Recover Belkin RT3200

diagpope · May 27, 2025, 2:59pm

At first, we have success!

After the last steps of recovery using 23.05 and my own ethernet MACS, I had to add the following additional steps

Disconnect USB connection to the serial port
Power off the device
Wait a minute and restart
Note: The device started back into recovery mode
Checked for oops files via:

root@OpenWrt:~# find /sys/fs/pstore/
/sys/fs/pstore/

=> none found:

flash sysupgrade again with
https://downloads.openwrt.org/releases/23.05.5/targets/mediatek/mt7622/openwrt-23.05.5-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb
after restart, the device shows a running system

and both wifi network devices

As you went with me through my agonizing troubles, what favor may I provide to you @grauerfuchs ?

grauerfuchs · May 27, 2025, 3:13pm

Perfect! I knew we'd get there eventually.

...Now, the big question is, do you intend to upgrade to 24.10? If so, don't forget to use the UBI installer 1.1.4 to do so. After using the installer, make sure you use the matching 24.10 UBI sysupgrade file.

diagpope · May 27, 2025, 3:48pm

I have the intention to upgrade to 24.10 but it gives me another headache:
I need one of the initramfs from dangowrt, to flash first. I recall that my other Belkin/Linksys routers all required a force update which "literally shows a red flag" , I failed to write down my own steps and regret it.

Unfortunately, all three choices show the "image check failed" uploan upload, so I stopped applying any.

openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb
openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer_signed.itb
openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb

This is definitively not to flash now:

openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

el_charlie · May 27, 2025, 3:55pm

If you're on 23.05 with EVERYTHING working fine, the procedure to upgrade to 24.10 is as stated on the Wiki:

Flash the Unsigned 1.1.4 installer (openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb). Luci will complain. You have to force the upgrade and uncheck to keep settings.
The router should reboot in a 24.10 recovery environment. There you can go to Flash the 24.10 sysupgrade image. Again, do not keep settings. Please note that the sysupgrade image has to have -ubi on the filename.
The router will reboot on 24.10 and you'll be fine.

From 24.10 onwards, you only need to use the regular -ubi sysupgrade image.

grauerfuchs · May 27, 2025, 4:16pm

The installer is going to show a flag because it is not a normal image. This is expected, but it is good to be concerned and to make sure. Because you are running the UBI version of OpenWRT 23.05 The files you need are:

Installer (v. 1.1.4):
https://github.com/dangowrt/owrt-ubi-installer/releases/download/v1.1.4/openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb

Sysupgrade file to flash after the installer has completed:
https://github.com/dangowrt/owrt-ubi-installer/releases/download/v1.1.4/openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb
or
https://downloads.openwrt.org/releases/24.10.1/targets/mediatek/mt7622/openwrt-24.10.1-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

The first sysupgrade link is the one that matches and was produced with the UBI installer, and it is OpenWRT 24.10.0. The second is the official sysupgrade file for OpenWRT 24.10.1, and it is fully compatible with the UBI installer v. 1.1.4.
As stated in the above post by el_charlie, do not keep settings when flashing the installer or when flashing the sysupgrade used after the installer.

diagpope · May 28, 2025, 12:20am

Thank you, I found that the standard instructions are not applicable in my case while the serial port is connected!

I flashed openwrt-24.10.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb from dangowrt got
Upon reboot, I see the 23.05.5. recovery booted

image2756×1522 305 KB

AND I see

root@OpenWrt:~# find /sys/fs/pstore/
/sys/fs/pstore/
/sys/fs/pstore/dmesg-ramoops-0

