Reboot loop after upgrading to 22.03.0 on Xiaomi Router 4

I've upgraded OpenWrt firmware from 21.02 to 22.03.0-rc3 on Xiaomi Router 4 using LuCi: https://openwrt.org/docs/guide-quick-start/sysupgrade.luci

After the upgrade, the router is stuck in a reboot loop. The same upgrade on Redmi AC2100 was successful (only via CLI).

After connecting to a serial port, I was managed to check dmesg and see lots of:
Bad eraseblock - 258 errors
mt7621-nand 1e003000.nand: Uncorrectable ECC error at page - 4452 errors

===================================================================
                MT7621   stage1 code May 28 2018 14:51:28 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0xe, 1/0 = 738/286 39000000
PLL3 FB_DL: 0x12, 1/0 = 705/319 49000000
PLL4 FB_DL: 0x12, 1/0 = 680/344 49000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1
000E:|    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1    1
000F:|    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0    0
0010:|    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0    0
0011:|    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 64
B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
opt_dle value:11
DRAMC_DDR2CTL[07c]=C287223D
DRAMC_PADCTL4[0e4]=000044B3
DRAMC_DQIDLY1[210]=0B0B090A
DRAMC_DQIDLY2[214]=050A080A
DRAMC_DQIDLY3[218]=0B080706
DRAMC_DQIDLY4[21c]=08070A07
DRAMC_R0DELDLY[018]=00001D1F
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    6 4 6 7 5 4 6 5 3 3
10 |    6 7 6 8 7 7
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =31 DQS1 = 29
==================================================================
bit     DQS0     bit      DQS1
0  (1~53)27  8  (1~52)26
1  (1~52)26  9  (1~50)25
2  (1~51)26  10  (2~53)27
3  (1~54)27  11  (1~50)25
4  (0~52)26  12  (0~56)28
5  (1~53)27  13  (1~54)27
6  (1~54)27  14  (2~57)29
7  (3~59)31  15  (1~56)28
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 9 11 11 10 8 10 5 6 7
10 |    8 11 7 10 7 8
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (May 28 2018 - 07:44:28)

Board: Ralink APSoC DRAM:  128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fa4000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 87fdfd90
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [98 F1 80 15 F2]
Device found in MTK table, ID: 98f1, EXT_ID: 8015f2
Support this Device in MTK table! 98f1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
..============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:May 28 2018  Time:07:44:28
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

Booting System 2
..ranand_erase: start:80000, len:20000
..Done!
done

3: System Boot system code via Flash.
## Booting image at bc600000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.116
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2678669 Bytes =  2.6 MB
   Load Address: 80001000
   Entry Point:  80001000
.........................................   Verifying Checksum ... OK
OK
commandline uart_en=0 factory_mode=0
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.10.116 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19378-9f415792e1) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Sat May 21 18:52:39 2022
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 4
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] percpu: Embedded 15 pages/cpu s30160 r8192 d23088 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=000168c0
[    0.000000] Readback ErrCtl register=000168c0
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 119536K/131072K available (6994K kernel code, 624K rwdata, 824K rodata, 1272K init, 244K bss, 11536K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from 0x80842a80 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000013] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 4398046511103ns
[    0.007946] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.016926] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.083087] pid_max: default: 32768 minimum: 301
[    0.087850] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.095053] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.105407] rcu: Hierarchical SRCU implementation.
[    0.110394] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.118403] smp: Bringing up secondary CPUs ...
[    0.123555] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.123565] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.123577] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.123654] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.178295] Synchronize counters for CPU 1: done.
[    0.210602] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.210611] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.210620] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.210666] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.269565] Synchronize counters for CPU 2: done.
[    0.300014] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.300022] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.300031] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.300080] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.354749] Synchronize counters for CPU 3: done.
[    0.384618] smp: Brought up 1 node, 4 CPUs
[    0.392735] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.402548] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.409560] pinctrl core: initialized pinctrl subsystem
[    0.416841] NET: Registered protocol family 16
[    0.422511] thermal_sys: Registered thermal governor 'step_wise'
[    0.423462] cpuidle: using governor teo
[    0.449951] random: fast init done
[    0.467570] clocksource: Switched to clocksource GIC
[    0.474401] NET: Registered protocol family 2
[    0.478970] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.486984] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.495372] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.502967] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.509953] TCP: Hash tables configured (established 1024 bind 1024)
[    0.516395] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.522878] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.530008] NET: Registered protocol family 1
[    0.534301] PCI: CLS 0 bytes, default 32
[    0.540382] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.551320] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.557067] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.567773] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.576856] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.582732] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.588646] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.595068] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.605493] printk: console [ttyS0] disabled
[    0.609814] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    0.618815] printk: console [ttyS0] enabled
[    0.618815] printk: console [ttyS0] enabled
[    0.627051] printk: bootconsole [early0] disabled
[    0.627051] printk: bootconsole [early0] disabled
[    0.639107] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.646457] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xf1
[    0.652847] nand: Toshiba TC58NVG0S3HTA00 1G 3.3V 8-bit
[    0.658073] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    0.665701] mt7621-nand 1e003000.nand: ECC strength adjusted to 12 bits
[    0.672331] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.679626] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.686912] Scanning device for bad blocks
[    0.691236] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 0.0
[    0.698270] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 0.1
[    0.705272] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 0.2
[    0.712292] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 0.3
[    0.719152] Bad eraseblock 0 at 0x000000000000

