OpenWRT One permanently bricked through OpenWRT 25.12 upgrade

Installing and Using OpenWrt
1

I bought an OpenWRT One on 2025-12-07 and installed it, worked so far.
Yesterday night/2026-03-17 I decided to upgrade to 25.12 using the attended sysupgrade application, because it also worked in the past. Download of all files seem to work, but after the reboot, the system did not come online, also the ethernet LEDs stayed offline on the device.

I then tried to reset to 24.10.5 using the NOR Recovery from USB as described:
https://openwrt.org/toh/openwrt/one#boot_into_norfull_recovery_modeflash_nand_from_usb using the files: https://firmware-selector.openwrt.org/?version=24.10.5&target=mediatek%2Ffilogic&id=openwrt_one

On the USB terminal I directly saw a lot of issues during flashing, a big list of "Skipping bad block" appeared during the process, which might indicate a defective eMMC? The flash process ended with

Writing 22282240 byte(s) (10880 page(s)) at offset 0x00000000
done
  • after that I powered down the OpenWRT One, switched from NOR to NAND flash and tried to boot.

Directly Uboot showed a warning:

UBI: EOF marker found, PEBs from 165 will be erased
ubi0 warning: ubi_calculate_reserved: number of bad PEBs (1024) is above the expected limit (40), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)

The boot itself seemed to work, but the kernel message started to feel a bit off, e.g. notes about "Volume calibration not found! No size specified -> Using max size (10792960)" and

[    2.075361] ubi0 error: 0xffffffc0805e1828: no enough physical eraseblocks (2, need 3)
[    2.083729] ubi0 error: 0xffffffc0805d6324: failed to attach mtd5, error -28

In the end if kernel panics and reboots:

[    2.388070] phy phy-soc:usb-phy@11e10000.1: type_sw - reg 0x218, index 0
[    2.395659] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    2.403014] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    2.409292] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    2.749184] mtk-pcie-gen3 11280000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x1)
[    2.758008] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[    2.765950] clk: Disabling unused clocks
[    2.770702] /dev/root: Can't open blockdev
[    2.774811] VFS: Cannot open root device "" or unknown-block(0,0): error -6
[    2.781773] Please append a correct "root=" boot option; here are the available partitions:
[    2.790126] 1f00             256 mtdblock0
[    2.790133]  (driver?)
[    2.796650] 1f01             768 mtdblock1
[    2.796654]  (driver?)
[    2.803175] 1f02             512 mtdblock2
[    2.803180]  (driver?)
[    2.809700] 1f03           12800 mtdblock3
[    2.809705]  (driver?)
[    2.816221] 1f04            1024 mtdblock4
[    2.816225]  (driver?)
[    2.822745] 1f05          261120 mtdblock5
[    2.822750]  (driver?)
[    2.829272] List of all bdev filesystems:
[    2.833267]  ext3
[    2.833270]  ext2
[    2.835184]  ext4
[    2.837097]  squashfs
[    2.839010]  f2fs
[    2.841275]
[    2.844669] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.852916] SMP: stopping secondary CPUs
[    2.856827] Kernel Offset: disabled
[    2.860302] CPU features: 0x0,00000000,00000000,1000400b
[    2.865601] Memory Limit: none
[    2.870766] pstore: backend (ramoops) writing error (-28)
[    2.876154] Rebooting in 1 seconds..

This then goes on forever.
I tried the recovery process about 5 times, but it does not help.

Within NAND mode I can boot into the recovery system from NAND, but I trying to flash a new image from there does also not work. I also tried "Rest all settings to factory defaults", which did not change anything.

I also checked the power supply and USB C cable with a USB C Power Meter - which seemed fine and exchanged it for a known good supply and cable, just in case and retried the recovery process. That also did not help.

To me, it looks like the eMMC memory is damaged.

I am a bit speechless, I bought the OpenWRT One to support OpenWRT instead of the devices I have been using since ~2006. As the device is just slightly older than 3 months, I won't be able to return it, but it seems to be bricked - even though that should not be possible.. So, what to do now?

