Unbrick Belkin RT3200 - after getting initramfs running then what?

phatgeek · December 12, 2021, 2:24am

On my third Belkin RT3200, something went wrong and I ended with a soft-brick (meaning I still had U-Boot, but it's not booting OpenWRT). I followed the same procedure as the other two, but on this third one, the stock firmware update tool said that my image was wrong (installing the same openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb image I previously used on the other two). After rebooting, it booted into the initramfs openwrt anyway, so I proceeded to try the sysupgrade image. That went badly.

I managed to open the box (phew! not easy) and connect a serial device. I got an error saying something about bad magic when loading the kernel.

Using the U-Boot console and the tftpboot command I uploaded my personally-built openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb image and booted it using the bootm command. So my question is, now what do I do?

Do I try to use sysupgrade and a sysupgrade image? Or do I try again the initramfs-recovery-installer image? Or something different. (Hint, I've tried both, and no love).

As a side note: I have MTD backups from one of the other two routers. It might just be simplest to restore from those MTD block backups, but I'm not sure how to do that.

Thanks in advance for any advice.

daniel · December 12, 2021, 11:23am

As you got serial access, please share a complete bootlog incl. U-Boot output, that will make it easy to judge what to do next.

phatgeek · December 12, 2021, 3:37pm

Thank you, Daniel. Here is the serial output upon just attempting to boot (failure to load kernel):

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036D [000F]
Jump to BL

UNIVPLL_CON0 = 0xFE000000!!!
mt_pll_init: Set pll frequency for 25M crystal
[PMIC_WRAP]wrap_init pass,the return value=0.
[pmic_init] Preloader Start..................
[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2  0:E3
[pmic_init] Done...................
Chip part number:7622B
MT7622 Version: 1.2.8, (iPA) 
SSC OFF
mt_pll_post_init: mt_get_cpu_freq = 1350000Khz
mt_pll_post_init: mt_get_mem_freq = 1600000Khz
mt_pll_post_init: mt_get_bus_freq = 1119920Khz
[PLFM] Init I2C: OK(0)

[BLDR] Build Time: 20200522-165358
==== Dump RGU Reg ========
RGU MODE:     4D
RGU LENGTH:   FFE0
RGU STA:      0
RGU INTERVAL: FFF
RGU SWSYSRST: 8000
==== Dump RGU Reg End ====
RGU: g_rgu_satus:0
 mtk_wdt_mode_config  mode value=10, tmp:22000010
PL P ON
WDT does not trigger reboot
WDT NONRST=0x20000000
WDT IRQ_EN=0x340003
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)
[EMI] MDL number = 2
[EMI] DRAMC calibration start

[EMI] DRAMC calibration end

[EMI]rank size auto detect
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x48000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0x12345678, test_addr[0x50000000]= 0xEDCBA987
[EMI]start_addr[0x40000000]=0xEDCBA987, test_addr[0x60000000]= 0xEDCBA987
[EMI]rank0 size: 0x20000000
[MEM] complex R/W mem test pass
RAM_CONSOLE wdt status (0x0)=0x0
[BBT] BMT.v2 is found at 0x3FF
[PLFM] Init Boot Device: OK(0)

[PART] blksz: 2048B
[PART] [0x0000000000000000-0x000000000007FFFF] "PRELOADER" (256 blocks) 
[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (128 blocks) 
[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (256 blocks) 

Device APC domain init setup:

Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x0)
Domain Setup (0x0)
[PART] Image with part header
[PART] name : U-Boot
[PART] addr : 41E00000h mode : -1
[PART] size : 342676
[PART] magic: 58881688h

[PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS]
[PART] load speed: 16731KB/s, 342676 bytes, 20ms
load lk (ret=0)
[PART] Image with part header
[PART] name : atf
[PART] addr : FFFFFFFFh mode : -1
[PART] size : 57936
[PART] magic: 58881688h

[PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS]
[PART] load speed: 14144KB/s, 57936 bytes, 4ms
load tee1 (ret=0)
[BLDR] bldr load tee part ret=0x0, addr=0x43001000
[BLDR] boot part. not found
[BLDR] part_load_images ret=0x0
[BLDR] Others, jump to ATF

