Recover Belkin RT3200

diagpope · May 19, 2025, 2:24am

I bricked one of my RT3200 likely because of losing oversight what device was updated and stupidity:, I do not have mtd blocks from either factory or OpenWrt config as backup.

The dangowrt conversion was likely - wrongfylly done more than once and that is not good.

Status of recovery attempts:
I am now able to boot via Serial adapter and Uboot into 22.03.3 or 23.05.5 from tftp, both with network and luci running. I can also write them for flash and boot from the device.
When I sysupgrade or run luci FWupdate to 24.10, the imminent reboot ends up in

NOTICE:  BL2: v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7622-snand-ubi-1ddr)
NOTICE:  BL2: Built : 18:00:59, May 10 2025
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  CPU: MT7622
NOTICE:  WDT: disabled
NOTICE:  SPI-NAND: adjusting SPI-NAND pin drive strength to 12mA
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: Bad VID magic in block 0 181c0012
NOTICE:  UBI: Bad VID magic in block 1 33008052
NOTICE:  UBI: Bad VID magic in block 2 40028012
NOTICE:  UBI: Bad VID magic in block 3 66feff97
NOTICE:  UBI: Bad VID magic in block 4 e3028052
NOTICE:  UBI: Bad VID magic in block 5 bc000a8b
NOTICE:  UBI: Bad VID magic in block 6 2920646f
NOTICE:  UBI: Bad VID magic in block 7 00000000
NOTICE:  UBI: Bad VID magic in block 10 a2ddcbc3
NOTICE:  UBI: Bad VID magic in block 11 7edc1941
NOTICE:  UBI: Bad VID magic in block 12 b57a61a9
NOTICE:  UBI: Bad VID magic in block 13 a61657e1
NOTICE:  UBI: Bad VID magic in block 14 f9a5744b
NOTICE:  UBI: Bad VID magic in block 15 721a9f24
NOTICE:  UBI: Bad VID magic in block 16 46dd7407
NOTICE:  UBI: Bad VID magic in block 17 98dfb80c
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   io_dev_init failed for FIP image id 0 (-2)
ERROR:   Image id 3 open failed with -2
ERROR:   BL2: Failed to load image id 3 (-2)

The flash layout appears to be pre-UBI conversion

root@OpenWrt:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00080000 00020000 "bl2"
mtd1: 00140000 00020000 "fip"
mtd2: 00100000 00020000 "factory"
mtd3: 07d00000 00020000 "ubi"

The boot loader (?) is

root@OpenWrt:~# grep "(release)" /dev/mtd0ro
v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7622-snand-ubi-1ddr)
v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7622-snand-ubi-1ddr)
v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7622-snand-ubi-1ddr)
v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7622-snand-ubi-1ddr)

And now I am stuck as to what's next.
I can not find instructions how to get get an proper layout

Is the bootloader intact?
Is the fip partition corrupted, what does fip do?
Is there a kernel at the right place?
Is it possible to use mtd /ubi tools to edit the layout manually?
Is it possible to copy an entire flash layout from one of my other devices?

My functional RT3200 shows

grep "(release)" /dev/mtd0ro
v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
v2.10.0 (release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)

cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00080000 00020000 "bl2"
mtd1: 07f80000 00020000 "ubi"

Is it possible to clone one or will that overwrite Serial numbers, mac addresses w/o being able to fix the config/recover?

Any help is appreciated, thank you.

grauerfuchs · May 19, 2025, 9:15am

The issue is that you ignored warnings. 23.05 and older cannot directly upgrade to 24.10 on this device. You need to run the latest UBI installer much as you had originally done to get 23.05 running in the first place. The fact that you didn't take the backups from boot_backup or from the mtdparts only makes it worse, since you may have damaged the unique factory data on the router.

This version number indicates that your BL2 (preloader) has been upgraded to post 24.10 data layout. It cannot boot a device with layout designed for 23.05 or older.

You're saying that if you use mtk_uartboot with the FIP for 23.05, it boots 23.05 successfully? Can you confirm that it's running the full firmware from flash, and not booting the recovery over TFTP? If so, then you might be able to get back to 23.05 by interrupting the boot process on the U-Boot menu and flashing only the BL2 (preloader) from 22.0x onto the device. Do not use the preloader from 23.05, since it contains the OKD bug. Thankfully, re-flashing the BL2 is an option available right in the U-Boot boot menu.

If downgrading the bootloader works and the router now boots on its own, check to make sure you still have access to the 5GHz radio. If you do, then you can run the UBI installer v. 1.1.4 to get to OpenWRT 24.10. If you do not see the 5GHz radio, do not attempt the upgrade. It will fail because the factory data was damaged. If this is the case, you'll need to run the hard recovery instructions. There's a link in the wiki under Serial Recovery, under the subsection of the bootloader being broken in an unusual way.

No.

The error ERROR: BL2: Failed to load image id 3 (-2) says it can't find the FIP. This usually happens when it is corrupted or, most likely in this case, it's not where it's expected to be because the boot chain is wrong for the data layout.
The FIP is part of the boot chain. The boot chain for this device is:
BL1 (baked into the SOC) => BL2 (preloader) => BL3.1 (part of the FIP) => BL3.3 (part of the FIP) => OpenWRT.

Yes, but it is going to be easier to do this from U-Boot.

Don't do this. You'll regret it. However, you can use an edited version of the factory data from another device if this one's factory data has been destroyed. The instructions for what to edit are in the 'hard recovery' post under the main forum topic for this device. The instructions are also linked from the device page on the wiki.

diagpope · May 19, 2025, 10:46am

@grauerfuchs
I booted 'Production from flash" and it ended with OpenWrt 23.05.5, r24106-10cc5fcd00 that has LAN access. There is no 5GHz radio, only 2.4Ghz. I will try hard recovery. Thank you for such great insight!