Thank you for any advice and help

2

Full log:



F0: 102B 0000
FA: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [0000]
T0: 0000 022F [010F]
Jump to BL

NOTICE:  BL2: v2.10.0   (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-nor-ddr4)
NOTICE:  BL2: Built : 11:41:08, Dec  3 2024
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.10.0  (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-nor-ddr4)
NOTICE:  BL31: Built : 11:41:08, Dec  3 2024


U-Boot 2024.10-OpenWrt-r28161-ea17e958b9 (Dec 03 2024 - 11:41:08 +0000)

CPU:   MediaTek MT7981
Model: OpenWrt One
DRAM:  1 GiB
Core:  44 devices, 20 uclasses, devicetree: separate
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
Loading Environment from nowhere... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from nowhere... OK
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 3a:c7:3c:4d:da:d2
eth0: ethernet@15100000
SF: Detected w25q128 with page size 256 Bytes, erase size 4 KiB, total 16 MiB
Reading 131072 byte(s) at offset 0x00000000
Initialize Env
## Error: "ubi_create_env" not defined
Unknown command 'saveenv' - try 'help'

        ( ( ( OpenWrt ) ) )  [SPI-NOR]       U-Boot 2024.10-OpenWrt-r28161-ea17e958b9 (Dec 03 2024 - 11:41:08 +0000)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Unlock NOR. (Make sure the NOR/WP jumper is populated)
      4. Load BL31+U-Boot FIP via TFTP then write to NOR.
      5. Load BL2 preloader via TFTP then write to NOR.
      6. Load recovery system via TFTP then write to NOR.
      7. Lock NOR. (Remove jumper afterwards)
      8. Reboot.
      0. Exit


  Press UP/DOWN to move, ENTER to select, ESC to quit
on
starting USB...
Bus xhci@11200000: xhci-mtk xhci@11200000: hcd: 0x0000000011200000, ippc: 0x0000000011203e00
xhci-mtk xhci@11200000: ports disabled mask: u3p-0x1, u2p-0x0
xhci-mtk xhci@11200000: u2p:1, u3p:1
Register 200010f NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus xhci@11200000 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
234341 bytes read in 9 ms (24.8 MiB/s)
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
Writing 262144 byte(s) (128 page(s)) at offset 0x00000000
Writing 262144 byte(s) (128 page(s)) at offset 0x00040000
Writing 262144 byte(s) (128 page(s)) at offset 0x00080000
22282240 bytes read in 506 ms (42 MiB/s)
Erasing 0x00000000 ... 0x0fefffff (2040 eraseblock(s))
Skipping bad block at 0x07f00000
[.... multiple hunderd bad blocks here]
Skipping bad block at 0x0fee0000
Writing 22282240 byte(s) (10880 page(s)) at offset 0x00000000
done

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0244 [010F]
Jump to BL

NOTICE:  BL2: v2.10.0   (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 21:08:22, Dec 17 2025
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: EOF marker found in block 165
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
NOTICE:  UBI: Volume fip (Id #2) size is 961529 bytes
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.10.0  (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL31: Built : 21:08:22, Dec 17 2025


U-Boot 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)

CPU:   MediaTek MT7981
Model: OpenWrt One
DRAM:  1 GiB
Core:  44 devices, 20 uclasses, devicetree: separate
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
Loading Environment from UBI... SF: Detected w25q128 with page size 256 Bytes, erase size 4 KiB, total 16 MiB
UBI: EOF marker found, PEBs from 165 will be erased
ubi0 warning: ubi_calculate_reserved: number of bad PEBs (1024) is above the expected limit (40), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)
Read 126976 bytes from volume ubootenv to 000000007f7bf040
Read 126976 bytes from volume ubootenv2 to 000000007f7de080
*** Warning - bad CRC, using default environment

In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... UBI partition 'ubi' already selected
Read 126976 bytes from volume ubootenv to 000000007f7bf040
Read 126976 bytes from volume ubootenv2 to 000000007f7de080
*** Warning - bad CRC, using default environment

Net:
Warning: ethernet@15100000 (eth0) using random MAC address - d2:1d:43:7b:ae:46
eth0: ethernet@15100000
Reading 131072 byte(s) at offset 0x00000000
Saving Environment to UBI... UBI partition 'ubi' already selected
Writing to UBI... done
OK
Saving Environment to UBI... UBI partition 'ubi' already selected
Writing to UBI... done
OK

