28436K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: 0xffffffc008423cb4
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000001] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.008504] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.019237] pid_max: default: 32768 minimum: 301
[    0.024295] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.031785] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.041072] rcu: Hierarchical SRCU implementation.
[    0.046504] smp: Bringing up secondary CPUs ...
[    0.051581] Detected VIPT I-cache on CPU1
[    0.051592] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x00000000bebc20, CPU1: 0x00000000000000
[    0.051611] CPU features: Unsupported CPU feature variation detected.
[    0.051642] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.051714] smp: Brought up 1 node, 2 CPUs
[    0.085697] SMP: Total of 2 processors activated.
[    0.090566] CPU features: detected: 32-bit EL0 Support
[    0.095886] CPU features: detected: CRC32 instructions
[    0.101234] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.109947] CPU: All CPU(s) started at EL2
[    0.114192] alternatives: patching kernel code
[    0.123292] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.133504] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.140683] pinctrl core: initialized pinctrl subsystem
[    0.147009] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.153463] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.160811] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.168850] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.177334] thermal_sys: Registered thermal governor 'fair_share'
[    0.177338] thermal_sys: Registered thermal governor 'bang_bang'
[    0.183646] thermal_sys: Registered thermal governor 'step_wise'
[    0.189874] thermal_sys: Registered thermal governor 'user_space'
[    0.196301] ASID allocator initialised with 65536 entries
[    0.208578] pstore: Registered ramoops as persistent store backend
[    0.214985] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.241612] cryptd: max_cpu_qlen set to 1000
[    0.248628] SCSI subsystem initialized
[    0.252735] libata version 3.00 loaded.
[    0.257980] clocksource: Switched to clocksource arch_sys_counter
[    0.264958] NET: Registered PF_INET protocol family
[    0.270123] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.278040] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.286705] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.294740] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.302779] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.310206] TCP: Hash tables configured (established 2048 bind 2048)
[    0.316867] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.323647] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.331018] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.336896] PCI: CLS 0 bytes, default 64
[    0.341151] Unpacking initramfs...
[    0.350451] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.360819] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.366875] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.410000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.419164] mt7622-pinctrl 10211000.pinctrl: invalid group "pwm_ch7_2" for function "pwm"
[    0.432285] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    0.454069] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.462982] printk: console [ttyS0] disabled
[    0.487652] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 125, base_baud = 1562500) is a ST16650V2
[    0.497281] printk: console [ttyS0] enabled
[    0.497281] printk: console [ttyS0] enabled
[    0.505695] printk: bootconsole [uart8250] disabled
[    0.505695] printk: bootconsole [uart8250] disabled
[    0.536376] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 126, base_baud = 1562500) is a ST16650V2
[    0.546477] 1100c000.serial: ttyS2 at MMIO 0x1100c000 (irq = 130, base_baud = 17499995) is a MediaTek BTIF
[    0.556327] serial serial0: tty port ttyS2 registered
[    0.563034] mtk_rng 1020f000.rng: registered RNG driver
[    0.568793] random: crng init done
[    0.575430] loop: module loaded
[    0.578642] Loading iSCSI transport class v2.0-870.