which contains

root@OpenWrt:~# cat /sys/fs/pstore/dmesg-ramoops-0
Panic#1 Part1
<7>[    2.093829] pci_bus 0000:00: scanning bus
<6>[    2.098022] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
<6>[    2.104214] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
<7>[    2.114551] pci_bus 0000:00: fixups for bus
<7>[    2.118781] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
<6>[    2.125481] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
<7>[    2.133559] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
<7>[    2.140697] pci_bus 0000:01: scanning bus
<6>[    2.144863] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
<6>[    2.151057] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
<6>[    2.158384] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
<6>[    2.165714] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
<6>[    2.173697] pci 0000:01:00.0: supports D1 D2
<6>[    2.177961] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
<7>[    2.184600] pci 0000:01:00.0: PME# disabled
<6>[    2.189130] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
<7>[    2.228917] pci_bus 0000:01: fixups for bus
<7>[    2.233123] pci_bus 0000:01: bus scan returning with max=01
<6>[    2.238724] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
<7>[    2.245352] pci_bus 0000:00: bus scan returning with max=01
<6>[    2.250959] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
<6>[    2.258621] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
<6>[    2.266643] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
<6>[    2.273452] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
<6>[    2.281299] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
<6>[    2.289151] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
<6>[    2.296986] pci 0000:00:00.0: PCI bridge to [bus 01]
<6>[    2.301969] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
<6>[    2.308779] pci_bus 0000:00: Some PCI device resources are unassigned, try booting with pci=realloc
<6>[    2.317822] pci_bus 0000:00: resource 4 [mem 0x20000000-0x27ffffff]
<6>[    2.324102] pci_bus 0000:01: resource 1 [mem 0x20000000-0x201fffff]
<7>[    2.330596] pcieport 0000:00:00.0: assign IRQ: got 130
<6>[    2.335748] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
<7>[    2.341881] pcieport 0000:00:00.0: enabling bus mastering
<7>[    2.347385] mtk-pcie 1a143000.pcie: msi#0 address_hi 0x0 address_lo 0x44e7d0c0
<6>[    2.354925] pcieport 0000:00:00.0: PME: Signaling with IRQ 130
<7>[    2.360955] pcieport 0000:00:00.0: save config 0x00: 0x325814c3
<7>[    2.366892] pcieport 0000:00:00.0: save config 0x04: 0x00100006
<7>[    2.372836] pcieport 0000:00:00.0: save config 0x08: 0x06040000
<7>[    2.378772] pcieport 0000:00:00.0: save config 0x0c: 0x00010000
<7>[    2.384694] pcieport 0000:00:00.0: save config 0x10: 0x0000000c
<7>[    2.390625] pcieport 0000:00:00.0: save config 0x14: 0x00000000
<7>[    2.396547] pcieport 0000:00:00.0: save config 0x18: 0x40010100
<7>[    2.402479] pcieport 0000:00:00.0: save config 0x1c: 0x04200000
<7>[    2.408402] pcieport 0000:00:00.0: save config 0x20: 0x20102000
<7>[    2.414341] pcieport 0000:00:00.0: save config 0x24: 0x00000000
<7>[    2.420273] pcieport 0000:00:00.0: save config 0x28: 0x00000000
<7>[    2.426196] pcieport 0000:00:00.0: save config 0x2c: 0x00000000
<7>[    2.432127] pcieport 0000:00:00.0: save config 0x30: 0x00000000
<7>[    2.438049] pcieport 0000:00:00.0: save config 0x34: 0x00000050
<7>[    2.443980] pcieport 0000:00:00.0: save config 0x38: 0x00000000
<7>[    2.449911] pcieport 0000:00:00.0: save config 0x3c: 0x00020182
<6>[    2.456813] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
<7>[    2.463417] mtk-pcie 1a145000.pcie: Parsing ranges property...
<6>[    2.469287] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
<6>[    2.808707] mtk-pcie 1a145000.pcie: Port1 link down
<6>[    2.813814] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
<6>[    2.820020] pci_bus 0001:00: root bus resource [bus 00-ff]
<6>[    2.825510] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
<7>[    2.832387] pci_bus 0001:00: scanning bus
<7>[    2.837887] pci_bus 0001:00: fixups for bus
<7>[    2.842074] pci_bus 0001:00: bus scan returning with max=00
<6>[    2.847645] pci_bus 0001:00: resource 4 [mem 0x28000000-0x2fffffff]
<6>[    2.854884] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
<6>[    3.120987] clk: Disabling unused clocks
<6>[    3.126135] Freeing unused kernel memory: 448K
<6>[    3.130681] Run /init as init process
<7>[    3.134337]   with arguments:
<7>[    3.137296]     /init
<7>[    3.139574]   with environment:
<7>[    3.142706]     HOME=/
<7>[    3.145058]     TERM=linux
<14>[    3.340304] init: Console is alive
<14>[    3.343839] init: - watchdog -
<14>[    3.351792] kmodloader: loading kernel modules from /etc/modules-boot.d/*
<6>[    3.365386] usbcore: registered new interface driver usbfs
<6>[    3.371014] usbcore: registered new interface driver hub
<6>[    3.376399] usbcore: registered new device driver usb
<4>[    3.382661] gpio_button_hotplug: loading out-of-tree module taints kernel.
<6>[    3.395378] xhci-mtk 1a0c0000.usb: xHCI Host Controller
<6>[    3.400691] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
<6>[    3.409751] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000200010
<6>[    3.418912] xhci-mtk 1a0c0000.usb: irq 133, io mem 0x1a0c0000
<6>[    3.424754] xhci-mtk 1a0c0000.usb: xHCI Host Controller
<6>[    3.430006] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
<6>[    3.437408] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
<6>[    3.444190] hub 1-0:1.0: USB hub found
<6>[    3.447990] hub 1-0:1.0: 2 ports detected
<6>[    3.452646] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
<6>[    3.461305] hub 2-0:1.0: USB hub found
<6>[    3.465125] hub 2-0:1.0: 1 port detected
<14>[    3.474279] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
<14>[    3.491898] init: - preinit -
<15>[    4.964650] INSTALLER: cannot find MAC addresses
<6>[    4.970723] sysrq: Trigger a crash
<0>[    4.975307] Kernel panic - not syncing: sysrq triggered crash
<2>[    4.982427] SMP: stopping secondary CPUs
<0>[    4.987732] Kernel Offset: disabled
<0>[    4.991288] CPU features: 0x0,00000004,00000000,0000400b
<0>[    4.996593] Memory Limit: none

