Looking for MT7621 NAND dump with OOB data

For Developers
1

Hi,

sadly my bricked router is not booting from any dump I provide and flash to the NAND and my options are coming to the end, since the soldering points are getting damaged on the board already.
I already gathered some info on how the NAND layout should look like, but something is not ok with the configuration of the pages/oob, or maybe the tools I have for the NAND flasher are incorrect somehow.
I only have a full NAND image without the oob data i.e. "dd" of the full NAND.

If someone knows how exactly the NAND layout is to be constructed for MT7621, or just having a dump at hand with oob data included, please let me know, so I can try and correct my image.

So far, I collected this info about the structure, specifically for the MT7621 (it is even in the driver like this):

/*
 * Raw page layout:
 * ---------------------------------------------------------------------------------
 * DAT0 | FDM0 | ECC0 | DAT1 | FDM1 | ECC1 | DAT2 | FDM2 | ECC2 | DAT3 | FDM3 | ECC3
 * 512B |  8B  |  8+B | 512B |  8B  |  8+B | 512B |  8B  |  8+B | 512B |  8B  |  8+B
 * ---------------------------------------------------------------------------------
 *
 * Formatted page layout:
 * ---------------------------------------------------------------------------------
 * DAT0 | DAT1 | DAT2 | DAT3 | FDM0 | FDM1 | FDM2 | FDM3 | ECC0 | ECC1 | ECC2 | ECC3
 * 512B | 512B | 512B | 512B |  8B  |  8B  |  8B  |  8B  |  8+B |  8+B |  8+B |  8+B
 * ---------------------------------------------------------------------------------
 */

The utility I use to extend the raw image with oob data then is set to:

page size: 2048 bytes
spare size: 64 bytes
ECC bits: 4
ECC method: Binary BHC
ECC data size: 7 bytes
Reverse byte order: no  (<- ???)

This will be the divided into the following subpages and sub-oob data (as above in the table):

Data1 (512 bytes)
empty (8 bytes)
ECC data1 (7 bytes) + empty (1 bytes)

Data2 (512 bytes)
empty (8 bytes)
ECC data2 (7 bytes) + empty (1 bytes)

Data3 (512 bytes)
empty (8 bytes)
ECC data3 (7 bytes) + empty (1 bytes)

Data4 (512 bytes)
empty (8 bytes)
ECC data4 (7 bytes) + empty (1 bytes)

The empty 8 bytes should be for the bad block indication (FDM) I believe, but since my replacement chips I use have so far no bad blocks at all, this are can be empty (correct me if wrong?)
Since the tool creates 7 bytes ECC, the last byte should be unused (correct me again if wrong).
Also have to tell, that wherever I talk about empty byte(s), they are not touched by the util, thus these bytes will be 0xFF. Can this be a problem too i.e. should I provide somehow 0x00-s instead?

Don't hesitate to correct what I'm thinking, or if having a dump with oob, please share it with me.
Thanx for your help!

2

You're not even supposed to be writing OOB-data. Taking a dump without OOB and then writing it back at some later point is perfectly fine as long as you're using NAND-aware tools and you erase the flash first, and your settings are correct.

I dumped my ZTE MF286D's NAND without OOB-data, I installed OpenWrt and messed around with the NAND's contents otherwise as well, and yet it worked perfectly well, when I erased the relevant portions of the flash and then flashed the dump back with nandwrite.

Your problem sounds like either you're not erasing the flash first and you end up with corrupted data, you are using wrong tools, you are using wrong settings and/or your dump itself is bad.

3

The router is not working anymore, so I had to desolder and flash the NAND externally. This means I'm currently not even sure, how it should be prepared, i.e. so far I understand, the flash tool is expecting an image with data + spare data.
In this case it is even more complicated, because regarding to MTK SDK document, the MT7621 is using 512/16 bytes subpages within the normal 2048/64 pages.
So far I didn't find an option to ignore the spare data, so I have the feeling something has to be there. Or maybe you mean I should completely ignore the spare data (ignore oob completely) and just try to leave it empty? Note that from the aspect of the flash tool, empty means 0xFF-s.

4

There are binary utilities from the MTK SDK that generate the correct OOB for the mt7621.

./BCH e 2048 64 file.bin fileOOB.bin - if the SoC is running at 2k+64