        ( ( ( OpenWrt ) ) )  [SPI-NAND]       U-Boot 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from NAND.
      4. Boot recovery system from NAND.
      5. Load production system via TFTP then write to NAND.
      6. Load recovery system via TFTP then write to NAND.
      7. Load BL31+U-Boot FIP via TFTP then write to NAND.
      8. Load BL2 preloader via TFTP then write to NAND.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. Exit


  Press UP/DOWN to move, ENTER to select, ESC to quit
off
off
Volume calibration not found!
No size specified -> Using max size (10792960)
Read 10792960 bytes from volume fit to 0000000046000000

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-6.6.119
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5648604 Bytes = 5.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8f32ab83
     Hash algo:    sha1
     Hash value:   175cfdd44fcdc087f671f14a0aef4df0c4dba6cc
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46565000
     Data Size:    29860 Bytes = 29.2 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   679d6e39
     Hash algo:    sha1
     Hash value:   ce5351a5bab3d6e368d53719ef68fa64b548da9d
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x4656d000
     Data Size:    5005312 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   90ed72db
     Hash algo:    sha1
     Hash value:   7c09e6f970b2adee0b0287f2c6c7b023069578ec
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt openwrt_one
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
   Hash(es) for Image 2 (rootfs-1): crc32+ sha1+
No size specified -> Using max size (105517056)
Creating dynamic volume rootfs_data of size 105517056
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.119
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5648604 Bytes = 5.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8f32ab83
     Hash algo:    sha1
     Hash value:   175cfdd44fcdc087f671f14a0aef4df0c4dba6cc
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46565000
     Data Size:    29860 Bytes = 29.2 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   679d6e39
     Hash algo:    sha1
     Hash value:   ce5351a5bab3d6e368d53719ef68fa64b548da9d
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Loading fdt from 0x46565000 to 0x43f00000
   Booting using the fdt blob at 0x43f00000
Working FDT set to 43f00000
## Loading loadables from FIT Image at 46000000 ...
   Trying 'rootfs-1' loadables subimage
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x4656d000
     Data Size:    5005312 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   90ed72db
     Hash algo:    sha1
     Hash value:   7c09e6f970b2adee0b0287f2c6c7b023069578ec
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Uncompressing Kernel Image to 44000000
   Loading Device Tree to 000000007e7ee000, end 000000007e7f84a3 ... OK
Working FDT set to 7e7ee000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.119 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r29087-d9c5716d1d) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Wed Dec 17 21:08:22 2025
[    0.000000] Machine model: OpenWrt One
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.4
[    0.000000] percpu: Embedded 18 pages/cpu s35112 r8192 d30424 u73728
[    0.000000] pcpu-alloc: s35112 r8192 d30424 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line:
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000007eb00000-0x000000007ec00000] (1MB)
[    0.000000] Memory: 1010736K/1048576K available (9088K kernel code, 1002K rwdata, 1676K rodata, 448K init, 305K bss, 37840K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: 0xffffffc080010080
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000090] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000100] pid_max: default: 32768 minimum: 301
[    0.002993] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.003005] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.005220] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.005774] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.005936] rcu: Hierarchical SRCU implementation.
[    0.005939] rcu:     Max phase no-delay instances is 1000.
[    0.006398] smp: Bringing up secondary CPUs ...
[    0.006778] Detected VIPT I-cache on CPU1
[    0.006828] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.006861] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.006937] smp: Brought up 1 node, 2 CPUs
[    0.006942] SMP: Total of 2 processors activated.
[    0.006945] CPU features: detected: 32-bit EL0 Support
[    0.006949] CPU features: detected: CRC32 instructions
[    0.006983] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.006987] CPU: All CPU(s) started at EL2
[    0.006988] alternatives: applying system-wide alternatives
[    0.011120] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.011141] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.012414] pinctrl core: initialized pinctrl subsystem
[    0.013642] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.013981] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.014008] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.014029] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.014444] thermal_sys: Registered thermal governor 'fair_share'
[    0.014448] thermal_sys: Registered thermal governor 'bang_bang'
[    0.014451] thermal_sys: Registered thermal governor 'step_wise'
[    0.014454] thermal_sys: Registered thermal governor 'user_space'
[    0.014495] ASID allocator initialised with 65536 entries
[    0.015446] pstore: Using crash dump compression: deflate