I tried the steps from Belkin RT3200/Linksys E8450 WiFi AX discussion - #5108 by grauerfuchs

but ended up at:

NOTICE: UBI: scanning is finished
NOTICE: UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE: UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR: UBI error: No volume named fip could be found
ERROR: BL2: Failed to load image id 3 (-2)

Must be user errror ...

grauerfuchs · May 19, 2025, 10:10pm

You haven't installed a FIP, but you have a valid 24.10 data layout. You may have missed the step for installing the FIP (it's right after you prepare the U-Boot environment).

diagpope · May 20, 2025, 12:09pm

I tried it again with 24.10.1. Here is the log (failed with same errors)

MT7622> run boot_tftp_write_bl2

Error: ethernet@1b100000 address 23:9f:9f:ff:0d:1b illegal value
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin'.
Load address: 0x48000000
Loading: ##T ####
         7.8 KiB/s
done
Bytes transferred = 88077 (1580d hex)
Erasing 0x00000000 ... 0x0007ffff (4 eraseblock(s))
Writing 131072 byte(s) (64 page(s)) at offset 0x00000000
Writing 131072 byte(s) (64 page(s)) at offset 0x00020000
Writing 131072 byte(s) (64 page(s)) at offset 0x00040000
Writing 131072 byte(s) (64 page(s)) at offset 0x00060000
MT7622>

MT7622> ubi detach; mtd erase ubi && ubi part ubi
Erasing 0x00000000 ... 0x07cfffff (1000 eraseblock(s))
MT7622>

MT7622> mw $loadaddr 0xff 0x1f000 ; ubi write $loadaddr ubootenv 0x1f000 ; ubi write $loadaddr ubootenv2 0x1f000
Volume ubootenv not found!
Volume ubootenv2 not found!
MT7622>

MT7622> run boot_tftp_write_fip
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip'.
Load address: 0x48000000
Loading: #################################################################
         #####
         4.1 MiB/s
done
Bytes transferred = 1021228 (f952c hex)
Erasing 0x00000000 ... 0x0013ffff (10 eraseblock(s))
Writing 1310720 byte(s) (640 page(s)) at offset 0x00000000
MT7622>

MT7622> tftpboot 0x48000000 factory.bin
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'factory.bin'.
Load address: 0x48000000
Loading: ####################################
         3.9 MiB/s
done
Bytes transferred = 524288 (80000 hex)
MT7622>

MT7622> mw.b 0x4807FFFA 0x7a
MT7622> mw.b 0x4807FFFB 0x8f
MT7622> mw.b 0x4807FFFC 0x05
MT7622> mw.b 0x4807FFFD 0xb4
MT7622> mw.b 0x4807FFFE 0xa6
MT7622> mw.b 0x4807FF 0xf6
MT7622> mw.b 0x4807FFF4 0x7a
MT7622> mw.b 0x4807FFF5 0x8f
MT7622> mw.b 0x4807FFF6 0x05
MT7622> mw.b 0x4807FFF7 0xb4
MT7622> mw.b 0x4807FFF8 0xa6
MT7622> mw.b 0x4807F9 0xf7
MT7622> mw.b 0x48000004 0x7a
MT7622> mw.b 0x48000005 0x8f
MT7622> mw.b 0x48000006 0x05
MT7622> mw.b 0x48000007 0xb4
MT7622> mw.b 0x48000008 0xa6
MT7622> mw.b 0x480009 0xf8
MT7622> mw.b 0x48005004 0x7a
MT7622> mw.b 0x48005005 0x8f
MT7622> mw.b 0x48005006 0x05
MT7622> mw.b 0x48005007 0xb4
MT7622> mw.b 0x48005008 0xa6
MT7622> mw.b 0x480009 0xf9
MT7622>

MT7622> ubi create factory $filesize static && ubi write $loadaddr factory $filesize
Creating static volume factory of size 524288
524288 bytes written to volume factory
MT7622>

run boot_tftp_recovery

device reboots

>>> Then loaded sysupgrade via luci

NOTICE:  UBI: Bad VID magic in block 117 5e250937
NOTICE:  UBI: Bad EC magic in block 1019 424d5402
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   BL2: Failed to load image id 3 (-2)

Attempt #3

Then, I decided to "alles nochmal, aber mit 23.05". It booted fine into 23.05 recovery with old NAND layout. I took these steps :

mw.b 0x48000007 0xb4
mw.b 0x48000008 0xa6
mw.b 0x48000009 0xf8
mw.b 0x48005004 0x7a
mw.b 0x48005005 0x8f
mw.b 0x48005006 0x05
mw.b 0x48005007 0xb4
mw.b 0x48005008 0xa6
mw.b 0x48005009 0xf9

ubi detach; mtd erase ubi && ubi part ubi

ubi create factory $filesize static && ubi write $loadaddr factory $filesize

run boot_tftp_recovery

After reboot, I applied the 23.05 sysupgrade via luci from:

https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/mt7622/openwrt-23.05.4-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

But:
Boot production system from flash:

Volume fit not found!
Press ENTER to return to menu

Boot recovery system from flash boots back into 23.05 recovery

 OpenWrt 23.05.4, r24012-d8dd03c46f

Here I run sysupgrade again with 23.05, installs clean but does not boot it production from flash

Volume fit not found!
Press ENTER to return to menu

I thought I can now use Uboot to run: Load production and write to flash

wget https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/mt7622/openwrt-23.05.4-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb -O /srv/tftp/openwrt-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

but it has no ethernet address which I know how to set but didnt't the recovery provide one I set earlier?

3. Boot production system from flash

Volume fit not found!
Press ENTER to return to menu

4. Boot recovery system from flash.

OpenWrt 23.05.4, r24012-d8dd03c46f


I also tried from here to flash the dangowrt recovery installer signed/unsigned but always end up in 23.05 recovery.

How do I get out of this recovery?

grauerfuchs · May 20, 2025, 12:34pm

You're mixing steps from different versions and you're also skipping over instructions and placing other instructions in different places. For 23.05, the factory data is not in UBI. There are different commands to write it after performing the edits. Please go back to the hard recovery instructions and look at the differences. This document has recently been updated to include fixes for some of the common problems and also it now includes an improved order of instructions for installing 24.10.

The "Volume fit not found" error will be solved by installing a compatible sysupgrade file. This can be done either by using U-Boot to install the production firmware or by flashing the firmware via OpenWRT. This can even be done from the recovery version.