[BLDR] jump to 0x41E00000
[BLDR] <0x41E00000>=0xEA00000F
[BLDR] <0x41E00004>=0xE59FF014


U-Boot 2014.04-rc1 Version: 1.0.0.1 (Jul 21 2020 - 12:07:36)

static declaration g_total_rank_size = 0x1F000000
DRAM:  496 MiB
NAND:  Recognize SNAND: ID [e5 71 ], Device Name [FM35X1GA], Page Size [2048]B Spare Size [64]B Total Size [128]MB
[mtk_snand] probe successfully!
[BBT] BMT.v2 is found at 0x3ff
128 MiB
[mtk_nand_erase_hw] mtk_nand_erase_hw @4249, ret:0x40. page:0x640 
[mtk_nand_erase_hw] mtk_nand_erase_hw @4249, ret:0x40. page:0x6c0 
In:    serial
Out:   serial
Err:   serial
Net:   mtk_eth
Uip activated

  *** U-Boot SPI NAND ***

     1. System Load Linux to SDRAM via TFTP.
     2. System Load Linux Kernel then write to Flash via TFTP.
     3. Boot master system code via Flash.
     4. Boot slave system code via Flash.
     5. System Load U-Boot then write to Flash via TFTP.
     6. System Load U-Boot then write to Flash via Serial.
     7. System Load ATF then write to Flash via TFTP.
     8. System Load Preloader then write to Flash via TFTP.
     U-Boot console


  Press UP/DOWN to move or Press 1~8 to choose, ENTER to select

NAND read: device 0 offset 0x500000, size 0x2000
 8192 bytes read: OK
[do_read_image_blks] Image format error,neither FIT image nor old image.
Bad Magic Number.

NAND read: device 0 offset 0x500000, size 0x0
 0 bytes read: OK
bootm flag=0, states=70f
Wrong Image Format for bootm command
ERROR: can't get kernel image!
MT7622>

phatgeek · December 12, 2021, 3:45pm

The whole thing was too big for one post, so here is everthing starting from me loading the rescue initramfs image and booting it:

MT7622> tftpboot 192.168.1.5:openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
ETH already turn on and power on flow will be skipped...