[    0.584600] mtk-ecc 1100e000.ecc: probed
[    0.592644] spi-nand spi2.0: Fidelix SPI NAND was found.
[    0.598056] spi-nand spi2.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.606262] mtk-snand 1100d000.spi: ECC strength: 4 bits per 512 bytes
[    1.493047] Freeing initrd memory: 11196K
[    1.505484] 4 fixed-partitions partitions found on MTD device spi2.0
[    1.511905] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.518211] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.524771] Creating 4 MTD partitions on "spi2.0":
[    1.529602] 0x000000000000-0x000000080000 : "bl2"
[    1.535627] 0x000000080000-0x0000001c0000 : "fip"
[    1.542502] 0x0000001c0000-0x0000002c0000 : "factory"
[    1.549107] 0x000000300000-0x000008000000 : "ubi"
[    1.811598] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc008ea0000, irq 141
[    1.821514] i2c_dev: i2c /dev entries driver
[    1.827093] mtk-wdt 10212000.watchdog: IRQ index 0 not found
[    1.832993] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.843131] NET: Registered PF_INET6 protocol family
[    1.849108] Segment Routing with IPv6
[    1.852787] In-situ OAM (IOAM) with IPv6
[    1.856754] NET: Registered PF_PACKET protocol family
[    1.861871] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.875051] 8021q: 802.1Q VLAN Support v1.8
[    1.880448] pstore: Using crash dump compression: deflate
[    1.895814] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    1.902410] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    1.908260] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    2.044467] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    2.050688] pci_bus 0000:00: root bus resource [bus 00-ff]
[    2.056176] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    2.063054] pci_bus 0000:00: scanning bus
[    2.067270] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    2.073467] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    2.083472] pci_bus 0000:00: fixups for bus
[    2.087679] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    2.094399] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.102470] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    2.109593] pci_bus 0000:01: scanning bus
[    2.113816] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    2.120018] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    2.127346] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    2.134675] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    2.142650] pci 0000:01:00.0: supports D1 D2
[    2.146916] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    2.153560] pci 0000:01:00.0: PME# disabled
[    2.158070] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.201423] pci_bus 0000:01: fixups for bus
[    2.205635] pci_bus 0000:01: bus scan returning with max=01
[    2.211244] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    2.217884] pci_bus 0000:00: bus scan returning with max=01
[    2.223477] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    2.231132] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    2.239140] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    2.245925] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    2.253757] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    2.261585] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    2.269409] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.274371] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    2.281300] pcieport 0000:00:00.0: assign IRQ: got 146
[    2.286443] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    2.292555] pcieport 0000:00:00.0: enabling bus mastering
[    2.297998] mtk-pcie 1a143000.pcie: msi#0 address_hi 0x0 address_lo 0x44d2d0c0
[    2.305405] pcieport 0000:00:00.0: PME: Signaling with IRQ 146
[    2.311345] pcieport 0000:00:00.0: saving config space at offset 0x0 (reading 0x325814c3)
[    2.319540] pcieport 0000:00:00.0: saving config space at offset 0x4 (reading 0x100006)
[    2.327539] pcieport 0000:00:00.0: saving config space at offset 0x8 (reading 0x6040000)
[    2.335628] pcieport 0000:00:00.0: saving config space at offset 0xc (reading 0x10000)
[    2.343542] pcieport 0000:00:00.0: saving config space at offset 0x10 (reading 0xc)