Not having an ethernet address in U-Boot is common when the factory data is lost or when the flash is completely rebuilt. The command setenv -f ethaddr 00:11:22:33:44:55 (use the real MAC address on the sticker instead of the fake one in the command) followed by saveenv will fix that. The hard recovery instructions have been updated to add this fix.

The UBI installer will not work if it cannot find the factory data in the place where it is expected. Until you install the factory data in the right place, you will be unable to upgrade using the UBI installer.

diagpope · May 23, 2025, 1:46am

I hope i fixed up my act. I am using 24.10, booted into Uboot Option 0, then pasted lines of codes:

ubi detach; mtd erase ubi && ubi part ubi

mw $loadaddr 0xff 0x1f000
ubi create ubootenv 0x100000 dynamic ; ubi write $loadaddr ubootenv 0x1f000
ubi create ubootenv2 0x100000 dynamic ; ubi write $loadaddr ubootenv2 0x1f000

setenv -f ethaddr 7a:8f:05:b4:a6:f6
saveenv

run boot_tftp_write_bl2

run boot_tftp_write_fip

tftpboot factory.bin && ubi create factory $filesize static && ubi write $loadaddr factory $filesize

run boot_tftp_recovery

#----------------
Then, after reboot, the upgrade succeeds with no errors

sysypgrade -v https://downloads.openwrt.org/releases/24.10.1/targets/mediatek/mt7622/openwrt-24.10.1-mediatek-mt7622-linksys_e8450-squashfs-sysupgrade.bin

Upon next boot fip volume cannot be found


...
Jump to BL

NOTICE:  BL2: v2.10.0	(release):OpenWrt v2024.01.17~bacca82a-3 (mt7622-snand-ubi-1ddr)
NOTICE:  BL2: Built : 16:38:32, Apr 13 2025
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  CPU: MT7622
NOTICE:  SPI-NAND: adjusting SPI-NAND pin drive strength to 12mA
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: Bad VID magic in block 0 f35301a9
NOTICE:  UBI: Bad VID magic in block 1 e43f40f9
NOTICE:  UBI: Bad VID magic in block 2 21a02791
NOTICE:  UBI: Bad VID magic in block 3 00fc48d3
NOTICE:  UBI: Bad VID magic in block 4 e20315aa
NOTICE:  UBI: Bad VID magic in block 5 6fffff17
NOTICE:  UBI: Bad VID magic in block 6 6c782920
NOTICE:  UBI: Bad VID magic in block 7 00000000
NOTICE:  UBI: Bad VID magic in block 8 bc0ff04b
NOTICE:  UBI: Bad VID magic in block 9 f00ff40f
NOTICE:  UBI: Bad EC magic in block 10 22760200
NOTICE:  UBI: Bad EC magic in block 11 ffffffff
NOTICE:  UBI: Bad EC magic in block 12 ffffffff
NOTICE:  UBI: Bad EC magic in block 13 ffffffff
NOTICE:  UBI: Bad EC magic in block 14 ffffffff
NOTICE:  UBI: Bad EC magic in block 15 ffffffff
NOTICE:  UBI: Bad EC magic in block 16 ffffffff
NOTICE:  UBI: Bad EC magic in block 17 ffffffff
NOTICE:  UBI: Bad EC magic in block 21 ffffffff
NOTICE:  UBI: Bad EC magic in block 1019 424d5402
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: Bad VID magic in block 0 f35301a9
NOTICE:  UBI: Bad VID magic in block 1 e43f40f9
NOTICE:  UBI: Bad VID magic in block 2 21a02791
NOTICE:  UBI: Bad VID magic in block 3 00fc48d3
NOTICE:  UBI: Bad VID magic in block 4 e20315aa
NOTICE:  UBI: Bad VID magic in block 5 6fffff17
NOTICE:  UBI: Bad VID magic in block 6 6c782920
NOTICE:  UBI: Bad VID magic in block 7 00000000
NOTICE:  UBI: Bad VID magic in block 8 bc0ff04b
NOTICE:  UBI: Bad VID magic in block 9 f00ff40f
NOTICE:  UBI: Bad EC magic in block 10 22760200
NOTICE:  UBI: Bad EC magic in block 11 ffffffff
NOTICE:  UBI: Bad EC magic in block 12 ffffffff
NOTICE:  UBI: Bad EC magic in block 13 ffffffff
NOTICE:  UBI: Bad EC magic in block 14 ffffffff
NOTICE:  UBI: Bad EC magic in block 15 ffffffff
NOTICE:  UBI: Bad EC magic in block 16 ffffffff
NOTICE:  UBI: Bad EC magic in block 17 ffffffff
NOTICE:  UBI: Bad EC magic in block 21 ffffffff
NOTICE:  UBI: Bad EC magic in block 1019 424d5402
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   BL2: Failed to load image id 3 (-2)

Does it read like a flash hardware fail/defect ?

hnyman · May 23, 2025, 6:37am

You are using the wrong image.
You need the ubi version of the sysupgrade image.

http://downloads.openwrt.org/releases/24.10.1/targets/mediatek/mt7622/openwrt-24.10.1-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

Note the -ubi- in the name.

The non-ubi version is unusable unless you have kept away from @daniel tools and have otherwise modernised of bootchain to support the current flash driver with ECC support. There has been discussion during the years that it should be removed, but so far then has been no action to that direction. It is confusing, like you have now noticed...

diagpope · May 23, 2025, 4:06pm

Tried with luci

and it failed the same way of missing fip

ERROR:   UBI error: No volume named fip could be found
ERROR:   BL2: Failed to load image id 3 (-2)

2nd attempt, then I loaded via command

root@OpenWrt:~# sysupgrade -F http://downloads.openwrt.org/releases/24.10.1/targ
ets/mediatek/mt7622/openwrt-24.10.1-mediatek-mt7622-linksys_e8450-ubi-squashfs-s
ysupgrade.itb

result:

NOTICE:  UBI: Bad EC magic in block 1019 424d5402
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   BL2: Failed to load image id 3 (-2)

grauerfuchs · May 23, 2025, 7:33pm

Each time you load the wrong file, it corrupts your flash storage. These files expect different data layouts. When you install the wrong file, they try to establish their own layout. The new layout isn't supported by the boot chain, so the router can't boot.

