Installing OpenWrt on a Netgear WAC124

Hi

I must be doing something silly, but I can't put openwrt 21.02.1 on a new Netgear WAC124.

Let me explain. About 8 - 9 months ago I bought two of these boxes from ebay as they were offered at a good price ... I junked the standard Netgear software and put openwrt on them, using the then current 21.02.1. It was a long time ago, but I don't remember any difficulties ... I'm pretty sure I used nmrpflash, and just flashed the squashfs-factory image. They have been working perfectly since then ...

I wanted to extend my WiFi into my garage, and found out that I could still buy another WAC124, so it arrived yesterday. I powered it on and logged into the Negear software just to check ... everything looked OK.

I found the directory on my desktop machine that still contained the openwrt squashfs-factory image that I had used before, along with the nmrpflash program, so re-read the reflashing instructions to acquaint myself with them, and proceeded to re-flash the box.

nmrpflash seemed to go through as I expected ...

sudo bin/nmrpflash -i eno1 -f openwrt-21.02.1-ramips-mt7621-netgear_wac124-squashfs-factory.img
Advertising NMRP server on eno1 ... -
Received configuration request from 9c:c9:eb:4f:e4:f4.
Sending configuration: 10.164.183.252/24.
Received upload request without filename.
Uploading openwrt-21.02.1-ramips-mt7621-netgear_wac124-squashfs-factory.img ... OK (6280479 b)
Waiting for remote to respond.
Received keep-alive request (2).
Remote finished. Closing connection.
Reboot your device now.

But the netgear box never responded to a ping on 192.168.1.1. I powered it off, and saw that the LED's were constantly rotating

ALL ON (1 sec)
POWER LED ON (1 sec)
POWER LED OFF, INTERNET LED ON (2 sec)
INTERNET LED OFF, POWER LED ON (5 sec)
ALL OFF (2 sec)

repeat ad-nauseam ... Don't know what any of that means tho' ...

I assumed that the flashing had gone wrong somehow, but I've repeated it 4 or 5 times now, with exactly the same results. However the really odd thing is that I then re-flashed the box with Netgear firmware (v1.0.4.2) ... the flashing process completed correctly and the box runs perfectly. So I don't think the flashing process is going wrong.

But if not that, what the hell am I doing wrong with the openwrt firmware ???

-- Chris

You try the other method: https://openwrt.org/toh/netgear/wac124#oem_easy_installation

Hi

nmrpflash is meant for flashing back the netgear firmware, so there is nothing odd in that it flashes it successfully :wink:

Restore netgear firmware (it seems you've already done it), and flash a factory image from within the Netgear UI. That is the conventionnal method to use.

So I used nmrpflash to put Netgear v1.0.4.2 on the box. This worked fine

Then I went through the logon process to set a root password

Then I reset the box to factory defaults

Then I logged back in and using the Netgear GUI tried to flash openwrt 21.0.2 squashfs-factory

The process looked like it worked. I waited about 10 mins after the reflashing process finished flashing the LED's, then powered off and on again.

No joy. The box does not respond to 192.168.1.1. The lights continue to flash in the pattern described above.

I even ran wireshark to see if the mac address of the Netgear box shows up when it attempts to boot, but I can't see any data matching this mac address at all, so as far as I can tell it's not actually going to respond to any network packets :frowning:

Stumped ....

-- Chris

Can you try the factory 22.03.2?

Thanks for your suggestion ... I have to leave this now until tomorrow.

I will try the newer version, but I know that 21.02.1 should work, it is already running fine on my other two units. I'm using the exact same file and nmrpflash that I used before (they have been sitting on the hard drive of my desktop machine). I don't see anything different about this unit compared to the others. It was new out of the box, and shrink-wrapped in plastic film, I don't think it is a re-furbed unit or anything.

Still stumped ...