[    2.351195] pcieport 0000:00:00.0: saving config space at offset 0x14 (reading 0x0)
[    2.358852] pcieport 0000:00:00.0: saving config space at offset 0x18 (reading 0x40010100)
[    2.367108] pcieport 0000:00:00.0: saving config space at offset 0x1c (reading 0x4200000)
[    2.375282] pcieport 0000:00:00.0: saving config space at offset 0x20 (reading 0x20102000)
[    2.383546] pcieport 0000:00:00.0: saving config space at offset 0x24 (reading 0x0)
[    2.391200] pcieport 0000:00:00.0: saving config space at offset 0x28 (reading 0x0)
[    2.398854] pcieport 0000:00:00.0: saving config space at offset 0x2c (reading 0x0)
[    2.406504] pcieport 0000:00:00.0: saving config space at offset 0x30 (reading 0x0)
[    2.414156] pcieport 0000:00:00.0: saving config space at offset 0x34 (reading 0x50)
[    2.421897] pcieport 0000:00:00.0: saving config space at offset 0x38 (reading 0x0)
[    2.429550] pcieport 0000:00:00.0: saving config space at offset 0x3c (reading 0x20192)
[    2.438121] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    2.444675] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    2.450518] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    2.678054] mtk-pcie 1a145000.pcie: Port1 link down
[    2.683130] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    2.689336] pci_bus 0001:00: root bus resource [bus 00-ff]
[    2.694824] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    2.701706] pci_bus 0001:00: scanning bus
[    2.707482] pci_bus 0001:00: fixups for bus
[    2.711671] pci_bus 0001:00: bus scan returning with max=00
[    2.717870] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    2.793407] mt7530-mdio mdio-bus:00: configuring for fixed/2500base-x link mode
[    2.802668] mt7530-mdio mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.811746] mt7530-mdio mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=147)
[    2.832521] mt7530-mdio mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=148)
[    2.852864] mt7530-mdio mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=149)
[    2.873216] mt7530-mdio mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=150)
[    2.893809] mt7530-mdio mdio-bus:00 wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=151)
[    2.905088] DSA: tree 0 setup
[    2.908889] UBI: auto-attach mtd3
[    2.912224] ubi0: default fastmap pool size: 50
[    2.916747] ubi0: default fastmap WL pool size: 25
[    2.921542] ubi0: attaching mtd3
[    3.227060] ubi0: scanning is finished
[    3.236544] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[    3.242071] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.248952] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.255734] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.262692] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[    3.268781] ubi0: user volume: 6, internal volumes: 1, max. volumes count: 128
[    3.275994] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 162383981
[    3.285042] ubi0: available PEBs: 0, total reserved PEBs: 1000, PEBs reserved for bad PEB handling: 20
[    3.294356] ubi0: background thread "ubi_bgt0d" started, PID 517
[    3.301445] FIT: Default configuration: "config-1" (OpenWrt linksys_e8450-ubi)
[    3.308759] FIT:           kernel sub-image 0x00001000..0x004e68d7 "kernel-1" (ARM64 OpenWrt Linux-5.15.134)
[    3.318686] FIT:          flat_dt sub-image 0x004e7000..0x004ee712 "fdt-1" (ARM64 OpenWrt linksys_e8450-ubi device tree blob)
[    3.330084] FIT:       filesystem sub-image 0x004ef000..0x00967fff "rootfs-1" (ARM64 OpenWrt linksys_e8450-ubi rootfs)
[    3.340870] FIT: selecting configured loadable "rootfs-1" to be root filesystem
[    3.348182]  ubiblock0_4: p1(rootfs-1)
[    3.348398] block ubiblock0_4: created from ubi0:4(fit)
[    3.358320] Freeing unused kernel memory: 448K
[    3.398929] Run /init as init process
[    3.402600]   with arguments:
[    3.405564]     /init
[    3.407834]   with environment:
[    3.411003]     HOME=/
[    3.413361]     TERM=linux
[    3.621558] init: Console is alive
[    3.625090] init: - watchdog -
[    3.631861] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.642128] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.658925] init: - preinit -