 Waitting for RX_DMA_BUSY status Start... done

mt7531: mt7531_sw_init
mt7531: mt7531_core_pll_setup, hwstrap = 000000ff, xtal=25MHz
mt7531: mt7531_mac_port_setup, port = 6
mt7531: mt7531_set_port_sgmii_force_mode, port = 6
mt7531: timeout waiting for SGMII_LINK
mt7531: mt7531_mac_port_setup, PMCR6 = f805633b
>>>>>>>>>>>>>>>>>>>>>>>>>>>>> START CALIBRATION:
-------- gephy-calbration (port:0) --------
CALDLY = 40
0x1e-e0 = 2727
0x1f-115 = 4
  GE Rext AnaCal Done! (7)(0x27)  
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE 1e_174(0xb4b4), 1e_175(0xb4b2)  
 GE Tx offset AnaCal Done! (pair-0)(3)(0x3) 0x1e_172=0x320
 GE Tx offset AnaCal Done! (pair-1)(5)(0x24) 0x1e_172=0x324
 GE Tx offset AnaCal Done! (pair-2)(2)(0x2) 0x1e_173=0x220
 GE Tx offset AnaCal Done! (pair-3)(5)(0x24) 0x1e_173=0x224
 GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x8020)
 GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1b1b)
 GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x2028)
 GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x222a)
PORT 0 RX_DC_OFFSET
before pairA output = f
after pairA output = ff
before pairB output = 1e
after pairB output = 2
before pairC output = 1e
after pairC output = ff
before pairD output = 1e
after pairD output = 0
-------- gephy-calbration (port:1) --------
CALDLY = 40
 GE R50 AnaCal Done! (11) (0x31)(0xb1) 
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE 1e_174(0xb1b2), 1e_175(0xb4b2)  
 GE Tx offset AnaCal Done! (pair-0)(3)(0x22) 0x1e_172=0x2220
 GE Tx offset AnaCal Done! (pair-1)(6)(0x25) 0x1e_172=0x2225
 GE Tx offset AnaCal Done! (pair-2)(1)(0x1) 0x1e_173=0x120
 GE Tx offset AnaCal Done! (pair-3)(2)(0x2) 0x1e_173=0x102
 GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x681a)
 GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1b1b)
 GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x1d25)
 GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x1820)
PORT 1 RX_DC_OFFSET
before pairA output = 1e
after pairA output = 1
before pairB output = f
after pairB output = 1
before pairC output = c
after pairC output = 1
before pairD output = d
after pairD output = 0
-------- gephy-calbration (port:2) --------
CALDLY = 40
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE 1e_174(0xb2b2), 1e_175(0xb4b4)  
 GE Tx offset AnaCal Done! (pair-0)(3)(0x22) 0x1e_172=0x2220
 GE Tx offset AnaCal Done! (pair-1)(5)(0x24) 0x1e_172=0x2224
 GE Tx offset AnaCal Done! (pair-2)(2)(0x21) 0x1e_173=0x2120
 GE Tx offset AnaCal Done! (pair-3)(3)(0x22) 0x1e_173=0x2122
 GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x6419)
 GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1b1b)
 GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x1b23)
 GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x121a)
PORT 2 RX_DC_OFFSET
before pairA output = f
after pairA output = 1
before pairB output = f
after pairB output = 1
before pairC output = e
after pairC output = 1
before pairD output = e
after pairD output = 0
-------- gephy-calbration (port:3) --------
CALDLY = 40
 GE R50 AnaCal Done! (12) (0x30)(0xb0) 
 GE R50 AnaCal Done! (10) (0x32)(0xb2) 
 GE R50 AnaCal Done! (11) (0x31)(0xb1) 
 GE R50 AnaCal Done! (11) (0x31)(0xb1) 
 GE 1e_174(0xb0b2), 1e_175(0xb1b1)  
 GE Tx offset AnaCal Done! (pair-0)(4)(0x23) 0x1e_172=0x2320
 GE Tx offset AnaCal Done! (pair-1)(2)(0x21) 0x1e_172=0x2321
 GE Tx offset AnaCal Done! (pair-2)(5)(0x24) 0x1e_173=0x2420
 GE Tx offset AnaCal Done! (pair-3)(4)(0x23) 0x1e_173=0x2423
 GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x6c1b)
 GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1717)
 GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x1f27)
 GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x1e26)
PORT 3 RX_DC_OFFSET
before pairA output = 1d
after pairA output = 1
before pairB output = 1e
after pairB output = ff
before pairC output = 1d
after pairC output = fe
before pairD output = 1e
after pairD output = fe
-------- gephy-calbration (port:4) --------
CALDLY = 40
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (9) (0x34)(0xb4) 
 GE R50 AnaCal Done! (8) (0x35)(0xb5) 
 GE R50 AnaCal Done! (8) (0x35)(0xb5) 
 GE 1e_174(0xb4b4), 1e_175(0xb5b5)  
 GE Tx offset AnaCal Done! (pair-0)(3)(0x22) 0x1e_172=0x2220
 GE Tx offset AnaCal Done! (pair-1)(4)(0x23) 0x1e_172=0x2223
 GE Tx offset AnaCal Done! (pair-2)(2)(0x21) 0x1e_173=0x2120
 GE Tx offset AnaCal Done! (pair-3)(5)(0x24) 0x1e_173=0x2124
 GE Tx amp AnaCal Done! (pair-0)(1e_12 = 0x3c0f)
 GE Tx amp AnaCal Done! (pair-1)(1e_17 = 0x1515)
 GE Tx amp AnaCal Done! (pair-2)(1e_19 = 0x1119)
 GE Tx amp AnaCal Done! (pair-3)(1e_21 = 0x121a)
PORT 4 RX_DC_OFFSET
before pairA output = 1e
after pairA output = 1
before pairB output = e
after pairB output = ff
before pairC output = 1e
after pairC output = ff
before pairD output = d
after pairD output = 1
 0x1b000014 = 0x00110214
Using mtk_eth device
TFTP from server 192.168.1.5; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb'.
Load address: 0x4007ff28
Loading: T #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ############################
	 1.8 MiB/s
done
Bytes transferred = 13762560 (d20000 hex)
get filesize 0xd20000
MT7622> bootm 0x4007ff28
bootm flag=0, states=70f
## Loading kernel from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.10.82
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x40080010
     Data Size:    3731975 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   d43690de
     Hash algo:    sha1
     Hash value:   79fe3a55d0101b2f0e8f0e89fd3de04d4bf8e413
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x4040f354
     Data Size:    9901632 Bytes = 9.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   7f00528b
     Hash algo:    sha1
     Hash value:   e0d0f58a20bc4700709340f2100a02368934e27c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x40d80aa4
     Data Size:    29481 Bytes = 28.8 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   d090dd70
     Hash algo:    sha1
     Hash value:   5a6a6edd97ebfd758f4e57902d4662cb015eaf39
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x40d80aa4
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 5c5a1000, end 5cf12640 ... OK
   Loading Device Tree to 5c596000, end 5c5a0328 ... OK