[   21.647184] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 39232.3
[   21.654377] rcu: INFO: rcu_sched self-detected stall on CPU
[   21.654396] rcu:     3-....: (2100 ticks this GP) idle=c3e/1/0x40000002 softirq=33/33 fqs=1050
[   21.654404]  (t=2100 jiffies g=-1167 q=257)
[   21.654414] NMI backtrace for cpu 3
[   21.654426] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.10.116 #0
[   21.654432] Stack : 00000000 8071e078 809a0000 00000035 00000000 00000000 00000000 00000000
[   21.654464]         00000000 00000000 00000000 00000000 00000000 00000001 80c11cb8 b486fa28
[   21.654489]         80c11d50 00000000 00000000 00a13649 00000038 803989c4 00245d17 ffffffff
[   21.654516]         00000000 ffff2cd4 ffff2cb0 70617773 80c11c98 806ed070 00000000 806f0000
[   21.654542]         00000000 807c0000 807c0000 807b82f8 00000008 ffffffff 0000000c 8098000c
[   21.654568]         ...
[   21.654575] Call Trace:
[   21.654593] [<803989c4>] 0x803989c4
[   21.654602] [<80007b08>] 0x80007b08
[   21.654608] [<80007b10>] 0x80007b10
[   21.654614] [<8037cd94>] 0x8037cd94
[   21.654620] [<8007fb60>] 0x8007fb60
[   21.654627] [<80383718>] 0x80383718
[   21.654633] [<80004f1c>] 0x80004f1c
[   21.654638] [<803838cc>] 0x803838cc
[   21.654645] [<800962b4>] 0x800962b4
[   21.654653] [<8009c668>] 0x8009c668
[   21.654662] [<800a4910>] 0x800a4910
[   21.654670] [<800a28cc>] 0x800a28cc
[   21.654676] [<800b708c>] 0x800b708c
[   21.654683] [<8006a300>] 0x8006a300
[   21.654689] [<804bc820>] 0x804bc820
[   21.654694] [<8008c2e4>] 0x8008c2e4
[   21.654702] [<80085d38>] 0x80085d38
[   21.654708] [<806d4b1c>] 0x806d4b1c
[   21.654713] [<80399800>] 0x80399800
[   21.654720] [<80399894>] 0x80399894
[   21.654726] [<80085d38>] 0x80085d38
[   21.654733] [<806d49a4>] 0x806d49a4
[   21.654739] [<80399034>] 0x80399034
[   21.654746] [<80003448>] 0x80003448
[   21.654750]