-- Chris

I agree with you procedure.
https://www.downloads.netgear.com/files/GDC/WAC124/WAC124_V1.0.3.2.zip
Try this : use nmrp to install the oldest Netgear firmware, than flash OpenWrt from within UI. You may encounter an incompatibilty within the newer version of Netgear firmware. As you have already installed Openwrt on other such devices, you may not had the same Netgear firmware at the time. You can also try least older version.
And you can also try to install 22.03.2 as suggested by @d687r02j8g

1 Like

This sounds like it could be due to the partition table. These devices contain a device-specific partition-table on-flash (which adjusts the partition sizes to compensate for bad blocks in the flash). However, OpenWrt uses a fixed partition table instead, which is only correct on devices without bad blocks. Devices with bad blocks on the flash may not work correctly.

Usually this just results in degraded wireless performance (as the calibration data is not at the expected offset). But if there is a bad block already before the ubi partition, this could also lead to the kernel not finding the root file system, which would cause a bootloop as described here.

If you are able to build an OpenWrt image on your own, could you try this patch applied on current OpenWrt master?

2 Likes

Aha ... that sounds interesting !

I've never built openwrt before but I will give it a go and let you know what happens.

As an aside, I ssh'ed into my other two netgear boxen and ran the dmesg command to see ... One reported a couple of bad blocks, but the bad blocks didn't actually seem to affect anything else. But the other one shows this

dmesg

[    0.993386] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    1.006421] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    1.020981] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    1.035540] Scanning device for bad blocks
[    1.849052] Bad eraseblock 635 at 0x000004f60000
[    2.350029] 7 fixed-partitions partitions found on MTD device mt7621-nand
[    2.363551] Creating 7 MTD partitions on "mt7621-nand":
[    2.373972] 0x000000000000-0x000000100000 : "u-boot"
[    2.385202] 0x000000100000-0x000000200000 : "SC PART_MAP"
[    2.397425] 0x000000200000-0x000000600000 : "kernel"
[    2.408675] 0x000000600000-0x000002e00000 : "ubi"
[    2.419695] 0x000002e00000-0x000004600000 : "reserved0"
[    2.431553] 0x000004600000-0x000004800000 : "factory"
[    2.443109] 0x000004800000-0x000008000000 : "reserved1"
[    2.456505] libphy: Fixed MDIO Bus: probed
[    2.492261] libphy: mdio: probed
[    2.498986] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.515188] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[    2.533953] mt7621-pci 1e140000.pcie: Parsing DT failed
[    2.546868] NET: Registered protocol family 10

...

[   14.622099] NET: Registered protocol family 24
[   14.644018] kmodloader: done loading kernel modules from /etc/modules.d/*
[   14.706843] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a
[   14.706843] 
[   15.026898] SQUASHFS error: xz decompression failed, data probably corrupt
[   15.040636] SQUASHFS error: squashfs_read_data failed to read block 0x98e36
[   15.097491] SQUASHFS error: xz decompression failed, data probably corrupt
[   15.111238] SQUASHFS error: squashfs_read_data failed to read block 0x98e36
[   15.169472] SQUASHFS error: xz decompression failed, data probably corrupt
[   15.183256] SQUASHFS error: squashfs_read_data failed to read block 0x98e36
[   15.197587] mt7615e 0000:01:00.0: loading /lib/firmware/mediatek/mt7615_n9.bin failed with error -5
[   15.215713] mt7615e 0000:01:00.0: Direct firmware load for mediatek/mt7615_n9.bin failed with error -5
[   15.234293] mt7615e 0000:01:00.0: Falling back to sysfs fallback for: mediatek/mt7615_n9.bin
[   16.479034] SQUASHFS error: xz decompression failed, data probably corrupt
[   16.492802] SQUASHFS error: squashfs_read_data failed to read block 0x98e36
[   16.508482] mt7615e 0000:01:00.0: N9 Firmware Version: �A��	�v!�, Build Time: �!7��'�MF��D�(�
[   16.530109] mt7615e 0000:01:00.0: Failed to send firmware to device
[   19.784735] mtk_soc_eth 1e100000.ethernet eth0: Link is Down
[   19.806308] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   19.822235] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   19.828984] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode

As far as I know this box is working fine, but this looks like it may be suffering from the bad block problem.