Starting kernel ...

[ATF][   594.064994]save kernel info
[ATF][   594.067931]Kernel_EL2
[ATF][   594.070601]Kernel is 64Bit
[ATF][   594.073689]pc=0x44000000, r0=0x5c596000, r1=0x0
INFO:    BL3-1: Preparing for EL3 exit to normal world, Kernel
INFO:    BL3-1: Next image address = 0x44000000
INFO:    BL3-1: Next image spsr = 0x3c9
[ATF][   594.091388]el3_exit
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.10.82 (odin@odin-school) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r18066-8a6b1a8d29) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Dec 10 10:33:49 2021
[    0.000000] Machine model: Linksys E8450 (UBI)
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] On node 0 totalpages: 131072
[    0.000000]   DMA zone: 2048 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 131072 pages, LIFO batch:31
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv0.2 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] percpu: Embedded 20 pages/cpu s43800 r8192 d29928 u81920
[    0.000000] pcpu-alloc: s43800 r8192 d29928 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: console=ttyS0,115200 rootdelay=1 rootfstype=squashfs earlyprintk mtdparts=master
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 484316K/524288K available (7806K kernel code, 856K rwdata, 2084K rodata, 448K init, 285K bss, 39972K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x484 with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.000164] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.000173] pid_max: default: 32768 minimum: 301
[    0.000250] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000259] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001207] rcu: Hierarchical SRCU implementation.
[    0.001295] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.001478] smp: Bringing up secondary CPUs ...
[    0.001783] Detected VIPT I-cache on CPU1
[    0.001827] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001890] smp: Brought up 1 node, 2 CPUs
[    0.001897] SMP: Total of 2 processors activated.
[    0.001902] CPU features: detected: 32-bit EL0 Support
[    0.001906] CPU features: detected: CRC32 instructions
[    0.002006] CPU: All CPU(s) started at EL2
[    0.002017] alternatives: patching kernel code
[    0.005411] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005431] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.005516] pinctrl core: initialized pinctrl subsystem
[    0.005868] NET: Registered protocol family 16
[    0.006456] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006488] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006512] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.006795] thermal_sys: Registered thermal governor 'fair_share'
[    0.006799] thermal_sys: Registered thermal governor 'bang_bang'
[    0.006804] thermal_sys: Registered thermal governor 'step_wise'
[    0.006808] thermal_sys: Registered thermal governor 'user_space'
[    0.007065] ASID allocator initialised with 65536 entries
[    0.007490] pstore: Registered ramoops as persistent store backend
[    0.007498] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.036247] SCSI subsystem initialized
[    0.036445] libata version 3.00 loaded.
[    0.036582] usbcore: registered new interface driver usbfs
[    0.036614] usbcore: registered new interface driver hub
[    0.036639] usbcore: registered new device driver usb
[    0.037716] clocksource: Switched to clocksource arch_sys_counter
[    0.038286] NET: Registered protocol family 2
[    0.038387] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.038742] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.038756] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.038788] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.038850] TCP: Hash tables configured (established 4096 bind 4096)
[    0.038932] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.038948] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.039060] NET: Registered protocol family 1
[    0.039082] PCI: CLS 0 bytes, default 64
[    0.039186] Unpacking initramfs...
[    2.497033] Freeing initrd memory: 9668K
[    2.498023] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    2.500507] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.500517] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.533623] mtk-tphy 1a0c4000.usb-phy: failed to get ref_clk(id-1)
[    2.537583] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    2.551799] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    2.552350] printk: console [ttyS0] disabled
[    2.552404] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 22, base_baud = 1562500) is a 16550A