Perform the hard recovery instructions again to get to 23.05.
Make sure you have put the working factory data in place. If you don't see your 5GHz radio, you have not done this correctly and you cannot move on to the next step until you fix it.
Load the UBI Installer version 1.1.4 to convert the data layout to 24.10.0.
Load the sysupgrade for the Linksys e8450-ubi for version 24.10.1.

diagpope · May 24, 2025, 7:52am

wget https://downloads.openwrt.org/releases/22.03.7/targets/mediatek/mt7622/openwrt-22.03.7-mediatek-mt7622-linksys_e8450-ubi-preloader.bin -O /srv/tftp/openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin

wget https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/mt7622/openwrt-23.05.4-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip -O /srv/tftp/openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip

wget https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/mt7622/openwrt-23.05.4-mediatek-mt7622-linksys_e8450-initramfs-kernel.bin -O /srv/tftp/openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb

wget https://github.com/grauerfuchs/owrt_device_support/raw/main/e8450_factory_emergency.bin -O /srv/tftp/factory.bin

Uboot, Option 0

run boot_tftp_write_bl2
run boot_tftp_write_fip

tftpboot 0x48000000 factory.bin

mw.b 0x4807FFFA 0x7a
mw.b 0x4807FFFB 0x8f
mw.b 0x4807FFFC 0x05
mw.b 0x4807FFFD 0xb4
mw.b 0x4807FFFE 0xa6
mw.b 0x4807FFFF 0xf6

mw.b 0x4807FFF4 0x7a
mw.b 0x4807FFF5 0x8f
mw.b 0x4807FFF6 0x05
mw.b 0x4807FFF7 0xb4
mw.b 0x4807FFF8 0xa6
mw.b 0x4807FFF9 0xf7

mw.b 0x48000004 0x7a
mw.b 0x48000005 0x8f
mw.b 0x48000006 0x05
mw.b 0x48000007 0xb4
mw.b 0x48000008 0xa6
mw.b 0x48000009 0xf8

mw.b 0x48005004 0x7a
mw.b 0x48005005 0x8f
mw.b 0x48005006 0x05
mw.b 0x48005007 0xb4
mw.b 0x48005008 0xa6
mw.b 0x48005009 0xf9

mtd erase factory && mtd write factory 0x48000000 0 0x80000

ubi detach; mtd erase ubi && ubi part ubi

run boot_tftp_recovery

upon restart, I see no 5 Ghz radio, so I must still have an error in the sequence I do not see

grauerfuchs · May 24, 2025, 10:52am

I see no error in what you posted. Therefore, the error must be in what you did not post. What does the router show when it boots to the U-Boot menu? What are the responses the router gives to each command?

Edit:
There is an error after all. The recovery image you selected was not the correct one. Please see my later post for the correct link to the file.

diagpope · May 24, 2025, 1:25pm

Thank you for hanging in there. I am posting the screen log of booting Uboot, the uboot commands and the final reboot into recovery ending with two manual commands I issued in the shell: ip a; ip r

)þNOTICE:  BL31: v2.9(release):OpenWrt v2023-07-24-00ac6db3-2 (mt7622-snand-1ddr)
NOTICE:  BL31: Built : 13:38:11, Nov 14 2023


U-Boot 2023.07.02-OpenWrt-r23630-842932a63d (Nov 14 2023 - 13:38:11 +0000)

CPU:   MediaTek MT7622
Model: mt7622-linksys-e8450-ubi
DRAM:  512 MiB
Core:  48 devices, 21 uclasses, devicetree: separate
MMC:   
Loading Environment from UBI... SPI-NAND: FM35Q1GA (128MB)
Read 126976 bytes from volume ubootenv to 000000005f7bf200
Read 126976 bytes from volume ubootenv2 to 000000005f7de240
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... UBI partition 'ubi' already selected
Read 126976 bytes from volume ubootenv to 000000005f7bf200
Read 126976 bytes from volume ubootenv2 to 000000005f7de240
OK
Net:   eth0: ethernet@1b100000
e7e[re[999;999He[6ne8No EFI system partition
No EFI system partition
Failed to persist EFI variables
e[?25le[2Je[1;1He[1;1He[2Ke[2;3H      e[0;34m( ( ( e[1;39mOpenWrte[0;34m ) ) )e[0m       e[33mU-Boot 2023.07.02-OpenWrt-r24012-d8dd03c46f (Jul 15 2024 - 22:14:18 +0000)e[0me[0Ke[3;1He[2Ke[16;1He[2Ke[17;3HPress UP/DOWN to move, ENTER to select, ESC to quite[0Ke[18;1He[2Ke[4;7He[7m1. Run default boot command.e[0me[5;7H2. Boot system via TFTP.e[6;7H3. Boot production system from flash.e[7;7H4. Boot recovery system from flash.e[8;7H5. Load production system via TFTP then write to flash.e[9;7H6. Load recovery system via TFTP then write to flash.e[10;7H7. e[31mLoad BL31+U-Boot FIP via TFTP then write to flash.e[0me[11;7H8. e[31mLoad BL2 preloader via TFTP then write to flash.e[0me[12;7H9. Reboot.e[13;7Ha. Reset all settings to factory defaults.e[14;7H0. U-Boot consolee[16;3HHit any key to stop autoboot: 3 e[16;1He[2Ke[1;1He[2Ke[2;3H      e[0;34m( ( ( e[1;39mOpenWrte[0;34m ) ) )e[0m       e[33mU-Boot 2023.07.02-OpenWrt-r24012-d8dd03c46f (Jul 15 2024 - 22:14:18 +0000)e[0me[0Ke[3;1He[2Ke[16;1He[2Ke[17;3HPress UP/DOWN to move, ENTER to select, ESC to quite[0Ke[18;1He[2Ke[4;7H1. Run default boot command.e[5;7H2. Boot system via TFTP.e[6;7H3. Boot production system from flash.e[7;7H4. Boot recovery system from flash.e[8;7H5. Load production system via TFTP then write to flash.e[9;7H6. Load recovery system via TFTP then write to flash.e[10;7H7. e[31mLoad BL31+U-Boot FIP via TFTP then write to flash.e[0me[11;7H8. e[31mLoad BL2 preloader via TFTP then write to flash.e[0me[12;7H9. Reboot.e[13;7Ha. Reset all settings to factory defaults.e[14;7He[7m0. U-Boot consolee[0me[?25he[2Je[1;1HMT7622> run boot_tftp_write_bl2
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin'.
Load address: 0x48000000
Loading: *#####
	 9.2 MiB/s
done
Bytes transferred = 67445 (10775 hex)
Erasing 0x00000000 ... 0x0007ffff (4 eraseblock(s))
Writing 131072 byte(s) (64 page(s)) at offset 0x00000000
Writing 131072 byte(s) (64 page(s)) at offset 0x00020000
Writing 131072 byte(s) (64 page(s)) at offset 0x00040000
Writing 131072 byte(s) (64 page(s)) at offset 0x00060000
MT7622> tftpboot 0x48000000 factory.bin
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'factory.bin'.
Load address: 0x48000000
Loading: *####################################
	 14.3 MiB/s
done
Bytes transferred = 524288 (80000 hex)
MT7622> mw.b 0x4807FFFA 0x7a
MT7622> mw.b 0x4807FFFB 0x8f
MT7622> mw.b 0x4807FFFC 0x05
MT7622> mw.b 0x4807FFFD 0xb4
MT7622> mw.b 0x4807FFFE 0xa6
MT7622> mw.b 0x4807F 0xf6
MT7622> mw.b 0x4807FFF4 0x7a
MT7622> mw.b 0x4807FFF5 0x8f
MT7622> mw.b 0x4807FFF6 0x05
MT7622> mw.b 0x4807FFF7 0xb4
MT7622> mw.b 0x4807FFF8 0xa6
MT7622> mw.b 0x48079 0xf7
MT7622> mw.b 0x48000004 0x7a
MT7622> mw.b 0x48000005 0x8f
MT7622> mw.b 0x48000006 0x05
MT7622> mw.b 0x48000007 0xb4
MT7622> mw.b 0x48000008 0xa6
MT7622> mw.b 0x48009 0xf8
MT7622> mw.b 0x48005004 0x7a
MT7622> mw.b 0x48005005 0x8f
MT7622> mw.b 0x48005006 0x05
MT7622> mw.b 0x48005007 0xb4
MT7622> mw.b 0x48005008 0xa6
MT7622> mw.b 0x48009 0xf9
MT7622> mtd erase factory && mtd write factory 0x48000000 0 0x80000
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
Writing 524288 byte(s) (256 page(s)) at offset 0x00000000
MT7622> ubi detach; mtd erase ubi && ubi part ubi
Erasing 0x00000000 ... 0x07cfffff (1000 eraseblock(s))
MT7622> run boot_tftp_recovery
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb'.
Load address: 0x48000000
Loading: *#################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #############################################################
	 12.3 MiB/s
done
Bytes transferred = 7566516 (7374b4 hex)

