1000+ "Bad EC magic in block" notifications on NAND boot

Banana Pi Router design BPI-R4/BPI-R4 Pro(MT7988)
8

This corrupted NAND error, along with other errors I’ve detected with OpenWrt, has been reported by me to the Banana Pi team privately. Here is their response; I am waiting for it.

They even have a video demonstrating all the boot failures caused by the corrupted NAND, plus other problems with the OpenWRT INA2xx sensor.

Dear friend,

We have conveyed your feedback to our engineering team. They will schedule time to reproduce the issue you described and will prepare relevant operation instructions for you.

Please rest assured that we are working on this. We kindly ask for your patience and thank you for your understanding.

Best regards,

Mia

--------------Original Message-------------- Sent: May 10, 2026 (Sunday) 7:29 PM To: “Li Yuyan” [email protected]; CC: “Sales” [email protected]; “Klaus Chen” [email protected]

9

Afaik there is no such sensor in hardware. It is only defined in software (bpi/mtk dts) but not soldered and so give a error on bootup that it is not found/responding.

10

Hi, Just getting back to my computer. Thanks for the responses.

@frank-w For the record it’s a BPR4 (not the Pro)

@Xiaomi_ax3600 Please let me know how your support call works out.

11

Ok,this sorted out the issue i’ve seen. You should see in linux the ubi initialization. Please post this part of bootlog please. I guess somehow this is not correct. Mtd definition in uboot and linux regarding the ubi should match,maybe start of ubi is different. Wonder why your ubi size in linux is only 21MB

12

Arm Trusted Firmware thinks your Nand is 256GB.

Does the 8GB R4 have a larger Nand?

13

When I remove power and immediately reapply it (fast power cycle), I get this error:

text
F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 1041 0000
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 380E 5012
F5: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [3000]
MK: 0000 0000 [0000]
T0: 0000 01F3 [0101]
Jump to BL

NOTICE:  BL2: v2.10.0   (release):OpenWrt v2024.01.17~bacca82a-3 (mt7988-sdmmc-comb)
NOTICE:  BL2: Built : 03:09:13, Jun 17 2025
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7988
NOTICE:  EMI: DDR4 4BG mode
NOTICE:  EMI: Using DDR unknown settings
NOTICE:  EMI: Detected DRAM size: 8192 MB
NOTICE:  EMI: complex R/W mem test passed
ERROR:   MSDC: CRC error occured while reading data with cmd=18, arg=0x3400
ERROR:   BL2: Failed to load image id 3 (-2)
This shows:

The CRC error occurs in BL2, before U-Boot even loads

The problem is related to MMC bus instability during early boot

When the WiFi card is ON during this phase, it causes interference on the MMC bus

Evidence 2 – The workaround (works 100% of the time) This is the procedure that works every time:

Power off the router completely (disconnect power cable)

With the WiFi card set to OFF, apply power

Wait for the U-Boot menu to appear

At this moment (or even a few seconds later, as the kernel is loading), turn the WiFi card ON

I have recorded a video demonstrating this procedure. I will send it to you separately.

What happens after this:

:white_check_mark: The BE14 WiFi card is detected and works perfectly

:white_check_mark: You can reboot via SSH or the web interface and the WiFi card remains detected

What happens if you remove power completely and start with WiFi ON:

:x: The WiFi card is NOT detected

What this proves: :white_check_mark: The hardware is fully functional :white_check_mark: The issue is software / boot timing :white_check_mark: The fix requires a patch in U-Boot or a delay in the PCIe / MMC initialization

What I need from you: An official patch for U-Boot to solve this problem permanently

Or, at minimum, official documentation of this workaround for users until a proper fix is released

I have recorded a full video showing:

The CRC error on fast power cycle

The OFF→ON workaround (including that it works even if you turn WiFi ON a few seconds later, not exactly at the menu)

The successful boot with WiFi detected and working

Subject: Reproducible mt7996e probe -11 on original NAND image —

Hello Mia / Klaus / 李玉燕,

Update: after keeping the router powered off for ~3 hours, I tested again using the original NAND image you provided (no changes). and insert it again.

Here are the key boot log lines showing the failure (mt7996e patch timeouts and probe -11):

[ 56.165611] mt7996e 0000:01:00.0: Message 00000007 (seq 12) timeout
[ 76.645602] mt7996e 0000:01:00.0: Message 00000007 (seq 13) timeout
[ 97.131852] mt7996e 0000:01:00.0: Failed to start patch
[ 158.571764] mt7996e 0000:01:00.0: Failed to release patch semaphore
[ 159.460364] mt7996e: probe of 0000:01:00.0 failed with error -11
[ 159.004909] Trying to free already-free IRQ 104

be14000

Here is the NAND corruption error I see:

text root@OpenWrt:~# fdisk -l Disk /dev/ubiblock0_4: 100.02 MiB, 104882176 bytes, 204848 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/mtdblock0: 2 MiB, 2097152 bytes, 4096 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/mtdblock1: 4 MiB, 4194304 bytes, 8192 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/mtdblock2: 250 MiB, 262144000 bytes, 512000 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/mtdblock3: 256 MiB, 268435456 bytes, 524288 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes The backup GPT table is corrupt, but the primary appears OK, so that will be used. The backup GPT table is not on the end of the device.