[    3.155308] printk: console [ttyS0] enabled
[    3.160050] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 23, base_baud = 1562500) is a 16550A
[    3.169548] 1100c000.serial: ttyS2 at MMIO 0x1100c000 (irq = 27, base_baud = 17499995) is a MediaTek BTIF
[    3.179234] serial serial0: tty port ttyS2 registered
[    3.184827] mtk_rng 1020f000.rng: registered RNG driver
[    3.184844] hwrng: no data available
[    3.190273] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    3.202204] loop: module loaded
[    3.206067] mtk-snand 1100d000.snfi: chip is FM35Q1GA, size 128MB, page size 2048, oob size 64
[    3.219066] 4 fixed-partitions partitions found on MTD device 1100d000.snfi
[    3.226029] Creating 4 MTD partitions on "1100d000.snfi":
[    3.231448] 0x000000000000-0x000000080000 : "bl2"
[    3.237005] 0x000000080000-0x0000001c0000 : "fip"
[    3.243195] 0x0000001c0000-0x0000002c0000 : "factory"
[    3.249477] 0x000000300000-0x000008000000 : "ubi"
[    3.282845] random: fast init done
[    3.384611] blk_update_request: I/O error, dev mtdblock2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[    3.394972] Buffer I/O error on dev mtdblock2, logical block 0, async page read
[    3.402420] blk_update_request: I/O error, dev mtdblock2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[    3.412766] Buffer I/O error on dev mtdblock2, logical block 0, async page read
[    3.420210] blk_update_request: I/O error, dev mtdblock2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[    3.430556] Buffer I/O error on dev mtdblock2, logical block 0, async page read
[    3.437863]  mtdblock2: unable to read partition table
[    3.446232] libphy: Fixed MDIO Bus: probed
[    3.474056] libphy: mdio: probed
[    3.478584] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc011080000, irq 35
[    3.488737] i2c /dev entries driver
[    3.493109] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    3.503582] NET: Registered protocol family 10
[    3.508690] Segment Routing with IPv6
[    3.512383] NET: Registered protocol family 17
[    3.516840] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.529863] 8021q: 802.1Q VLAN Support v1.8
[    3.535094] pstore: Using crash dump compression: deflate
[    3.541146] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    3.547676] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    3.553519] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    3.588004] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    3.594181] pci_bus 0000:00: root bus resource [bus 00-ff]
[    3.599666] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    3.606531] pci_bus 0000:00: scanning bus
[    3.610587] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    3.616614] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    3.625414] pci_bus 0000:00: fixups for bus
[    3.629600] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    3.636293] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    3.644303] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    3.651098] pci_bus 0000:01: scanning bus
[    3.655311] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    3.661493] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    3.668816] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    3.676135] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    3.684092] pci 0000:01:00.0: supports D1 D2
[    3.688358] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    3.694987] pci 0000:01:00.0: PME# disabled
[    3.699472] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    3.738917] pci_bus 0000:01: fixups for bus
[    3.743096] pci_bus 0000:01: bus scan returning with max=01
[    3.748674] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    3.755284] pci_bus 0000:00: bus scan returning with max=01
[    3.760867] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    3.768519] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    3.776515] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    3.783302] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    3.791125] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    3.798950] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    3.806767] pci 0000:00:00.0: PCI bridge to [bus 01]
[    3.811734] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    3.818594] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
[    3.825198] pcieport 0000:00:00.0: assign IRQ: got 0
[    3.830170] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    3.836272] pcieport 0000:00:00.0: enabling bus mastering