OpenWrt UBI installer

preparing backup of relevant flash areas...
4+0 records in
4+0 records out
10+0 records in
10+0 records out
8+0 records in
8+0 records out
16+0 records in
16+0 records out
Found MAC addresses block LAN: e8:9f:80:ec:d5:5c WAN: e8:9f:80:ec:d5:5b
1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...
Seeking on mtd device '/dev/mtd2' to: 393216

Writing from /tmp/macs-fixed to /dev/mtd2 ...
found factory partition at offset 00000000, rewriting...1+0 records in
1+0 records out
Unlocking /dev/mtd2 ...

Writing from /tmp/factory-fixed to /dev/mtd2 ...
redundantly write bl2 into the first 4 blocks
Unlocking /dev/mtd0 ...

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 131072

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 262144

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
Unlocking /dev/mtd0 ...
Seeking on mtd device '/dev/mtd0' to: 393216

Writing from /installer/mt7622-snand-1ddr-bl2.img to /dev/mtd0 ...
write FIP to NAND
Unlocking /dev/mtd1 ...

Writing from /installer/mt7622_linksys_e8450-u-boot.fip to /dev/mtd1 ...
[    5.578952] block ubiblock0_4: released
[    5.582963] ubi0: detaching mtd3
[    5.588467] ubi0: mtd3 is detached
ubiformat: mtd3 (nand), size 131072000 bytes (125.0 MiB), 1000 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 999 -- 100 % complete
ubiformat: 1000 eraseblocks have valid erase counter, mean value is 0
ubiformat: formatting eraseblock 999 -- 100 % complete
[   15.830333] ubi0: default fastmap pool size: 50
[   15.834890] ubi0: default fastmap WL pool size: 25
[   15.839719] ubi0: attaching mtd3
[   16.144428] ubi0: scanning is finished
[   16.153160] ubi0: attached mtd3 (name "ubi", size 125 MiB)
[   16.158685] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   16.165558] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   16.172345] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[   16.179313] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
[   16.185400] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[   16.192622] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1223820877
[   16.201754] ubi0: available PEBs: 974, total reserved PEBs: 26, PEBs reserved for bad PEB handling: 20
[   16.211073] ubi0: background thread "ubi_bgt0d" started, PID 592
UBI device number 0, total 1000 LEBs (126976000 bytes, 121.0 MiB), available 974 LEBs (123674624 bytes, 117.9 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv", alignment 1
Volume ID 1, size 9 LEBs (1142784 bytes, 1.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubootenv2", alignment 1
write recovery ubi volume
Volume ID 2, size 60 LEBs (7618560 bytes, 7.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "recovery", alignment 1
writing backup files to ubi volume...
Volume ID 3, size 67 LEBs (8507392 bytes, 8.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "boot_backup", alignment 1
[   19.038927] UBIFS (ubi0:3): default file-system created
[   19.044469] UBIFS (ubi0:3): Mounting in unauthenticated mode
[   19.050241] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 623
[   19.086292] UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "boot_backup"
[   19.094176] UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   19.104125] UBIFS (ubi0:3): FS size: 7237632 bytes (6 MiB, 57 LEBs), max 67 LEBs, journal size 1015809 bytes (0 MiB, 6 LEBs)
[   19.115354] UBIFS (ubi0:3): reserved for root: 341850 bytes (333 KiB)
[   19.121802] UBIFS (ubi0:3): media format: w5/r0 (latest is w5/r0), UUID 8862F642-BC2B-43B9-B8AF-DA08B2ECAD9A, small LPT model
[   19.563507] UBIFS (ubi0:3): un-mount UBI device 0
[   19.568309] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" stops
[   24.659000] reboot: Restarting system

F0: 102B 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F1: 5000 1006
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 0350 [000F]
System halt!

And I cannot get to the web interface.

I do see the section in those boot messages where it formatted and wrote to the flash. I didn't see any errors during that part. But I did see two lines that looked somewhat concerning earlier related to "OF: Bad cell count" after it found the flash:

[    0.592644] spi-nand spi2.0: Fidelix SPI NAND was found.
[    0.598056] spi-nand spi2.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.606262] mtk-snand 1100d000.spi: ECC strength: 4 bits per 512 bytes
[    1.493047] Freeing initrd memory: 11196K
[    1.505484] 4 fixed-partitions partitions found on MTD device spi2.0
[    1.511905] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.518211] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.524771] Creating 4 MTD partitions on "spi2.0":

I don't know if that is a problem or not.

I will keep trying. Maybe it halted because I still had openocd running. I'll retry and stop openocd before the bootm command and report back any progress.

Thanks for your help!
Jason

wavejumper00 · January 18, 2024, 5:02pm

Success!

After shutting down openocd, I just power cycled the device. It came up and I was able to flash the sysupgrade image from the web interface. Now the device is booting up on it's own.

I see the uboot menu temporarily on the serial console. Then it continues on and gets through what appears to be a normal boot process. And I get the root login if I press enter:

BusyBox v1.36.1 (2023-10-09 21:45:35 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.0, r23497-6637af95aa
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

And I can login with the Luci web interface as well. I ran poweroff and did power cycle once as well to test that it comes all the way back up.

I would be willing to run any extra debugging on the flash chip or any new experimental images, etc.