## Checking Image at 48000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-5.15.162
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x480000ec
     Data Size:    3768780 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8c2f95d1
     Hash algo:    sha1
     Hash value:   85d02e77cb1c9de9f87489c07d7b5bfd91cd43f1
    Image 1 (initrd-1)
     Description:  ARM64 OpenWrt linksys_e8450 initrd
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x483983f0
     Data Size:    3764256 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   54cb1f18
     Hash algo:    sha1
     Hash value:   e5a91128f51c0df39d98fffe5b6e74814817614c
    Image 2 (fdt-1)
     Description:  ARM64 OpenWrt linksys_e8450 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4872f51c
     Data Size:    31332 Bytes = 30.6 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   c8df3e06
     Hash algo:    sha1
     Hash value:   bef944e1910c1b148ad897f48957df7ab8bc33a7
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt linksys_e8450
     Kernel:       kernel-1
     Init Ramdisk: initrd-1
     FDT:          fdt-1
## Checking hash(es) for FIT Image at 48000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+ 
   Hash(es) for Image 1 (initrd-1): crc32+ sha1+ 
   Hash(es) for Image 2 (fdt-1): crc32+ sha1+ 
UBI partition 'ubi' already selected
Creating dynamic volume recovery of size 7566516
7566516 bytes written to volume recovery
## Loading kernel from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.162
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x480000ec
     Data Size:    3768780 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   8c2f95d1
     Hash algo:    sha1
     Hash value:   85d02e77cb1c9de9f87489c07d7b5bfd91cd43f1
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt linksys_e8450 initrd
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x483983f0
     Data Size:    3764256 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   54cb1f18
     Hash algo:    sha1
     Hash value:   e5a91128f51c0df39d98fffe5b6e74814817614c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_e8450 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4872f51c
     Data Size:    31332 Bytes = 30.6 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   c8df3e06
     Hash algo:    sha1
     Hash value:   bef944e1910c1b148ad897f48957df7ab8bc33a7
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4872f51c
Working FDT set to 4872f51c
   Uncompressing Kernel Image
   Loading Ramdisk to 5e450000, end 5e7e7020 ... OK
   Loading Device Tree to 000000005e445000, end 000000005e44fa63 ... OK
Working FDT set to 5e445000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.162 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24012-d8dd03c46f) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Jul 15 22:14:18 2024
[    0.000000] Machine model: Linksys E8450
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.4
[    0.000000] percpu: Embedded 18 pages/cpu s33112 r8192 d32424 u73728
[    0.000000] pcpu-alloc: s33112 r8192 d32424 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 498364K/524288K available (8384K kernel code, 904K rwdata, 1436K rodata, 448K init, 307K bss, 25924K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: 0xffffffc008010000
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000000] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.008246] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.018645] pid_max: default: 32768 minimum: 301
[    0.023556] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.030902] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.040041] rcu: Hierarchical SRCU implementation.
[    0.045328] smp: Bringing up secondary CPUs ...
[    0.050233] Detected VIPT I-cache on CPU1
[    0.050243] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x00000000bebc20, CPU1: 0x00000000000000
[    0.050263] CPU features: Unsupported CPU feature variation detected.
[    0.050293] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.050364] smp: Brought up 1 node, 2 CPUs
[    0.083290] SMP: Total of 2 processors activated.
[    0.088006] CPU features: detected: 32-bit EL0 Support
[    0.093162] CPU features: detected: CRC32 instructions
[    0.098344] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.106789] CPU: All CPU(s) started at EL2
[    0.110902] alternatives: patching kernel code
[    0.119903] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.129807] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.136765] pinctrl core: initialized pinctrl subsystem
[    0.142883] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.149157] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.156288] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.164077] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.172315] thermal_sys: Registered thermal governor 'fair_share'
[    0.172319] thermal_sys: Registered thermal governor 'bang_bang'
[    0.178431] thermal_sys: Registered thermal governor 'step_wise'
[    0.184462] thermal_sys: Registered thermal governor 'user_space'
[    0.190691] ASID allocator initialised with 65536 entries
[    0.202601] pstore: Registered ramoops as persistent store backend
[    0.208810] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.236824] cryptd: max_cpu_qlen set to 1000
[    0.243750] SCSI subsystem initialized
[    0.247704] libata version 3.00 loaded.
[    0.252770] clocksource: Switched to clocksource arch_sys_counter
[    0.259498] NET: Registered PF_INET protocol family
[    0.264539] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.272302] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.280734] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.288516] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.296323] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.303542] TCP: Hash tables configured (established 4096 bind 4096)
[    0.309997] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.316564] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.323709] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.329405] PCI: CLS 0 bytes, default 64
[    0.333635] Unpacking initramfs...