[    3.842115] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    3.848649] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    3.854480] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    3.962644] mtk-pcie 1a145000.pcie: Port1 link down
[    3.967611] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    3.973796] pci_bus 0001:00: root bus resource [bus 00-ff]
[    3.979279] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    3.986145] pci_bus 0001:00: scanning bus
[    3.991241] pci_bus 0001:00: fixups for bus
[    3.995416] pci_bus 0001:00: bus scan returning with max=00
[    4.001268] mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
[    4.009459] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    4.077371] libphy: dsa slave smi: probed
[    4.082296] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [dsa-0.0:00] driver [Generic PHY] (irq=POLL)
[    4.092965] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [dsa-0.0:01] driver [Generic PHY] (irq=POLL)
[    4.103509] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY] (irq=POLL)
[    4.113945] mt7530 mdio-bus:00 lan4 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY] (irq=POLL)
[    4.124528] mt7530 mdio-bus:00 wan (uninitialized): PHY [dsa-0.0:04] driver [Generic PHY] (irq=POLL)
[    4.135260] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
[    4.142336] DSA: tree 0 setup
[    4.142508] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    4.145982] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    4.157760] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[    4.166811] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000210010
[    4.175896] xhci-mtk 1a0c0000.usb: irq 31, io mem 0x1a0c0000
[    4.181874] hub 1-0:1.0: USB hub found
[    4.185633] hub 1-0:1.0: 2 ports detected
[    4.189879] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    4.195102] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[    4.202503] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
[    4.208801] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.217113] hub 2-0:1.0: USB hub found
[    4.220880] hub 2-0:1.0: 1 port detected
[    4.225584] UBI error: no valid UBI magic found inside mtd3
[    4.232049] Freeing unused kernel memory: 448K
[    4.267806] Run /init as init process
[    4.271460]   with arguments:
[    4.274417]     /init
[    4.276680]     earlyprintk
[    4.279476]   with environment:
[    4.282607]     HOME=/
[    4.284956]     TERM=linux
[    4.287653]     mtdparts=master
[    4.540916] init: Console is alive
[    4.544410] init: - watchdog -
[    4.552152] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.562328] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.579768] init: - preinit -
[    4.622292] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    4.630887] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    4.639829] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.650433] mt7530 mdio-bus:00 lan1: configuring for phy/gmii link mode
[    4.657561] 8021q: adding VLAN 0 to HW filter on device lan1
[    4.672110] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.771069] mt7530 mdio-bus:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[    7.778588] IPv6: ADDRCONF(NETDEV_CHANGE): lan1: link becomes ready
[    8.708395] mt7530 mdio-bus:00 lan1: Link is Down
[    8.716969] procd: - early -
[    8.719990] procd: - watchdog -
[    8.781930] random: jshn: uninitialized urandom read (4 bytes read)
[    8.838547] random: jshn: uninitialized urandom read (4 bytes read)
[    9.236697] procd: - watchdog -
[    9.240008] procd: - ubus -
[    9.244973] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.293360] procd: - init -
Please press Enter to activate this console.
[    9.390777] urngd: v1.0.2 started.
[    9.417047] random: crng init done
[    9.420502] random: 6 urandom warning(s) missed due to ratelimiting
[    9.430007] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.442321] tun: Universal TUN/TAP device driver, 1.6
[    9.453051] ipip: IPv4 and MPLS over IPv4 tunneling driver
[    9.464922] gre: GRE over IPv4 demultiplexor driver
[    9.471176] ip_gre: GRE over IPv4 tunneling driver
[    9.479059] ip6_gre: GRE over IPv6 tunneling driver
[    9.495720] Bridge firewalling registered
[    9.500980] Loading modules backported from Linux version v5.15-rc6-0-g519d81956ee2
[    9.508739] Backport generated by backports.git v5.15-rc6-1-0-gd44432d6
[    9.523633] MRM The MAC Address Re-Mapper is now in the kernel
[    9.540912] xt_time: kernel timezone is -0000
[    9.601382] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    9.612738] mt7915e 0000:01:00.0: assign IRQ: got 143