I will try again tomorrow with disconnected serial port, starting from 23.05.5 sys.

grauerfuchs · May 28, 2025, 8:04am

The installer script is returning an error, complaining about not being able to find the MAC addresses. This suggests there is something odd going on here. You may want to wait on upgrading until we can find out why it can't see what was supposed to have been written. The commands you posted here look correct, so I'm wondering what might have happened to the data when it was written to the device.

diagpope · May 28, 2025, 11:30am

I missed the large message "No MAC address found"

Is it safe to try the recovery method with 24.10.1 instead by avoiding mistakes you helped me fix using 23.05?

I reread setting the MACs and compared with the result and they do not match.
These are the MACS I intented to write

mw.b 0x4807FFFA 0x7a
mw.b 0x4807FFFB 0x8f
mw.b 0x4807FFFC 0x05
mw.b 0x4807FFFD 0xb4
mw.b 0x4807FFFE 0xa6
mw.b 0x4807FFFF 0xf6

mw.b 0x4807FFF4 0x7a
mw.b 0x4807FFF5 0x8f
mw.b 0x4807FFF6 0x05
mw.b 0x4807FFF7 0xb4
mw.b 0x4807FFF8 0xa6
mw.b 0x4807FFF9 0xf7

mw.b 0x48000004 0x7a
mw.b 0x48000005 0x8f
mw.b 0x48000006 0x05
mw.b 0x48000007 0xb4
mw.b 0x48000008 0xa6
mw.b 0x48000009 0xf8

mw.b 0x48005004 0x7a
mw.b 0x48005005 0x8f
mw.b 0x48005006 0x05
mw.b 0x48005007 0xb4
mw.b 0x48005008 0xa6
mw.b 0x48005009 0xf9

I do not see any of these in the output

root@OpenWrt:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1504 qdisc mq state UP qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::ac2c:81ff:fe93:c439/64 scope link
       valid_lft forever preferred_lft forever
3: lan1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
4: lan2@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
5: lan3@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
6: lan4@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
7: wan@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
    inet 192.168.226.177/24 brd 192.168.226.255 scope global wan
       valid_lft forever preferred_lft forever
    inet6 fd10:6d47:c4fc:0:ac2c:81ff:fe93:c439/64 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fd10:6d47:c4fc::461/128 scope global dynamic noprefixroute
       valid_lft 43198sec preferred_lft 43198sec
    inet6 fe80::ac2c:81ff:fe93:c439/64 scope link
       valid_lft forever preferred_lft forever
8: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether d2:3a:53:39:96:6e brd ff:ff:ff:ff:ff:ff
9: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether ae:2c:81:93:c4:39 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd4e:5880:7212::1/60 scope global noprefixroute
       valid_lft forever preferred_lft forever
    inet6 fe80::ac2c:81ff:fe93:c439/64 scope link
       valid_lft forever preferred_lft forever

So they have either not been written correctly of not being read properly.

