Bricked Belkin RT3200 after non-UBI image installation

wunderspud · February 10, 2025, 12:08am

Today I screwed up an RT3200. This router had been running OpenWRT 23.05 following application of owrt-ubi-installer 0.6.5. Today I:

Flashed openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb successfully.
Screwed up by then selecting the wrong file to flash - I flashed the non-UBI image openwrt-24.10.0-mediatek-mt7622-linksys_e8450-squashfs-sysupgrade.bin

After this, the router didn't boot, presenting a solid orange Internet LED only.

So, I opened up the box, and have hooked up a serial adapter. On the serial console when it boots I see:

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02ED [000F]
Jump to BL

NOTICE:  BL2: v2.10.0   (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
NOTICE:  BL2: Built : 23:09:37, Feb  3 2025
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  CPU: MT7622
NOTICE:  SPI-NAND: adjusting SPI-NAND pin drive strength to 12mA
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
NOTICE:  UBI: Volume fip (Id #0) size is 1021228 bytes
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.10.0  (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
NOTICE:  BL31: Built : 23:09:37, Feb  3 2025


U-Boot 2024.10-OpenWrt-r28427-6df0e3d02a (Feb 03 2025 - 23:09:37 +0000)

CPU:   MediaTek MT7622
Model: mt7622-linksys-e8450-ubi
DRAM:  512 MiB
Core:  49 devices, 21 uclasses, devicetree: separate
MMC:   
Loading Environment from UBI... SPI-NAND: FM35Q1GA (128MB)
ubi0 warning: scan_peb: valid VID header but corrupted EC header at PEB 1019
ubi0 error: ubi_add_to_av: two LEBs with same sequence number 78
eraseblock attaching information dump:
        ec       1
        pnum     940
        lnum     43
        scrub    0
        sqnum    78
Volume identifier header dump:
        magic     55424921
        version   1
        vol_type  1
        copy_flag 0
        compat    0
        vol_id    4
        lnum      43
        data_size 0
        used_ebs  0
        data_pad  0
        sqnum     78
        hdr_crc   349de96d
Volume identifier header hexdump:
00000000: 55 42 49 21 01 01 00 00 00 00 00 04 00 00 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  UBI!...........+................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 34 9d e9 6d  ...............N............4..m
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd2, error -22
UBI error: cannot attach mtd2
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)

** Cannot find mtd partition "ubi"
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... ubi0 warning: scan_peb: valid VID header but corrupted EC header at PEB 1019
ubi0 error: ubi_add_to_av: two LEBs with same sequence number 78
eraseblock attaching information dump:
        ec       1
        pnum     940
        lnum     43
        scrub    0
        sqnum    78
Volume identifier header dump:
        magic     55424921
        version   1
        vol_type  1
        copy_flag 0
        compat    0
        vol_id    4
        lnum      43
        data_size 0
        used_ebs  0
        data_pad  0
        sqnum     78
        hdr_crc   349de96d
Volume identifier header hexdump:
00000000: 55 42 49 21 01 01 00 00 00 00 00 04 00 00 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  UBI!...........+................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 34 9d e9 6d  ...............N............4..m
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd2, error -22
UBI error: cannot attach mtd2
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)

** Cannot find mtd partition "ubi"
Net:   
Error: ethernet@1b100000 No valid MAC address found.
No ethernet found.

Error, no UBI device selected!
Error, no UBI device selected!
Error, no UBI device selected!
Error, no UBI device selected!
Saving Environment to UBI... ubi0 warning: scan_peb: valid VID header but corrupted EC header at PEB 1019
ubi0 error: ubi_add_to_av: two LEBs with same sequence number 78
eraseblock attaching information dump:
        ec       1
        pnum     940
        lnum     43
        scrub    0
        sqnum    78
Volume identifier header dump:
        magic     55424921
        version   1
        vol_type  1
        copy_flag 0
        compat    0
        vol_id    4
ubi0 warning: scan_peb: valid VID header but corrupted EC header at PEB 1019
ubi0 error: ubi_add_to_av: two LEBs with same sequence number 78
eraseblock attaching information dump:
        ec       1
        pnum     940
        lnum     43
        scrub    0
        sqnum    78
Volume identifier header dump:
        magic     55424921
        version   1
        vol_type  1
        copy_flag 0
        compat    0
        vol_id    4
        lnum      43
        data_size 0
        used_ebs  0
        data_pad  0
        sqnum     78
        hdr_crc   349de96d
Volume identifier header hexdump:
00000000: 55 42 49 21 01 01 00 00 00 00 00 04 00 00 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  UBI!...........+................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 34 9d e9 6d  ...............N............4..m
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd2, error -22
UBI error: cannot attach mtd2
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)
Error, no UBI device selected!
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Error, no UBI device selected!
Error, no UBI device selected!
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Error, no UBI device selected!