Lets get the build system working :slight_smile: !

-- Chris

So I have a build server set up. Currently compiling 'master'. If that works I'll try to load it to one of my good ap's, then try the bad ap as well.

After that I'll apply the recommended patch and repeat the tests.

-- Chris

Hi.
You don't need to install your own server, for simply building a test version. Use the online firmware selector, or the image builder. It's much more faster !

Hmm. OK, this is going to be one of those jobs.

I successfully built a squash-factory.img from openwrt-master. I just ran

make menuconfig     (I set  ramips/mt7621/netgear_wac124 then exit)
make download && make 

I successfully loaded it to one of my good netgear boxes (one of the ones that was running 21.02.01), and the firmware loaded ok, and after the reboot, the box responds to a ping on 191.168.1.1.

However it does not seem to have the web frontend running. nmap shows that the only open ports on 192.168.1.1 are 22 and 53. I can ssh in to the box, but I don't know how to configure it without the web frontend.

I thought that if I used the netgear_wac124 profile make menuconfig would pick up the same packages that the official build does ? Am I wrong in that assumption ? And can I recover the build from the ssh console by adding whatever the required packages are ?

In anticipation that I can get this working, I also tried to apply the patch listed above. I downloaded the patch as a zip file, unpacked the zip file in the directory above where I was working and ran

wrt-dev{lidgaca} pwd
/home/lidgaca/wrt-builds/openwrt-with-patch
wrt-dev{lidgaca} git apply ../40397d37172220cac5953c1e2b4e0783-430669545883c1a4d971d23c9776dbdf46b18e87/sercomm-chj-bzw.patch 
error: corrupt patch at line 434

Line 434 is the last line of the patch file ... Is there another way to apply a git patch file ?

Help with any of these issues would be appreciated :slight_smile:

-- Chris

Did you add the Luci package ?
Hm ... you want to apply a patch, that's why you need the full build server, ok.

1 Like

Hi

After a bit more poking around ... the patch file seems to be designed to be used via patch in the normal way ...

patch -p1 < patch-file.patch

I was confused, as the text header of the file said something like

diff --git ...

so I assumed it was to be applied via git apply. Using patch allowed the file to patch properly.

So I created a new patch-squash-factory.img, and it loads to the bad ap. Hooray ! So big kudos to janh :slight_smile: I can confirm that you were correct, and that your patch is good. If you want me to post the dmesg listing I can. Also if you need any other testing done please let me know.

However, after opening the beers, I'm still left with a system that only seems to have ssh on it ... I probably need to read some more of the dev guide (but if someone wants to tell me what to do here, I would be quite happy :slight_smile: ) I'm close to calling this closed now.

Thanks very much to all who have contributed.

That bad block is in an area of the flash that isn't used on OpenWrt (after the factory partition), so it shouldn't have any effect. There must be another reason for the squashfs read error.

It would be interesting to see the actual bad block locations on that device.

You need to select the luci package in menuconfig, as the default package selection on the master branch does not include the web interface.

1 Like

Thanks for the heads up about luci ... I'm compiling a new version of the code now.

janh asked >

It would be interesting to see the actual bad block locations on that device.

I'm including the full dmesg listing from the 'bad' unit that I successfully flashed with your patched firmware. I'm sorry for sending it all, but I wasn't 100% sure that I could edit out the useless stuff accurately.