Is the starting MAC ae:2c:81:93:c4:39 the default from

https://github.com/grauerfuchs/owrt_device_support/raw/main/e8450_factory_emergency.bin

?

grauerfuchs · May 28, 2025, 11:32pm

I wouldn't recommend it until we find out what went wrong. Although it might work, it also might not. It will make further troubleshooting a little more difficult, however. Also, that process is not well tested, whereas the process for recovering to 23.05 has been mostly stable, has been used to recover many devices, and it has been refined even more to reduce the risk of certain edge cases.

No. The surrogate file does not contain any MAC addresses. Instead, it lets OpenWRT generate random addresses on each boot.

Let's start with taking a look to see if the chip has any bad blocks. Would you please post the results of the command mtd bad spi-nand0? This will let us know if the trouble may have been caused by bad blocks in a problematic spot.

If there are no bad blocks listed between 0x1c0000 and 0x2c0000, we can also run the commands

mtd dump.raw spi-nand0 0x1c0000
mtd dump.raw spi-nand0 0x1c5000
mtd dump.raw spi-nand0 0x23f800

and that will read back the raw pages that should be within the regions of the factory partition containing the EEPROMs and the MAC addresses. We can compare this with the source file to see if there is something obvious or telling going on there.

Edit: Fixed typo on the offset for the third page read command.

diagpope · May 29, 2025, 1:12am

I do not see the option 'bad' or 'dump.raw' for mtd on 23.05.5. Not even a read option?

root@OpenWrt:~# mtd bad spi-nand0
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...]

The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
        unlock                  unlock the device
        refresh                 refresh mtd partition
        erase                   erase all data on device
        verify <imagefile>|-    verify <imagefile> (use - for stdin) to device
        write <imagefile>|-     write <imagefile> (use - for stdin) to device
        jffs2write <file>       append <file> to the jffs2 partition on the device
        fixtrx                  fix the checksum in a trx header on first boot
Following options are available:
        -q                      quiet mode (once: no [w] on writing,
                                           twice: no status messages)
        -n                      write without first erasing the blocks
        -r                      reboot after successful command
        -f                      force write without trx checks
        -e <device>             erase <device> before executing the command
        -d <name>               directory for jffs2write, defaults to "tmp"
        -j <name>               integrate <file> into jffs2 data when writing an image
        -s <number>             skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
        -p <number>             write beginning at partition offset
        -l <length>             the length of data that we want to dump
        -M <magic>              magic number of the image header in the partition (for fixtrx)
        -o offset               offset of the image header in the partition(for fixtrx)
        -c datasize             amount of data to be used for checksum calculation (for fixtrx / fixseama / fixwrg / fixwrgg)

Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
         mtd -r write linux.trx linux

same help output is emitted when trying

mtd dump.raw spi-nand0 0x1c0000

grauerfuchs · May 29, 2025, 5:49am

Sorry, I was unclear. Those commands were intended for use within the U-Boot console, not from within OpenWRT.

diagpope · May 29, 2025, 1:41pm

Here is the requested output from uboot:

MT7622> mtd bad spi-nand0
MTD device spi-nand0 bad blocks list:
MT7622>

Output from three dump.raw commands

Again, the question: Why is there no ethernet address?

Error: ethernet@1b100000 address not set.
No ethernet found.