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.
No ethernet found.

I have the installer image being served up from a machine running a TFTP server, but when I select "Boot system fvia TFTP" from the boot menu of the router, I see:

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.
No ethernet found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.
Press ENTER to return to menu

So, my question is: how do I fix this - how come the router isn't picking up a MAC address?

Hoping @daniel @hnyman might have some sage advice here

Edit: I do have the boot_backup files for this device saved - both from factory setup, and from before I flashed the 24.10 recovery image.

daniel · February 10, 2025, 2:00am

As luckily the bootloader still comes up, for starters manually set the MAC address:

setenv ethaddr 00:11:22:33:44:55

Now you will need to fix UBI, so boot via TFTP and see if Linux manages to attach the UBI device. As PEB 1019 seems corrupted, the best you can do is probably to re-create UBI, though that's also a bit involved.

Do you have a backup of the factory partition/volume?

I can offer to help using tmate and try to recover the device, PM me and I try my best to catch you.

wunderspud · February 10, 2025, 11:53pm

Do you have a backup of the factory partition/volume?

I have backups of mtd{0,1,2,3} devices from before flashing with the ubi installer 0.6.5, and then from before flashing with ubi installer 1.1.4. But, I suspect the factory partition is something different? I do have two other working RT3200s I can take partiitions from if needed.

EDIT: I now realize the factory partition is mtd2 - so, yes, I do have that sitting on my desktop. What's not clear to me is how to replace the broken one on the router with this copy. there doesn't seem to be any menu item for loading that from TFTP like there is for e.g. BL2 or BL31+U-Boot.

Successfully booting via TFTP yields the logs here: https://pastebin.com/CnTdEkTQ which are too long to paste directly into this post.

After booting, they key thing I see is this:

OpenWrt UBI installer                                                           
                                                                                
preparing backup of relevant flash areas...                                     
4+0 records in                                                                  
4+0 records out                                                                 
32+0 records in                                                                 
32+0 records out                                                                
factory partitio[    4.928449] INSTALLER: cannot find Wi-Fi EEPROM data         
n not found on r[    4.934866] sysrq: Trigger a crash                           
[    4.939478] Kernel panic - not syncing: sysrq triggered crash                
[    4.946581] SMP: stopping secondary CPUs                                     
[    4.950500] Kernel Offset: disabled                                          
[    4.953980] CPU features: 0x0,00000004,00000000,0000400b                     
[    4.959288] Memory Limit: none                                               
[    4.966921] pstore: backend (ramoops) writing error (-28)                    
[    4.972318] Rebooting in 1 seconds..                                         
                                                                                
F0: 102B 0000                                                                   
F6: 0000 0000                                                                   
V0: 0000 0000 [0001]                                                            
00: 0000 0000                                                                   
BP: 0400 0041 [0000]                                                            
G0: 1190 0000                                                                   
T0: 0000 02ED [000F]                                                            
Jump to BL

So, it does look like the UBI volume needs rebuilding somehow. I'll PM you, @daniel

wunderspud · February 11, 2025, 9:40am

@daniel helped me via PM to restore the factory/mtd2 partition. In case anyone else hits the same problem, this was the process that worked:

All you need to do is to write the the backup of former mtd2 (the factory MTD partition at offset 0x1c0000) to the correct location. The best way to do this is using U-Boot:

Load the file via tftpboot $loadaddr mtd2 (after again setting ethaddr to something random, of course).
Erase the area of the flash using mtd erase spi-nand0 0x1c0000 0x100000
Write to flash mtd write spi-nand0 $loadaddr 0x1c0000 0x100000
Now load the unsigned installer, like you did before, this time it should work.

Huge thanks to @daniel

cdes · February 15, 2025, 9:36pm

Mine boots fine with 22.03 and 22.05 but shows the same EEPROM issue with booting any initramfs or sysupgrade beyond that.

The 1.1.0+ installer only boot loops indefinitely, claiming not finding a factory partition at offset.

1.0.2 installer works fine.

I'd appreciate any advice.

PS: state of my Belkin is unknown. I remember to had a snapshot on there when it failed to boot one day. Has been sitting in a bin for about a year.

wunderspud · March 7, 2025, 10:13pm

Hard to help with limited information. Best advice is probably to get hooked up with a serial adapter and report back what you see in the terminal when it boots.