[    0.015452] pstore: Registered ramoops as persistent store backend
[    0.015454] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.017328] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.024783] Modules: 29600 pages in range for non-PLT usage
[    0.024791] Modules: 521120 pages in range for PLT usage
[    0.025948] cryptd: max_cpu_qlen set to 1000
[    0.027164] SCSI subsystem initialized
[    0.027360] libata version 3.00 loaded.
[    0.029168] clocksource: Switched to clocksource arch_sys_counter
[    0.031509] NET: Registered PF_INET protocol family
[    0.031660] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.033404] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.033422] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.033431] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.033486] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[    0.033687] TCP: Hash tables configured (established 8192 bind 8192)
[    0.034066] MPTCP token hash table entries: 1024 (order: 3, 24576 bytes, linear)
[    0.034203] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.034227] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.034453] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.034481] PCI: CLS 0 bytes, default 64
[    0.036002] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.040821] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.040829] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.098871] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.100646] gpio-export gpio-export: 3 gpio(s) exported
[    0.101241] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    0.101260] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    0.101272] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    0.110241] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.114200] printk: console [ttyS0] disabled
[    0.134608] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.134654] printk: console [ttyS0] enabled
[    0.934991] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 73, base_baud = 2500000) is a ST16650V2
[    0.949698] loop: module loaded
[    0.955728] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    0.960867] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.967223] Creating 4 MTD partitions on "spi0.0":
[    0.972017] 0x000000000000-0x000000040000 : "bl2-nor"
[    0.977524] 0x000000040000-0x000000100000 : "factory"
[    0.983384] 0x000000100000-0x000000180000 : "fip-nor"
[    0.989085] 0x000000180000-0x000000e00000 : "recovery"
[    0.998463] spi-nand spi1.1: calibration result: 0x3
[    1.003579] spi-nand spi1.1: Winbond SPI NAND was found.
[    1.008892] spi-nand spi1.1: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.017790] 2 fixed-partitions partitions found on MTD device spi1.1
[    1.024455] Creating 2 MTD partitions on "spi1.1":
[    1.029268] 0x000000000000-0x000000100000 : "bl2"
[    1.035196] 0x000000100000-0x000010000000 : "ubi"
[    1.203229] ubi0: default fastmap pool size: 100
[    1.207850] ubi0: default fastmap WL pool size: 50
[    1.212651] ubi0: attaching mtd5
[    2.061676] ubi0: scanning is finished
[    2.075361] ubi0 error: 0xffffffc0805e1828: no enough physical eraseblocks (2, need 3)
[    2.083729] ubi0 error: 0xffffffc0805d6324: failed to attach mtd5, error -28
[    2.293261] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081780000, irq 78
[    2.303195] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081780000, irq 78
[    2.313025] i2c_dev: i2c /dev entries driver
[    2.320187] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    2.329438] NET: Registered PF_INET6 protocol family
[    2.335303] Segment Routing with IPv6
[    2.338986] In-situ OAM (IOAM) with IPv6
[    2.342968] NET: Registered PF_PACKET protocol family
[    2.348033] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.361404] 8021q: 802.1Q VLAN Support v1.8
[    2.388070] phy phy-soc:usb-phy@11e10000.1: type_sw - reg 0x218, index 0
[    2.395659] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[    2.403014] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[    2.409292] mtk-pcie-gen3 11280000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    2.749184] mtk-pcie-gen3 11280000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x1)
[    2.758008] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[    2.765950] clk: Disabling unused clocks
[    2.770702] /dev/root: Can't open blockdev
[    2.774811] VFS: Cannot open root device "" or unknown-block(0,0): error -6
[    2.781773] Please append a correct "root=" boot option; here are the available partitions:
[    2.790126] 1f00             256 mtdblock0
[    2.790133]  (driver?)
[    2.796650] 1f01             768 mtdblock1
[    2.796654]  (driver?)
[    2.803175] 1f02             512 mtdblock2
[    2.803180]  (driver?)
[    2.809700] 1f03           12800 mtdblock3
[    2.809705]  (driver?)
[    2.816221] 1f04            1024 mtdblock4
[    2.816225]  (driver?)
[    2.822745] 1f05          261120 mtdblock5
[    2.822750]  (driver?)
[    2.829272] List of all bdev filesystems:
[    2.833267]  ext3
[    2.833270]  ext2
[    2.835184]  ext4
[    2.837097]  squashfs
[    2.839010]  f2fs
[    2.841275]
[    2.844669] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.852916] SMP: stopping secondary CPUs
[    2.856827] Kernel Offset: disabled
[    2.860302] CPU features: 0x0,00000000,00000000,1000400b
[    2.865601] Memory Limit: none
[    2.870766] pstore: backend (ramoops) writing error (-28)
[    2.876154] Rebooting in 1 seconds..