What does cannot reserve enough PEBs for bad PEB mean?
The 3rd commandcomplains: Offset not aligned with a page (0x800)

ÿNOTICE:  BL31: v2.9(release):OpenWrt v2023-07-24-00ac6db3-2 (mt7622-snand-1ddr)
NOTICE:  BL31: Built : 13:38:11, Nov 14 2023


U-Boot 2023.07.02-OpenWrt-r23630-842932a63d (Nov 14 2023 - 13:38:11 +0000)

CPU:   MediaTek MT7622
Model: mt7622-linksys-e8450-ubi
DRAM:  512 MiB
Core:  48 devices, 21 uclasses, devicetree: separate
MMC:   
Loading Environment from UBI... SPI-NAND: FM35Q1GA (128MB)
ubi0 warning: print_rsvd_warning: cannot reserve enough PEBs for bad PEB handling, reserved 18, need 20
Read 126976 bytes from volume ubootenv to 000000005f7bf200
Read 126976 bytes from volume ubootenv2 to 000000005f7de240
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... UBI partition 'ubi' already selected
Read 126976 bytes from volume ubootenv to 000000005f7bf200
Read 126976 bytes from volume ubootenv2 to 000000005f7de240
OK
Net:   
Error: ethernet@1b100000 address not set.
No ethernet found.

e7e[re[999;999He[6ne8No EFI system partition
No EFI system partition
Failed to persist EFI variables

Error: ethernet@1b100000 address not set.

Error: ethernet@1b100000 address not set.
e[?25le[2Je[1;1He[1;1He[2Ke[2;3H      e[0;34m( ( ( e[1;39mOpenWrte[0;34m ) ) )e[0m       e[33mU-Boot 2024.10-OpenWrt-r28597-0425664679 (Apr 13 2025 - 16:38:32 +0000)e[0me[0Ke[3;1He[2Ke[16;1He[2Ke[17;3HPress UP/DOWN to move, ENTER to select, ESC to quite[0Ke[18;1He[2Ke[4;7He[7m1. Run default boot command.e[0me[5;7H2. Boot system via TFTP.e[6;7H3. Boot production system from flash.e[7;7H4. Boot recovery system from flash.e[8;7H5. Load production system via TFTP then write to flash.e[9;7H6. Load recovery system via TFTP then write to flash.e[10;7H7. e[31mLoad BL31+U-Boot FIP via TFTP then write to flash.e[0me[11;7H8. e[31mLoad BL2 preloader via TFTP then write to flash.e[0me[12;7H9. Reboot.e[13;7Ha. Reset all settings to factory defaults.e[14;7H0. U-Boot consolee[16;3HHit any key to stop autoboot: 3 e[16;1He[2Ke[1;1He[2Ke[2;3H      e[0;34m( ( ( e[1;39mOpenWrte[0;34m ) ) )e[0m       e[33mU-Boot 2024.10-OpenWrt-r28597-0425664679 (Apr 13 2025 - 16:38:32 +0000)e[0me[0Ke[3;1He[2Ke[16;1He[2Ke[17;3HPress UP/DOWN to move, ENTER to select, ESC to quite[0Ke[18;1He[2Ke[4;7H1. Run default boot command.e[5;7H2. Boot system via TFTP.e[6;7H3. Boot production system from flash.e[7;7H4. Boot recovery system from flash.e[8;7H5. Load production system via TFTP then write to flash.e[9;7H6. Load recovery system via TFTP then write to flash.e[10;7H7. e[31mLoad BL31+U-Boot FIP via TFTP then write to flash.e[0me[11;7H8. e[31mLoad BL2 preloader via TFTP then write to flash.e[0me[12;7H9. Reboot.e[13;7Ha. Reset all settings to factory defaults.e[14;7He[7m0. U-Boot consolee[0me[?25he[2Je[1;1H


MT7622> mtd dump.raw spi-nand0 0x1c0000
Reading 2048 byte(s) (1 page(s)) at offset 0x001c0000 [raw]

Dump 2048 data bytes from 0x001c0000:
0x001c0000:	55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 02 
0x001c0010:	00 00 08 00 00 00 10 00  60 0f 67 56 00 00 00 00 
0x001c0020:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0030:	00 00 00 00 00 00 00 00  00 00 00 00 3f 9a 27 a3 
0x001c0040:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0050:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0060:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0070:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0080:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0090:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c00f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0100:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0110:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0120:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0130:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0140:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0150:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0160:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0170:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0180:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0190:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c01f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0200:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0210:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0220:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0230:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0240:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0250:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0260:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0270:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0280:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0290:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c02f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0300:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0310:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0320:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0330:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0340:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0350:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0360:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0370:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0380:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0390:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c03f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0400:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0410:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0420:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0430:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0440:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0450:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0460:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0470:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0480:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0490:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c04f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0500:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0510:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0520:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0530:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0540:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0550:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0560:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0570:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0580:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0590:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c05f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0600:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0610:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0620:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0630:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0640:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0650:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0660:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0670:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0680:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0690:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c06f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0700:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0710:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0720:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0730:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0740:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0750:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0760:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0770:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0780:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c0790:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07a0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07b0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07c0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07d0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07e0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
0x001c07f0:	00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 