What I saw was no indication of bad block scanning at all, and no bad blocks identified. Which I didn't understand :frowning: . Maybe it will make more sense to you ...

root@OpenWrt:~# dmesg 
[    0.000000] Linux version 5.10.152 (lidgaca@wrt-dev) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r21166-9721a42a27) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Wed Nov 2 11:41:56 2022
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Netgear WAC124
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] percpu: Embedded 15 pages/cpu s30224 r8192 d23024 u61440
[    0.000000] pcpu-alloc: s30224 r8192 d23024 u61440 alloc=15*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000009
[    0.000000] Readback ErrCtl register=00000009
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 119280K/131072K available (6717K kernel code, 620K rwdata, 1360K rodata, 1272K init, 235K bss, 11792K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000014] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 4398046511103ns
[    0.015869] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.033793] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.106125] pid_max: default: 32768 minimum: 301
[    0.115436] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.129842] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.148060] rcu: Hierarchical SRCU implementation.
[    0.157862] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.173434] smp: Bringing up secondary CPUs ...
[    0.183167] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.183178] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.183189] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.183264] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.243264] Synchronize counters for CPU 1: done.
[    0.305367] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.305377] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.305385] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.305431] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.364341] Synchronize counters for CPU 2: done.
[    0.424676] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.424686] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.424694] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.424744] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.483917] Synchronize counters for CPU 3: done.
[    0.543526] smp: Brought up 1 node, 4 CPUs
[    0.556377] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.575891] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.589696] pinctrl core: initialized pinctrl subsystem
[    0.602232] NET: Registered protocol family 16
[    0.613450] cpuidle: using governor teo
[    0.636540] FPU Affinity set after 11720 emulations
[    0.662620] clocksource: Switched to clocksource GIC
[    0.674132] NET: Registered protocol family 2
[    0.683117] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.698235] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.714823] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.729947] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.743945] TCP: Hash tables configured (established 1024 bind 1024)
[    0.756678] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.769561] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.783662] NET: Registered protocol family 1
[    0.792199] PCI: CLS 0 bytes, default 32
[    0.802142] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.818967] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.830464] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.852343] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.863752] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.875059] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.887020] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.901227] printk: console [ttyS0] disabled
[    0.909713] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    0.927625] printk: console [ttyS0] enabled
[    0.944164] printk: bootconsole [early0] disabled
[    0.965589] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    0.978301] nand: Macronix MX30LF1G18AC
[    0.985957] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.001034] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    1.071383] scpart: Valid 'SC PART MAP' (29 partitions) found at 0x100000
[    1.085043] 29 scpart partitions found on MTD device mt7621-nand
[    1.097997] Creating 29 MTD partitions on "mt7621-nand":
[    1.108613] 0x000000000000-0x000000100000 : "u-boot"
[    1.129674] 0x000000100000-0x000000200000 : "SC PART_MAP"
[    1.151703] 0x000000200000-0x000000620000 : "kernel"
[    1.203712] 0x000000620000-0x000002e20000 : "ubi"
[    1.616720] 0x000002e20000-0x000003020000 : "English UI"
[    1.648808] 0x000003020000-0x000003220000 : "ML1"
[    1.679411] 0x000003220000-0x000003420000 : "ML2"
[    1.710064] 0x000003420000-0x000003620000 : "ML3"
[    1.740675] 0x000003620000-0x000003820000 : "ML4"
[    1.771280] 0x000003820000-0x000003a20000 : "ML5"
[    1.801904] 0x000003a20000-0x000003c40000 : "ML6"
[    1.833129] 0x000003c40000-0x000003e40000 : "ML7"
[    1.863713] 0x000003e40000-0x000004040000 : "ML8"
[    1.894232] 0x000004040000-0x000004240000 : "ML9"
[    1.924773] 0x000004240000-0x000004440000 : "ML10"
[    1.955466] 0x000004440000-0x000004640000 : "ML11"
[    1.986215] 0x000004640000-0x000004840000 : "factory"
[    2.017444] 0x000004840000-0x000004a40000 : "SC Private Data"
[    2.050007] 0x000004a40000-0x000004c40000 : "POT"
[    2.080535] 0x000004c40000-0x000004e60000 : "Traffic Meter"
[    2.113513] 0x000004e60000-0x000005060000 : "SC PID"
[    2.144532] 0x000005060000-0x000005260000 : "SC Nvram"
[    2.175869] 0x000005260000-0x000005460000 : "Ralink Nvram"