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0244 [010F]
Jump to BL

NOTICE:  BL2: v2.10.0   (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 21:08:22, Dec 17 2025
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
NOTICE:  UBI: Volume fip (Id #2) size is 961529 bytes
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.10.0  (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL31: Built : 21:08:22, Dec 17 2025


U-Boot 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)

CPU:   MediaTek MT7981
Model: OpenWrt One
DRAM:  1 GiB
Core:  44 devices, 20 uclasses, devicetree: separate
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
Loading Environment from UBI... SF: Detected w25q128 with page size 256 Bytes, erase size 4 KiB, total 16 MiB
ubi0 warning: ubi_calculate_reserved: number of bad PEBs (1024) is above the expected limit (40), not reserving any PEBs for bad PEB handling, will use available PEBs (if any)
Read 126976 bytes from volume ubootenv to 000000007f7bf040
Read 126976 bytes from volume ubootenv2 to 000000007f7de080
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... UBI partition 'ubi' already selected
Read 126976 bytes from volume ubootenv to 000000007f7bf040
Read 126976 bytes from volume ubootenv2 to 000000007f7de080
OK
Net:   eth0: ethernet@15100000

        ( ( ( OpenWrt ) ) )  [SPI-NAND]       U-Boot 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from NAND.
      4. Boot recovery system from NAND.
      5. Load production system via TFTP then write to NAND.
      6. Load recovery system via TFTP then write to NAND.
      7. Load BL31+U-Boot FIP via TFTP then write to NAND.
      8. Load BL2 preloader via TFTP then write to NAND.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. Exit


  Press UP/DOWN to move, ENTER to select, ESC to quit
off
off
Volume calibration not found!
No size specified -> Using max size (10792960)
Read 10792960 bytes from volume fit to 0000000046000000

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-6.6.119
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5648604 Bytes = 5.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8f32ab83
     Hash algo:    sha1
     Hash value:   175cfdd44fcdc087f671f14a0aef4df0c4dba6cc
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46565000
     Data Size:    29860 Bytes = 29.2 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   679d6e39
     Hash algo:    sha1
     Hash value:   ce5351a5bab3d6e368d53719ef68fa64b548da9d
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x4656d000
     Data Size:    5005312 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   90ed72db
     Hash algo:    sha1
     Hash value:   7c09e6f970b2adee0b0287f2c6c7b023069578ec
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt openwrt_one
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
   Hash(es) for Image 2 (rootfs-1): crc32+ sha1+
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.119
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5648604 Bytes = 5.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8f32ab83
     Hash algo:    sha1
     Hash value:   175cfdd44fcdc087f671f14a0aef4df0c4dba6cc
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46565000
     Data Size:    29860 Bytes = 29.2 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   679d6e39
     Hash algo:    sha1
     Hash value:   ce5351a5bab3d6e368d53719ef68fa64b548da9d
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Loading fdt from 0x46565000 to 0x43f00000
   Booting using the fdt blob at 0x43f00000
Working FDT set to 43f00000
## Loading loadables from FIT Image at 46000000 ...
   Trying 'rootfs-1' loadables subimage
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x4656d000
     Data Size:    5005312 Bytes = 4.8 MiB
     Hash algo:    crc32
     Hash value:   90ed72db
     Hash algo:    sha1
     Hash value:   7c09e6f970b2adee0b0287f2c6c7b023069578ec
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Uncompressing Kernel Image to 44000000
   Loading Device Tree to 000000007e7ee000, end 000000007e7f84a3 ... OK
Working FDT set to 7e7ee000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.119 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r29087-d9c5716d1d) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Wed Dec 17 21:08:22 2025
[    0.000000] Machine model: OpenWrt One
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
3