Thanks again to all who helped. Especially @daniel, DarkDengar, AmiSapphire, hackpascal, ricky92 from this thread, and info from daniel, m1tchll and vasilii from the other threads I read. Since I'm a new user, it won't let me mention all of you with @ usernames.

I hope I can give back by doing some additional testing. I'd really like to understand if my flash is damaged/degraded or not.

odrt · January 18, 2024, 5:21pm

Good to read your RT3200 is back alive.

How is your boot and reboot stability running and having 23.05.2 installed?

I still think min_freq should be raised to 600 MHz or performance governor should be configured because:

The min_freq setting will not help fixing cold boot problems, but reportedly improves stability for reboots.

plater · January 18, 2024, 7:42pm

Since reading about these issues I’ve patched the kernel so that the scaling_min_freq is 600. I also removed some values to hopefully help with responsiveness but that’s a different discussion.

This is the result of the patch:

cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_frequencies
600000 1025000 1350000

Would this help with the potential cold boot problem or should I modify the source to boot with the performance governor and then set it to ondemand via rc.local? Would that help with the potential cold boot issue?

wavejumper00 · January 18, 2024, 7:44pm

Thanks @odrt

I have just upgraded to 23.05.2:

OpenWrt 23.05.2, r23630-842932a63d

And will power cycle it several times throughout the day to see if it has any problems.

I see that by default it is still allowed to go down to 437.5MHz:

root@OpenWrt:/# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_governor
ondemand
root@OpenWrt:/# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_min_freq
437500
root@OpenWrt:/# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_cur_freq
437500
root@OpenWrt:/# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_go
vernors
conservative ondemand userspace powersave performance schedutil
root@OpenWrt:/# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_fr
equencies
437500 600000 812500 1025000 1137500 1262500 1350000

To clarify - do you only want me to change the scaling_min_freq value and nothing else? Is the ondemand governor still ok for the testing you want?

Thanks again.

callmesteve · January 18, 2024, 10:13pm

Also, to get clarity on this - for those people who've had one of these die, was it the Belkin or Linksys variant?

Having received mine, I noticed the Belkin variant is apparently missing the LAN LEDs. That leads me to think that Belkin might be cheaping out elsewhere. Or maybe the extra LEDs cause the Linksys to experience extra voltage sag? Who knows.

Anyway, it might be theoretically the same hardware, but if they're getting parts or boards from different houses there could be a correlation we can pin down.

wavejumper00 · January 19, 2024, 12:37am

@callmesteve -

My two that died at the same time are both the white Belkin RT3200 versions. I've only opened and recovered one so far. I will likely not get to the other one until the weekend.

From hex dump of mtd3 backup file from one of them:

modelNumber=RT3200
cert_region=US
hw_revision=1
hw_version=48SAR601.0GB
manufacturer_date=2021/04/14

callmesteve · January 19, 2024, 1:14am

Drat. I mean, sample size of two so far, but that's the one I bought.
I recently saw mention of possibly updating where the FIT is stored, so I may wait to install in case that shows up in the next... week? Not really sure how quickly these move.

I'll post hardware info after that. I'm also thinking I might pop this open and take a look to see what sort of power supply filtering it has. The wiki could use some more board photos anyway.

EDIT:
So, here's the hardware pics. I'm unsure how useful they might be, let me know if I should focus on something. I also forgot to take a good picture of the board's back before I put the case together again...

Anyway, feel free to add any/all of these to the wiki if it's useful. You have my permission. I'd do it, but I have no idea if my wiki credentials still exist, I think they predated the great crash and I don't have them either.

Original images: https://mega.nz/folder/tO5jlQRD#1JtqfBjISG6yjS4Tfryfbw

How to open, if you wondered

Board pics and HW revision details

Gix · January 20, 2024, 10:37am

I think that this recent commit breaks WED acceleration on RT3200...
LE: I reverted this commit but WED is still not working. Maybe there was an error when rebasing patches for the 6.1.72 kernel update?