[    0.345454] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.355652] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.361520] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.404785] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.413697] mt7622-pinctrl 10211000.pinctrl: invalid group "pwm_ch7_2" for function "pwm"
[    0.426629] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    0.441267] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.449740] printk: console [ttyS0] disabled
[    0.474284] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 125, base_baud = 1562500) is a ST16650V2
[    0.483619] printk: console [ttyS0] enabled
[    0.483619] printk: console [ttyS0] enabled
[    0.491994] printk: bootconsole [uart8250] disabled
[    0.491994] printk: bootconsole [uart8250] disabled
[    0.522651] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 126, base_baud = 1562500) is a ST16650V2
[    0.532694] 1100c000.serial: ttyS2 at MMIO 0x1100c000 (irq = 130, base_baud = 17499995) is a MediaTek BTIF
[    0.542540] serial serial0: tty port ttyS2 registered
[    0.548940] mtk_rng 1020f000.rng: registered RNG driver
[    0.554642] random: crng init done
[    0.562167] loop: module loaded
[    0.565367] Loading iSCSI transport class v2.0-870.
[    0.571723] mtk-ecc 1100e000.ecc: probed
[    0.578934] spi-nand spi2.0: Fidelix SPI NAND was found.
[    0.584305] spi-nand spi2.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.592463] mtk-snand 1100d000.spi: ECC strength: 4 bits per 512 bytes
[    0.833879] [BBT] 80 available blocks in BMT pool
[    0.843475] [BBT] BMT.v2 is written into PBA:0x3ff
[    1.376866] Freeing initrd memory: 3676K
[    1.389860] 12 fixed-partitions partitions found on MTD device spi2.0
[    1.396356] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.402642] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.409221] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.415549] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.422009] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.428301] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    1.434742] Creating 12 MTD partitions on "spi2.0":
[    1.439621] 0x000000000000-0x000000080000 : "Preloader"
[    1.445893] 0x000000080000-0x0000000c0000 : "ATF"
[    1.451384] 0x0000000c0000-0x000000140000 : "u-boot"
[    1.457400] 0x000000140000-0x0000001c0000 : "u-boot-env"
[    1.464079] 0x0000001c0000-0x0000002c0000 : "factory"
[    1.470681] 0x000000300000-0x000000320000 : "devinfo"
[    1.476302] 0x000000320000-0x000000340000 : "senv"
[    1.481747] 0x000000360000-0x000000380000 : "bootseq"
[    1.487373] 0x000000500000-0x000002300000 : "firmware1"
[    1.524314] 0x000002300000-0x000004100000 : "firmware2"
[    1.560610] 0x000004100000-0x000005a00000 : "data"
[    1.591398] 0x000005a00000-0x000006e00000 : "mfg"
[    1.746801] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc008ee0000, irq 141
[    1.756712] i2c_dev: i2c /dev entries driver
[    1.762304] mtk-wdt 10212000.watchdog: IRQ index 0 not found
[    1.768171] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.778280] NET: Registered PF_INET6 protocol family
[    1.784399] Segment Routing with IPv6
[    1.788077] In-situ OAM (IOAM) with IPv6
[    1.792036] NET: Registered PF_PACKET protocol family
[    1.797157] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.810295] 8021q: 802.1Q VLAN Support v1.8
[    1.815703] pstore: Using crash dump compression: deflate
[    1.830991] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    1.837583] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    1.843435] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    1.989169] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    1.995382] pci_bus 0000:00: root bus resource [bus 00-ff]
[    2.000870] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    2.007753] pci_bus 0000:00: scanning bus
[    2.011971] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    2.018163] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    2.028171] pci_bus 0000:00: fixups for bus
[    2.032378] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    2.039092] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.047172] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    2.054302] pci_bus 0000:01: scanning bus
[    2.058527] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    2.064724] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    2.072052] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    2.079383] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    2.087359] pci 0000:01:00.0: supports D1 D2
[    2.091624] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    2.098264] pci 0000:01:00.0: PME# disabled
[    2.102772] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.146240] pci_bus 0000:01: fixups for bus
[    2.150452] pci_bus 0000:01: bus scan returning with max=01
[    2.156064] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    2.162703] pci_bus 0000:00: bus scan returning with max=01
[    2.168297] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    2.175953] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    2.183961] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    2.190746] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    2.198575] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    2.206403] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    2.214228] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.219190] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    2.226113] pcieport 0000:00:00.0: assign IRQ: got 146
[    2.231257] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    2.237371] pcieport 0000:00:00.0: enabling bus mastering
[    2.242817] mtk-pcie 1a143000.pcie: msi#0 address_hi 0x0 address_lo 0x44d150c0
[    2.250218] pcieport 0000:00:00.0: PME: Signaling with IRQ 146
[    2.256153] pcieport 0000:00:00.0: saving config space at offset 0x0 (reading 0x325814c3)
[    2.264348] pcieport 0000:00:00.0: saving config space at offset 0x4 (reading 0x100006)
[    2.272350] pcieport 0000:00:00.0: saving config space at offset 0x8 (reading 0x6040000)
[    2.280440] pcieport 0000:00:00.0: saving config space at offset 0xc (reading 0x10000)
[    2.288360] pcieport 0000:00:00.0: saving config space at offset 0x10 (reading 0xc)