[    2.207998] 0x000005460000-0x000005660000 : "reserved0"
[    2.239771] 0x000005660000-0x000005860000 : "reserved1"
[    2.271415] 0x000005860000-0x000005a60000 : "reserved2"
[    2.303032] 0x000005a60000-0x000005c60000 : "reserved3"
[    2.334507] 0x000005c60000-0x000005e60000 : "reserved4"
[    2.366140] 0x000005e60000-0x000007f80000 : "reserved5"
[    2.774199] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.791994] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[    2.809720] mtk_soc_eth 1e100000.ethernet wan: mediatek frame engine at 0xbe100000, irq 21
[    2.827609] i2c /dev entries driver
[    2.837035] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    2.850430] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    2.867967] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[    2.884263] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    2.900636] mt7621-pci 1e140000.pcie: Parsing DT failed
[    2.913265] NET: Registered protocol family 10
[    2.923983] Segment Routing with IPv6
[    2.931364] NET: Registered protocol family 17
[    2.940753] 8021q: 802.1Q VLAN Support v1.8
[    2.953288] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.985358] mt7530 mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7530 PHY] (irq=26)
[    3.007345] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=27)
[    3.029323] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7530 PHY] (irq=28)
[    3.051280] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7530 PHY] (irq=29)
[    3.074120] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    3.090916] DSA: tree 0 setup
[    3.097149] rt2880-pinmux pinctrl: pcie is already enabled
[    3.108186] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    3.121546] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    3.139068] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[    3.155370] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    3.171759] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[    3.186849] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[    3.201817] mt7621-pci 1e140000.pcie: failed to parse bus ranges property: -22
[    3.316390] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    3.327502] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    3.438694] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    3.452559] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    3.462267] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    3.471978] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    3.490683] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    3.503366] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    3.517060] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    3.530749] pci_bus 0000:00: root bus resource [bus 00-ff]
[    3.541673] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] (bus address [0x00000000-0x0fffffff])
[    3.561988] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    3.573966] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    3.586446] pci 0000:00:00.0: reg 0x14: initial BAR value 0x00000000 invalid
[    3.600473] pci 0000:00:00.0: reg 0x14: [mem size 0x00010000]
[    3.611983] pci 0000:00:00.0: supports D1
[    3.619978] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    3.631888] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    3.643902] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    3.656386] pci 0000:00:01.0: reg 0x14: initial BAR value 0x00000000 invalid
[    3.670418] pci 0000:00:01.0: reg 0x14: [mem size 0x00010000]
[    3.681930] pci 0000:00:01.0: supports D1
[    3.689913] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    3.702999] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    3.718959] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    3.735157] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    3.747161] pci 0000:01:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    3.761200] pci 0000:01:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    3.773853] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    3.805014] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    3.815449] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    3.827583] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    3.841097] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff pref]
[    3.855499] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    3.868934] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
[    3.880931] pci 0000:02:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    3.894973] pci 0000:02:00.0: reg 0x10: [mem size 0x00100000]
[    3.906551] pci 0000:02:00.0: PME# supported from D0 D3hot D3cold
[    3.920291] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    3.930733] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    3.942869] pci 0000:00:01.0:   bridge window [mem 0x60000000-0x600fffff]
[    3.956384] pci 0000:00:01.0:   bridge window [mem 0x60000000-0x600fffff pref]
[    3.970775] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    3.984014] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    3.997183] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    4.011044] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    4.024213] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    4.038075] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    4.051598] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    4.065982] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    4.079504] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    4.093888] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    4.107417] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    4.120935] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    4.134455] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    4.147987] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    4.162550] pci 0000:00:00.0: PCI bridge to [bus 01]