[   35.163085] Bad eraseblock 1023 at 0x000007fe0000
[   35.167872] 10 fixed-partitions partitions found on MTD device mt7621-nand
[   35.174714] Creating 10 MTD partitions on "mt7621-nand":
[   35.180029] 0x000000000000-0x000000080000 : "Bootloader"
[   35.186427] 0x000000080000-0x0000000c0000 : "Config"
[   35.192590] 0x0000000c0000-0x000000100000 : "Bdata"
[   35.198475] 0x000000100000-0x000000140000 : "factory"
[   35.204529] 0x000000140000-0x000000180000 : "crash"
[   35.210343] 0x000000180000-0x0000001c0000 : "crash_syslog"
[   35.216761] 0x0000001c0000-0x000000200000 : "reserved0"
[   35.222970] 0x000000200000-0x000000600000 : "kernel_stock"
[   35.229442] 0x000000600000-0x000000a00000 : "kernel"
[   35.235314] 0x000000a00000-0x000007f80000 : "ubi"
[   35.289008] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[   35.297978] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.0
[   35.305181] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.1
[   35.312375] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.2
[   35.319582] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.3
[   35.326616] mtk_soc_eth 1e100000.ethernet: generated random MAC address 6a:77:62:db:9f:48
[   35.335599] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[   35.344826] i2c /dev entries driver
[   35.350616] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[   35.357386] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[   35.366166] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[   35.374338] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[   35.382615] mt7621-pci 1e140000.pcie: Parsing DT failed
[   35.389999] NET: Registered protocol family 10
[   35.395983] Segment Routing with IPv6
[   35.399775] NET: Registered protocol family 17
[   35.404300] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[   35.417603] 8021q: 802.1Q VLAN Support v1.8
[   35.425112] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[   35.449199] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=26)
[   35.461603] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7530 PHY] (irq=27)
[   35.473676] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.0
[   35.480915] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.1
[   35.488113] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.2
[   35.495292] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 540.3
[   35.503267] mt7530 mdio-bus:1f wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7530 PHY] (irq=28)
[   35.515716] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[   35.526122] DSA: tree 0 setup
[   35.529420] rt2880-pinmux pinctrl: pcie is already enabled
[   35.534973] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[   35.541685] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[   35.550482] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[   35.558655] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[   35.566891] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[   35.574643] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[   35.582274] mt7621-pci 1e140000.pcie: failed to parse bus ranges property: -22
[   35.689675] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[   35.695243] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[   35.800953] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[   35.807912] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[   35.814846] mt7621-pci 1e140000.pcie: PCIE1 enabled
[   35.819723] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[   35.829165] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[   35.835510] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[   35.842389] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[   35.849259] pci_bus 0000:00: root bus resource [bus 00-ff]
[   35.854726] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] (bus address [0x00000000-0x0fffffff])
[   35.864923] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[   35.870949] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[   35.877193] pci 0000:00:00.0: reg 0x14: [mem 0x60200000-0x6020ffff]
[   35.883527] pci 0000:00:00.0: supports D1
[   35.887539] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[   35.894965] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[   35.901030] pci 0000:01:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[   35.908075] pci 0000:01:00.0: reg 0x10: [mem size 0x00100000 64bit]
[   35.914353] pci 0000:01:00.0: reg 0x30: initial BAR value 0x00000000 invalid
[   35.921389] pci 0000:01:00.0: reg 0x30: [mem size 0x00010000 pref]
[   35.927676] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[   35.935160] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[   35.940408] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[   35.946479] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[   35.953257] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[   35.960480] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[   35.967109] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[   35.973713] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[   35.980670] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[   35.987459] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[   35.994652] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[   36.001438] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[   36.008226] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[   36.015518] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref]
[   36.022726] pci 0000:00:00.0: PCI bridge to [bus 01]
[   36.027692] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[   36.034453] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[   36.041231] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[   36.050180] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 5120.0
[   36.057601] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 5120.1
[   36.064866] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 5120.2
[   36.072178] mt7621-nand 1e003000.nand: Uncorrectable ECC error at page 5120.3
[   36.079306] UBI error: unable to read from mtd9
[   36.084766] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[   36.084866] /dev/root: Can't open blockdev
[   36.095976] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[   36.103453] Please append a correct "root=" boot option; here are the available partitions:
[   36.111801] 1f00             512 mtdblock0
[   36.111807]  (driver?)
[   36.118337] 1f01             256 mtdblock1
[   36.118342]  (driver?)
[   36.124847] 1f02             256 mtdblock2
[   36.124851]  (driver?)
[   36.131382] 1f03             256 mtdblock3
[   36.131387]  (driver?)
[   36.137937] 1f04             256 mtdblock4
[   36.137942]  (driver?)
[   36.144447] 1f05             256 mtdblock5
[   36.144451]  (driver?)
[   36.150982] 1f06             256 mtdblock6
[   36.150987]  (driver?)
[   36.157515] 1f07            4096 mtdblock7
[   36.157520]  (driver?)
[   36.164025] 1f08            4096 mtdblock8
[   36.164029]  (driver?)
[   36.170558] 1f09          120320 mtdblock9
[   36.170564]  (driver?)
[   36.177067] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[   36.185323] Rebooting in 1 seconds..