[    9.617917] pci 0000:00:00.0: enabling bus mastering
[    9.622907] mt7915e 0000:01:00.0: enabling device (0000 -> 0002)
[    9.629019] mt7622-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20190801210006a
[    9.629019] 
[    9.629069] mt7915e 0000:01:00.0: enabling bus mastering
[    9.656738] mt7622-wmac 18000000.wmac: N9 Firmware Version: 2.0, Build Time: 20200131180931
[    9.668209] mt7915e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20201105222230a
[    9.668209] 
[    9.687311] mt7915e 0000:01:00.0: WM Firmware Version: ____000000, Build Time: 20201105222304
[    9.710435] mt7915e 0000:01:00.0: WA Firmware Version: DEV_000000, Build Time: 20201105222323
[    9.834299] PPP generic driver version 2.4.2
[    9.839650] NET: Registered protocol family 24
[    9.845742] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[    9.853637] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[    9.867927] kmodloader: done loading kernel modules from /etc/modules.d/*
[   17.671270] mtk_soc_eth 1b100000.ethernet eth0: Link is Down
[   17.689827] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   17.698204] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   17.701325] mt7530 mdio-bus:00 lan1: configuring for phy/gmii link mode
[   17.714301] 8021q: adding VLAN 0 to HW filter on device lan1
[   17.722973] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   17.730545] br-lan: port 1(lan1) entered blocking state
[   17.735788] br-lan: port 1(lan1) entered disabled state
[   17.744406] device lan1 entered promiscuous mode
[   17.749136] device eth0 entered promiscuous mode
[   17.766415] mt7530 mdio-bus:00 lan2: configuring for phy/gmii link mode
[   17.778461] 8021q: adding VLAN 0 to HW filter on device lan2
[   17.786472] br-lan: port 2(lan2) entered blocking state
[   17.791818] br-lan: port 2(lan2) entered disabled state
[   17.798281] device lan2 entered promiscuous mode
[   17.822414] mt7530 mdio-bus:00 lan3: configuring for phy/gmii link mode
[   17.829685] 8021q: adding VLAN 0 to HW filter on device lan3
[   17.842548] br-lan: port 3(lan3) entered blocking state
[   17.847807] br-lan: port 3(lan3) entered disabled state
[   17.868239] device lan3 entered promiscuous mode
[   17.878018] mt7530 mdio-bus:00 lan4: configuring for phy/gmii link mode
[   17.885133] 8021q: adding VLAN 0 to HW filter on device lan4
[   17.893248] br-lan: port 4(lan4) entered blocking state
[   17.898533] br-lan: port 4(lan4) entered disabled state
[   17.904717] device lan4 entered promiscuous mode
[   17.915805] mt7530 mdio-bus:00 wan: configuring for phy/gmii link mode
[   17.922920] 8021q: adding VLAN 0 to HW filter on device wan
[   20.811069] mt7530 mdio-bus:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   20.818592] br-lan: port 1(lan1) entered blocking state
[   20.823810] br-lan: port 1(lan1) entered forwarding state
[   20.830219] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

BusyBox v1.34.1 (2021-12-10 10:33:49 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18302-ea49690ff4
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

daniel · December 12, 2021, 7:11pm

So this is still the original stock bootloader, ie. you did not yet run the installer image which replaces the loader.
Just like you now started openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb via TFTP, do the same with openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb which will carry out the conversion to UBI.
Then proceed to flash sysupgrade image.

phatgeek · December 12, 2021, 8:35pm

Edit: to be clear to anyone else reading this, this worked.

I can't thank you enough! Are you also the developer who created this UBI image in the first place? Thank you very much for that, as well! I had tried to use the sysupgrade to load both the initramfs-recovery-installer and the sysupgrade images, and failed. I guess that isn't raw enough to install the recovery installer image?

The original recovery installer image didn't load from the stock firmware update tool. It also complained about the bad magic numbers. I didn't see any option to force the install from the stock firmware. I tried a bunch of stuff, all of which appeared to fail, then rebooted and ended up in a recovery initramfs, which I thought was the installer image, but I bet it wasn't. I never would have figured this out. So glad I asked, and you were watching.

Best Regards,
Rich

tmomas · December 13, 2021, 7:06am

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

phatgeek · December 13, 2021, 2:43pm

Thank you.

system · December 23, 2021, 2:43pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.