[    4.172450] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    4.185972] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    4.199486] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    4.213876] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff]
[    4.227401] pci 0000:00:01.0: PCI bridge to [bus 02]
[    4.237285] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[    4.250799] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    4.264320] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    4.282322] UBI: auto-attach mtd3
[    4.289008] ubi0: attaching mtd3
[    4.295773] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[    5.110719] ubi0: scanning is finished
[    5.134608] ubi0: attached mtd3 (name "ubi", size 40 MiB)
[    5.145396] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    5.159080] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    5.172601] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    5.186455] ubi0: good PEBs: 320, bad PEBs: 0, corrupted PEBs: 0
[    5.198408] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    5.212797] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1667389316
[    5.230974] ubi0: available PEBs: 0, total reserved PEBs: 320, PEBs reserved for bad PEB handling: 20
[    5.249360] ubi0: background thread "ubi_bgt0d" started, PID 545
[    5.251758] block ubiblock0_0: created from ubi0:0(rootfs)
[    5.272319] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    5.293334] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    5.311681] Freeing unused kernel memory: 1272K
[    5.320734] This architecture does not have kernel memory protection.
[    5.333573] Run /sbin/init as init process
[    5.341709]   with arguments:
[    5.341714]     /sbin/init
[    5.341719]   with environment:
[    5.341724]     HOME=/
[    5.341729]     TERM=linux
[    5.862127] init: Console is alive
[    5.869348] init: - watchdog -
[    6.778596] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    6.881229] usbcore: registered new interface driver usbfs
[    6.892372] usbcore: registered new interface driver hub
[    6.903120] usbcore: registered new device driver usb
[    6.924700] xhci-mtk 1e1c0000.xhci: supply vusb33 not found, using dummy regulator
[    6.940226] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    6.950870] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1
[    6.972800] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x0000000000290010
[    6.991120] xhci-mtk 1e1c0000.xhci: irq 20, io mem 0x1e1c0000
[    7.003893] hub 1-0:1.0: USB hub found
[    7.011501] hub 1-0:1.0: 2 ports detected
[    7.020194] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    7.030855] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2
[    7.045811] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed
[    7.058681] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    7.075751] hub 2-0:1.0: USB hub found
[    7.083385] hub 2-0:1.0: 1 port detected
[    7.099045] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.133126] init: - preinit -
[    7.977480] random: jshn: uninitialized urandom read (4 bytes read)
[    8.064140] random: jshn: uninitialized urandom read (4 bytes read)
[    8.115239] random: jshn: uninitialized urandom read (4 bytes read)
[    8.435984] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[    8.452133] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[    8.453152] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[    8.482526] 8021q: adding VLAN 0 to HW filter on device lan1
[    8.496863] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.693756] UBIFS (ubi0:1): Mounting in unauthenticated mode
[   10.705409] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 691
[   10.785844] UBIFS (ubi0:1): recovery needed
[   10.975719] UBIFS (ubi0:1): recovery completed
[   10.984724] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   11.000314] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.020053] UBIFS (ubi0:1): FS size: 32251904 bytes (30 MiB, 254 LEBs), journal size 1650688 bytes (1 MiB, 13 LEBs)
[   11.040832] UBIFS (ubi0:1): reserved for root: 1523336 bytes (1487 KiB)
[   11.054010] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID E0F220A3-341C-469A-8190-856B91574EF1, small LPT model
[   11.080729] mount_root: switching to ubifs overlay
[   11.108058] urandom-seed: Seeding with /etc/urandom.seed
[   11.328665] procd: - early -
[   11.334723] procd: - watchdog -
[   12.012819] procd: - watchdog -
[   12.019751] procd: - ubus -
[   12.174962] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.193493] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.206732] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.225970] procd: - init -
[   12.988089] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.190830] Loading modules backported from Linux version v5.15.74-0-ga3f2f5ac9d61
[   13.206099] Backport generated by backports.git v5.15.74-1-0-ge2d78967

-- Chrus

There was a change that disabled scanning for bad blocks. However, if you look at the partition offsets and sizes you can see that the kernel partition has an additional block on this device (block size is 0x20000 bytes / 128 KiB). So there is probably a bad block in there which the on-flash partition table compensates for, and as a result all following partitions are shifted by a block. (The same also applies to the "ML6" and "Traffic Meter" partitions.)