There's another thread: Bad eraseblock

Is it NAND failure, and no relation to upgrading? As it started/triggered right after the firmware upgrade.
Has anyone done the upgrade on the same router and faced the issue?

Want to make sure it's not software, but now a hardware-related issue.

Thanks. Also, is there a way to fix it, or router can be thrown away?

Try going back to 21.02.3 and seeing, if it works. If it does, then that tells us the issue is with the snapshot, not the hardware.

Thanks for the reply. How can I revert to 21.02 in current state? After restart, and during a boot I can see the following options, but 3rd (default) is always chosen no matter what I choose:

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

Booting System 2
..ranand_erase: start:80000, len:20000
..Done!
done

3: System Boot system code via Flash.
## Booting image at bc600000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.116
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2678669 Bytes =  2.6 MB
   Load Address: 80001000
   Entry Point:  80001000
.........................................   Verifying Checksum ... OK
OK
commandline uart_en=0 factory_mode=0
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Well, is it a Mi Router 4A? Or 4C? Or what? If it's a 4A, is it the gigabit version or the 100Mbps-one, and is it the international version or the Chinese one?

1 Like

Neither. It's https://openwrt.org/toh/xiaomi_mi_router_4

I was trying to restore to stock firmware via PXE but had no luck and after using a serial console found ECC and bad eraseblock errors and reboot loop.

At this stage, I run out of ideas on how I can fix it.

So, uboot reacts to your input, but e.g. using option 4 doesn't actually work and just proceeds to boot from flash?

1 Like

At least I type "4" from the 'screen' session via serial adapter (LED blinks while pushing and TX/RX/GND pins are connected) to send it to a router via UART. But 3rd (default) option is used by uboot. Not sure if I send it incorrectly or if it's ignored.

screen /dev/tty.wchusbserial1420 115200

It's probably ignored the same way as e.g. on the Mi Router 4A. You'd need an SPI NOR flash programmer and then modify uboot to make it accept UART-input, like e.g. I detailed in Observations on Xiaomi MIR4AG newer firmware

Your uboot is unlikely to be the exact same as mine, so exactly what you need to change is unlikely to be the same. Also, without a programmer, you are basically sh*t out of luck.

3 Likes

Such a CH341a programmer is easy enough to get though, most of the times. @sequentiality Got any pictures of the board? The wiki entry doesn't have them nor does it link to the FCC site e.g.

[ 0.652847] nand: Toshiba TC58NVG0S3HTA00 1G 3.3V 8-bit

I suspect 'U8' (front - on the right middle) are the pins leading to NAND (back - on the left middle) to connect the programmer to?

Front:


Back:

Well NAND requires different tools, the CH341a programmer is for NOR AFAIK.

1 Like

No, uboot lives inside an 8-pin SPI flash, not NAND. That's what you'd be programming.

EDIT: Oops, I am actually incorrect. I rechecked your log and yes, uboot is also on the NAND. Well, that makes recovery even more difficult.

Clips that allow for programming NAND without desoldering cost more than a new router, plus then there's the programmer itself that costs even more. If you're not planning to do a ton of hardware-hacking or your own electronics, it's probably not worth investing in such equipment.

2 Likes

If there's a NOR chip, probably under the RF shields then? I don't see any exposed on the pictures. Top right seems like contacts that could connect a NOR chip but there isn't any.

Under the shields. But I think it's the U8.


Yeah, probably it's not worth the effort.

It was the router used for testing and adding OpenWrt support for it. I've bricked it dozens of times, but easily restored it via PXE boot.

And now, with a regular upgrade it's gone :smiley:

Thank you for your support, @WereCatf @Borromini.

I think the thread can be closed.

That sucks. Maybe someone at a local hackerspace could help you rescue it? NAND isn't as straightforward as NOR unfortunately, my CH341a programmer saved my b*tt quite a few times already...

1: Load system code to SDRAM via TFTP.

Did you try that with an initramfs image already? Once your initramfs image has booted, you should be able to just sysugprade a permanent installation.

Any uboot options are ignored as described above :frowning:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.