[    2.296015] pcieport 0000:00:00.0: saving config space at offset 0x14 (reading 0x0)
[    2.303669] pcieport 0000:00:00.0: saving config space at offset 0x18 (reading 0x40010100)
[    2.311926] pcieport 0000:00:00.0: saving config space at offset 0x1c (reading 0x4200000)
[    2.320100] pcieport 0000:00:00.0: saving config space at offset 0x20 (reading 0x20102000)
[    2.328365] pcieport 0000:00:00.0: saving config space at offset 0x24 (reading 0x0)
[    2.336019] pcieport 0000:00:00.0: saving config space at offset 0x28 (reading 0x0)
[    2.343673] pcieport 0000:00:00.0: saving config space at offset 0x2c (reading 0x0)
[    2.351322] pcieport 0000:00:00.0: saving config space at offset 0x30 (reading 0x0)
[    2.358975] pcieport 0000:00:00.0: saving config space at offset 0x34 (reading 0x50)
[    2.366715] pcieport 0000:00:00.0: saving config space at offset 0x38 (reading 0x0)
[    2.374368] pcieport 0000:00:00.0: saving config space at offset 0x3c (reading 0x20192)
[    2.382952] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    2.389504] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    2.395345] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    2.622831] mtk-pcie 1a145000.pcie: Port1 link down
[    2.627913] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    2.634119] pci_bus 0001:00: root bus resource [bus 00-ff]
[    2.639608] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    2.646490] pci_bus 0001:00: scanning bus
[    2.652268] pci_bus 0001:00: fixups for bus
[    2.656458] pci_bus 0001:00: bus scan returning with max=00
[    2.662640] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    2.742968] mt7530-mdio mdio-bus:00: configuring for fixed/2500base-x link mode
[    2.752206] mt7530-mdio mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.761225] mt7530-mdio mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=147)
[    2.781788] mt7530-mdio mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=148)
[    2.802154] mt7530-mdio mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=149)
[    2.822490] mt7530-mdio mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=150)
[    2.843087] mt7530-mdio mdio-bus:00 wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=151)
[    2.854569] DSA: tree 0 setup
[    2.858295] UBI: auto-attach mtd10
[    2.861716] ubi0: default fastmap pool size: 10
[    2.866255] ubi0: default fastmap WL pool size: 5
[    2.870955] ubi0: attaching mtd10
[    2.931677] ubi0: scanning is finished
[    2.935467] ubi0 error: 0xffffffc0085622bc: the layout volume was not found
[    2.942476] ubi0 error: 0xffffffc008565f28: failed to attach mtd10, error -22
[    2.950210] UBI error: cannot attach mtd10
[    2.954725] clk: Disabling unused clocks
[    2.959698] Freeing unused kernel memory: 448K
[    2.964209] Run /init as init process
[    2.967862]   with arguments:
[    2.970819]     /init
[    2.973088]   with environment:
[    2.976218]     HOME=/
[    2.978568]     TERM=linux
[    3.164463] init: Console is alive
[    3.167993] init: - watchdog -
[    3.174788] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.187061] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.204659] init: - preinit -
[    3.268974] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.277606] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.284705] mt7530-mdio mdio-bus:00 lan1: configuring for phy/gmii link mode
[    3.293876] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.367714] procd: - early -
[    5.370694] procd: - watchdog -
[    5.905708] procd: - watchdog -
[    5.909234] procd: - ubus -
[    5.965386] procd: - init -
Please press Enter to activate this console.
[    6.148543] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.157626] Loading modules backported from Linux version v6.1.97-0-g7753af06eebfb
[    6.165241] Backport generated by backports.git v6.1.97-1-0-g2431d56e
[    6.214854] mt7622-wmac 18000000.wmac: registering led 'mt76-phy0'
[    6.221574] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    6.253172] mt7622-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20190801210006a
[    6.253172] 
[    6.268878] PPP generic driver version 2.4.2
[    6.275674] mt7622-wmac 18000000.wmac: N9 Firmware Version: _reserved_, Build Time: 20220630094834
[    6.284874] NET: Registered PF_PPPOX protocol family
[    6.299088] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.422972] urngd: v1.0.2 started.
[   10.316840] mtk_soc_eth 1b100000.ethernet eth0: Link is Down
[   10.334742] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   10.344510] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   10.349056] mt7530-mdio mdio-bus:00 lan1: configuring for phy/gmii link mode
[   10.363910] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.373224] br-lan: port 1(lan1) entered blocking state
[   10.378481] br-lan: port 1(lan1) entered disabled state
[   10.385892] device lan1 entered promiscuous mode
[   10.390528] device eth0 entered promiscuous mode
[   10.410504] mt7530-mdio mdio-bus:00 lan2: configuring for phy/gmii link mode
[   10.427713] br-lan: port 2(lan2) entered blocking state
[   10.433002] br-lan: port 2(lan2) entered disabled state
[   10.442316] device lan2 entered promiscuous mode
[   10.461034] mt7530-mdio mdio-bus:00 lan3: configuring for phy/gmii link mode
[   10.472176] br-lan: port 3(lan3) entered blocking state
[   10.477478] br-lan: port 3(lan3) entered disabled state
[   10.489611] device lan3 entered promiscuous mode
[   10.508683] mt7530-mdio mdio-bus:00 lan4: configuring for phy/gmii link mode
[   10.519628] br-lan: port 4(lan4) entered blocking state
[   10.524973] br-lan: port 4(lan4) entered disabled state
[   10.533498] device lan4 entered promiscuous mode
[   10.550233] mt7530-mdio mdio-bus:00 wan: configuring for phy/gmii link mode
[   13.468691] mt7530-mdio mdio-bus:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   13.476721] br-lan: port 1(lan1) entered blocking state
[   13.481959] br-lan: port 1(lan1) entered forwarding state
[   13.489216] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   14.061328] mt7530-mdio mdio-bus:00 wan: Link is Up - 1Gbps/Full - flow control rx/tx
[   14.069268] IPv6: ADDRCONF(NETDEV_CHANGE): wan: link becomes ready