What is the status of the NOR Write Protect jumper on the main board, Installed/Removed.

4

On my board there was none pre-installed, so I kept it off.

( I bought it at this seller: https://www.aliexpress.com/store/5795449? ), the sticker on the case mentions it to be a OpenWrt one HW 24.03 with a 2025-10-30-MP marking. The board itself mentions it to be HW 24.03 Rev 00. It is one of those boards with the missing/not-installed M.2 posts at the first position as mentioned in the Wiki.

5

On the OO, you have two fallbacks:

  • NOR
  • mtkuart

Especially the later should make ot virtually unbrickable.

6

I was able to flash the NAND from NOR via USB as mentioned in the original post. However, the NAND still seems to be corrupted afterwards, so it seems as if the NAND was damaged somehow during the upgrade to 25.12 via attended sysupgrade.

I did not try (and don't see a reason yet) to upgrade NOR, I just want to recover NAND to get normal operations back :slight_smile:

7

Dear all,
I tried my luck over in the BananaPi forums and I got some information there to erase the mtd via u-boot. This works as well as the following reflashing (booting via NOR and getting data from USB stick) - but as soon as the device tries to boot again from NAND, it shows that the data is defective. So the NAND module is really broken/died during the 25.12 upgrade. With that the OpenWRT One unit is bricked... https://forum.banana-pi.org/t/openwrt-one-permanently-bricked-through-openwrt-25-12-upgrade/26943/4

8

I replaced the NAND module with a new one and the OpenWRT One works again. Looking at the overall solder quality, I am not sure wheter the shop sold a genuine product, becasue the overall quality looks off. The seller also did not wanted to replace the less than 4 months old OpenWRT One, but wanted me to buy a new one, which I declined.

Shop: Chip Board House Store / https://www.aliexpress.com/store/5795449 / https://de.aliexpress.com/item/1005007826746106.html

9

Thanks for the update. That is good to know, and I'll add a cautionary note to the wiki.

I’m sure SFC (https://sfconservancy.org/) would like to hear your account.

10

Thank you,
I did inspect packaging and everything further and I am not sure whether the product is actually counterfeit or genuine. I compared the pictures with the ones in the Wiki ( https://openwrt.org/toh/openwrt/one ) - and it somewhat looks worse but in some aspects (e.g. underfill of solder on the throughhole components) it lines up even though I thought this to be a defect on first glance. Physically, it looks like one of those units mentioned in the wiki with the wrong/missing M.2 standoff not soldered at the 2230 location.

With that I am not sure whether that vendor should be put on the wiki as a bad actor, however, it is probably a good idea to emphasize on buying from the SFC AliExpress store. If I had watched out for that, they would have probably just exchanged the defective unit instead of letting me sit on the broke one/refusing repair and help.

However, I would have on suggestion, could you please add the part number of the NAND chip to the Wiki? The picture in the Wiki shows the NAND to be a Winbond W25N01GVZEIG - however thats the wrong version, it shows the initial 1 Gbit/128 MB chip which was used during the prototype phase.

The real chip is a 2 Gbit/256 MB Winbond W25N02KVZEIR - thats the one that would be needed to replace a faulty one and is the one being used in production right now. ( For the nerds: SPI ID would be following: Winbond SpiNAND: EFh, W25N02KV: AA22h, e.g. complete SPI ID is EFAA22 )

Pictures of my board (right click, open in new window for bigger size, original link to imgur: https://imgur.com/a/3VwMROI )

NOR and NAND flash before soldering
NOR and NAND Flash before soldering

Detail view at defects
Detail view at defects

Overview
Overview

11

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.