MT7622> mtd dump.raw spi-nand0 0x1c5000
Reading 2048 byte(s) (1 page(s)) at offset 0x001c5000 [raw]

Dump 2048 data bytes from 0x001c5000:
0x001c5000:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5010:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5020:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5030:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5040:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5050:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5060:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5070:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5080:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5090:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c50f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5100:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5110:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5120:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5130:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5140:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5150:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5160:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5170:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5180:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5190:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c51f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5200:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5210:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5220:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5230:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5240:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5250:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5260:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5270:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5280:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5290:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c52f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5300:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5310:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5320:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5330:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5340:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5350:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5360:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5370:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5380:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5390:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c53f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5400:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5410:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5420:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5430:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5440:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5450:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5460:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5470:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5480:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5490:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c54f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5500:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5510:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5520:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5530:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5540:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5550:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5560:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5570:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5580:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5590:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c55f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5600:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5610:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5620:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5630:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5640:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5650:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5660:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5670:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5680:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5690:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c56f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5700:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5710:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5720:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5730:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5740:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5750:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5760:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5770:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5780:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c5790:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57a0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57b0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57c0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57d0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57e0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 
0x001c57f0:	ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff 

MT7622> mtd dump.raw spi-nand0 0x23fe00
Offset not aligned with a page (0x800)
MT7622>

hnyman · May 29, 2025, 2:39pm

To my understanding, it means that the total ubi space is too fully allocated to volumes (like fip, factory, kernel, rootfs, ...), so that there is not enough free erase blocks for future bad block handling. Ubifs would like to have 20 blocks (certain proportion of the whole ubi area), and only 18 are available.

grauerfuchs · May 29, 2025, 10:43pm

The dump of the two pages is enough to be telling; The first page of the dumped data contains UBI block headers. The second page is blank, which isn't unexpected with the first page showing UBI headers. As for the third block, it no longer matters since the first page tells the tales.

The previous boot logs showed a crash of the installer when it couldn't find the MAC addresses. This is immediately after the check for the EEPROMs, which means that the EEPROMs were in the right location when the installer ran but the MAC addresses were not. The crash happens and the device is supposed to reset long before the UBI volume can be formatted, so the presence of UBI block markers at the start of the factory offset says that something very unexpected is happening where it shouldn't and in a way that doesn't appear to be happening for anyone else, or that there are actions being taken, resets being conducted unexpectedly, or other things happening in between the steps that you haven't reported here.

@daniel - Sorry to pull you into this, but is it possible that the sysrq-trigger reset may be delayed excessively, and so the procedure continues and may even be capable of starting the format of the UBI volume prior to the reset taking place? I don't see any command or return value check in there to ensure that the script is terminated on a failure result, and that kind of failure mode could potentially explain what we're seeing here.

@diagpope -
When you ran the most recent set of requested commands from U-Boot, did you boot the router with mtk_uartboot, or did you let the router boot with the onboard boot chain? The full boot log from the onboard boot chain might be helpful in determining whether we have to start back at the beginning again or if we can get the router running in fewer, more directed steps.

The factory data is no longer in the place where that version of U-Boot expects it to be. Therefore, it can't load the MAC address and it produces the error.

hnyman's explanation matches my understanding as well. The reason the error occurred is likely a result of the firmware that was used to boot into U-Boot and the state of the data on the flash chip.

This was my mistake; There was a typo in the offset given for the third page and that's why it wouldn't run. It should have been mtd dump.raw spi-nand0 0x23f800.

As for why the MAC addresses couldn't be found, I have one theory: If you took all of the commands for updating the factory data and ran them in one single cut-and-paste operation, it's possible the command buffer is too small and some of the earlier commands were lost. The next time you write the MAC addresses to the factory data in memory, you may want to cut and paste each MAC address (6 write commands) separately and let the router process each group before pasting the next group. I grouped them the way I did in hopes of avoiding this exact issue.

diagpope · May 30, 2025, 3:52am

Wow, a lot to digest.