BusyBox v1.36.1 (2024-07-15 22:14:18 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.4, r24012-d8dd03c46f
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

Cutting the rest into a 2nd post, could use pastebin....

diagpope · May 24, 2025, 1:26pm

Here the rest (likely irrelevant)

root@OpenWrt:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 qdisc mq state UP qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::788f:5ff:feb4:a600/64 scope link 
       valid_lft forever preferred_lft forever
3: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
4: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
5: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
6: lan4@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
7: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
    inet 192.168.226.234/24 brd 192.168.226.255 scope global wan
       valid_lft forever preferred_lft forever
    inet6 fd10:6d47:c4fc:0:788f:5ff:feb4:a600/64 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fd10:6d47:c4fc::53d/128 scope global dynamic noprefixroute 
       valid_lft 43188sec preferred_lft 43188sec
    inet6 fe80::788f:5ff:feb4:a600/64 scope link 
       valid_lft forever preferred_lft forever
8: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
9: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 7a:8f:05:b4:a6:00 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd10:6d47:c4fc:8::1/62 scope global dynamic noprefixroute 
       valid_lft 43188sec preferred_lft 43188sec
    inet6 fd4e:f6b1:5dcd::1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::788f:5ff:feb4:a600/64 scope link 
       valid_lft forever preferred_lft forever
root@OpenWrt:/# ip r
default via 192.168.226.15 dev wan  src 192.168.226.234 
192.168.1.0/24 dev br-lan scope link  src 192.168.1.1 
192.168.226.0/24 dev wan scope link  src 192.168.226.234 
root@OpenWrt:/#

grauerfuchs · May 24, 2025, 1:46pm

The boot log shows what I did not see, but it was listed in your previous post. This was my mistake. The recovery file you loaded is not the correct file.

The recovery file you need is
https://downloads.openwrt.org/releases/23.05.5/targets/mediatek/mt7622/openwrt-23.05.5-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb

Please note the inclusion of the text -ubi-. All of the files you need for your router that you download from the OpenWRT site must include this text. If the file does not include this text, it is the wrong file.

The file you loaded has once again corrupted some contents in the flash, so you will need to load the correct recovery file in place

wget https://downloads.openwrt.org/releases/23.05.5/targets/mediatek/mt7622/openwrt-23.05.5-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb -O /srv/tftp/openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb

and then once again perform the steps

run boot_tftp_write_fip
ubi detach; mtd erase ubi && ubi part ubi
run boot_tftp_recovery

Edit: I have once more updated the "Hard Recovery" post to include the complete and correct links to the files needed.

diagpope · May 25, 2025, 12:13am

I ran again , changed all references from 23.05.4 to 23.05.5 and the sysupgrade to ubi

Still ends up again in recovery
What sticks out to me:

Loading Environment from UBI... SPI-NAND: FM35Q1GA (128MB)

Volume ubootenv not found!

** Unable to read env from ubi:ubootenv **

Volume ubootenv2 not found!

** Unable to read redundant env from ubi:ubootenv2 **

*** Error - No Valid Environment Area found

*** Warning - bad env area, using default environment

And:
Error: ethernet@1b100000 address not set.

Error: ethernet@1b100000 address not set.

grauerfuchs · May 25, 2025, 12:50am

This actually looks good, but you've found another bug that has recently been causing trouble for multiple users. I'll go through what you're seeing piece by piece so you know what's happening.

Volume ubootenv not found!
** Unable to read env from ubi:ubootenv **
Volume ubootenv2 not found!
** Unable to read redundant env from ubi:ubootenv2 **
*** Error - No Valid Environment Area found
*** Warning - bad env area, using default environment

These errors happen during the first real boot from the onboard boot chain after the flash has been recovered. Because we didn't manually create the ubootenv or ubootenv2 UBI volumes, U-Boot is complaining about not finding them. Even if we do manually create the volumes, U-Boot will complain on the first boot about the volumes not being valid. This is self-recovering as long as the data layout is set properly, and the steps we have taken on your router ensure that it is set properly. Although this has not caused any real problems on your router, I have added manual creation of the volumes to the recovery post because it simplifies the matter and ensures the space is allocated before there is any chance of something else taking the space.

The warning Error: ethernet@1b100000 address not set. happens during that boot for the same reason. The MAC address used by U-Boot is stored within the U-Boot environment volumes, but they didn't yet exist and so the router couldn't access the data. The built-in scripts set this value from the data in the factory volume once the environment volume is available. The only time this error is a problem is during the actual recovery, because the scripts that set the data cannot run and so TFTP won't work until the value is set.

Now, here's the problem that is really preventing you from booting properly:
With all this having been completed, there is either data present in the ramoops section of memory, or the series of reboots needed to configure the device have triggered it to think there was an event that requires recovery. Therefore, the router boots into recovery rather than booting into the newly installed production firmware.

The solution: Disconnect the power from the router and wait 30 seconds. You may also need to disconnect the serial console cable, because it may be providing enough power to keep the bad data in memory. When you finally reconnect power, let the router boot on its own. It should now boot into the freshly loaded full firmware.

diagpope · May 25, 2025, 4:57am

Thank you for the detailed information. I have set up the router elsewhere with remote access and have toggled power remotely for all these attempts. Unfortunate curveball:
I can not disconnect the USB /serial connector until I have physical access, this will likely be next Tuesday. I will try to power down for a minute and see if that works now ... no.
With the USB adapter connected to the serial port, it still boots into recovery mode.
Will wait until Tuesday and post again.

Thank you already!

grauerfuchs · May 25, 2025, 12:14pm

Yes, that would make things a little more difficult. There is one more possibility, however. If you log into the router by ssh, check to see if there are any files in /sys/fs/pstore. That is where the ramoops files are stored. You can look them over if you wish, otherwise delete them. Once the files in that folder have been removed, reboot the router. If it boots back into recovery, try to install the sysupgrade one more time.

diagpope · May 25, 2025, 1:56pm

I have looked for theses files not consistently but when I did, i found none.