I can not add to the details of what I do not understand but I discovered one thing you mention at the end. Example:

I noticed that I cannot copy and paste all six lines of these 6 commands. The last command will be mangled. I have paste 5 + 1 (4 times for four blocks of it)

mw.b 0x4807FFFA 0x7a
mw.b 0x4807FFFB 0x8f
mw.b 0x4807FFFC 0x05
mw.b 0x4807FFFD 0xb4
mw.b 0x4807FFFE 0xa6
mw.b 0x4807FFFF 0xf6

Another fact is: There is a difference between toggling the power switch on the router and unplugging the power adapter which surprises me. At home I remote control the AC outlet, so I never noticed it.

As to " did you boot the router with mtk_uartboot, or did you let the router boot with the onboard boot chain": I did boot via mtk_uartboot

I will give it one more attempt with 23.05.5 by pasting each command one by one.
Maybe I can update to 24.10

diagpope · May 30, 2025, 4:08am

It appears, I need to disconnect the USB and power down for a minute again:

sudo bash -c 'RUST_BACKTRACE=full  ./mtk_uartboot -s /dev/ttyUSB0 -a -p bl2-mt7622-1ddr-ram.bin -f openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip ' && sudo screen /dev/ttyUSB0 115200
mtk_uartboot - 0.1.1
Using serial port: /dev/ttyUSB0
Handshake...
thread 'main' panicked at src/bootrom.rs:53:53:
called `Result::unwrap()` on an `Err` value: Custom { kind: TimedOut, error: "Operation timed out" }
stack backtrace:
   0:     0x7f623fb5fac6 - <unknown>
   1:     0x7f623fc42940 - <unknown>
   2:     0x7f623fb5dbbf - <unknown>
   3:     0x7f623fb5f8a4 - <unknown>
   4:     0x7f623fb60c87 - <unknown>
   5:     0x7f623fb609e9 - <unknown>
   6:     0x7f623fb61118 - <unknown>
   7:     0x7f623fb60ff2 - <unknown>
   8:     0x7f623fb5ffc6 - <unknown>
   9:     0x7f623fb60d50 - <unknown>
  10:     0x7f623faea1b5 - <unknown>
  11:     0x7f623faea623 - <unknown>
  12:     0x7f623faf2103 - <unknown>
  13:     0x7f623faebfe8 - <unknown>
  14:     0x7f623faf84a3 - <unknown>
Aborted

because it wont even uboot at the moment.

diagpope · June 21, 2025, 3:34pm

Update: I have attempted success-less-ly

Installation of 24.10 via Uboot
Upgrade from 23.05 via dangowrt to 24
All attempts end up in booting into the initramfs of 23.05
I have reassembled the case with the serial port exposed in case of future upgrade attempts.

diagpope · July 6, 2025, 4:03am

This is the current status page of this router

It shows 23.05.5 and states to have UBI layout (if I read correct that UBI means it's layout was converted) I am confused. I was assuming that only with version 24 or higher, UBI layout is supported on this device.
Can this be the reason why the images wont be accepted?

hnyman · July 6, 2025, 5:50am

Well, the UBI in the name here only signifies that it is not following the original OEM partition scheme and bootchain. (The is also the practically unusable non-ubi variant)

What 24.10 an later have in in addition, is that even more of the bootchain components were moved to UBI, "fib-in-ubi", but that is not visible in the device name.

Check the bootchain details more closely. Commands in:
https://openwrt.org/toh/linksys/e8450#brief_summary_of_okd

diagpope · July 6, 2025, 1:25pm

I recently tried to update one Belkin RT3200 and two Linksys E8450 that were already UBI converted via dangowrt (24.10.0) to 24.10.2 using sysupgrade.itb. They both refused the image as not compatible. The upgrade was only possible via
(1. backup)
2. Hard reset to boot into initramfs
3. Luci flash of openwrt-24.10.2-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb
(4. restore backup)

As I understand, the device has two images to boot from. Is it deterministic which one it boots from upon reset or power cycle? Is it always a specific one, when does it change?
How do I determine what bootloader and image type is flashed into which of the two 'slots''?