Disk /dev/mmcblk0: 58.3 GiB, 62599987200 bytes, 122265600 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 5452574F-2211-4433-5566-778899AABB00

Device Start End Sectors Size Type /dev/mmcblk0p1 34 8191 8158 4M Linux filesystem /dev/mmcblk0p2 8192 9215 1024 512K Linux filesystem /dev/mmcblk0p3 9216 13311 4096 2M Linux filesystem /dev/mmcblk0p4 13312 21503 8192 4M EFI System /dev/mmcblk0p5 24576 286719 262144 128M EFI System /dev/mmcblk0p6 286720 327679 40960 20M EFI System /dev/mmcblk0p7 327680 1245183 917504 448M unknown

Disk /dev/fit0: 93.38 MiB, 97914880 bytes, 191240 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/fitrw: 347.99 MiB, 364892160 bytes, 712680 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes

Disk /dev/sda: 59.48 GiB, 63864569856 bytes, 124735488 sectors Disk model: STORAGE DEVICE Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optical): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x38da4a7d

Device Boot Start End Sectors Size Id Type /dev/sda1 2048 124735487 124733440 59.5G 83 Linux

李玉燕 Archivos adjuntos vie, 8 may, 12:04 (hace 12 días) para mí, Sales, Klaus Chen

Dear friend,

Additionally, there is another issue regarding a WiFi software timeout. We still need some time to test it and will get back to you then.

Best regards, Mia

Banana PI original Developer & Manufacturer

Mia Li SINOVOIP CO.,LIMITED BANANAPI TECH LIMITED

Tel.: +86 755-2647-5332 |Mob: +86 15018467241
Email: [email protected] www.banana-pi.com www.banana-pi.org www.sinovoip.com.cn
BPI Wiki page: Banana Pi Main Page | BananaPi Docs (banana-pi.org) Shenzhen Address:3F, Block B,Digital Bldg. Garden City, No.1079 Nanhai Avenue, Shekou, Nanshan District , Shenzhen, Guangdong , China Dongguan Address:7/F, Rongyi Building, NO.5 Information Rd., Songshan Lake High-tech Industrianl Park, Dongguan 地址： 东莞市松山湖技术产业开发区信息路5号融易大厦七楼701室

14

Sorry, I’m not from bananapi, just a hobby enthousiast.

15

Good morning @ericwoud . I accidentally tagged you; it wasn’t meant for you. I apologize.

Have a good day.

16

It may help to lower the frequency of MMC in ATF.

17

Good morning. If you’d like to collaborate, my repositories are available to you; there are no rules in place.

Thank you for your help.

18

Thanks, but I do not use openwrt.

19

Good afternoon, could you tell me what you use and let me try one of your images? I’ve always used OpenWrt.

I’m eager to discover new things.

Thanks

20

ArchLinuxARM, but I haven’t got a R4pro to test any image. I think it won’t work yet, until I get one and iron out the bugs. But mostly it is the amount of time I have available, that I haven’t moved.on to R4pro.

21

Good afternoon, thank you as well. If you ever upgrade to the pro version, I’d be happy to try your image.

Best regards

22

Please do not hijack this thread which is for r4 and nand errors

23

The specs confirm 128M

Thanks,

24

Hi Frank,

Here are the NAND/ubi/mtd references in the boot log,

000 [0x411fd090]
[    0.000000] Linux version 6.12.85 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32912-6639b15f62) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Mon May  4 22:30:45 2026
[    0.000000] Machine model: Banana Pi BPI-R4 (2x SFP+)
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004304ffff (320 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047cc0000..0x0000000047dbffff (1024 KiB) nomap non-reusable wmcpu-reserved@47cc0000
[    0.000000] OF: reserved mem: 0x000000004f600000..0x000000004f63ffff (256 KiB) nomap non-reusable wo-emi@4f600000
[    0.000000] OF: reserved mem: 0x000000004f640000..0x000000004f67ffff (256 KiB) nomap non-reusable wo-emi@4f640000
[    0.000000] OF: reserved mem: 0x000000004f680000..0x000000004f6bffff (256 KiB) nomap non-reusable wo-emi@4f680000
[    0.000000] OF: reserved mem: 0x000000004f700000..0x000000004fefffff (8192 KiB) nomap non-reusable wo-data@4f700000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x00000000ffffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   [mem 0x0000000100000000-0x000000013fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004304ffff]
[    0.000000]   node   0: [mem 0x0000000043050000-0x0000000047cbffff]
[    0.000000]   node   0: [mem 0x0000000047cc0000-0x0000000047dbffff]
[    0.000000]   node   0: [mem 0x0000000047dc0000-0x000000004f5fffff]
[    0.000000]   node   0: [mem 0x000000004f600000-0x000000004f6bffff]
[    0.000000]   node   0: [mem 0x000000004f6c0000-0x000000004f6fffff]
[    0.000000]   node   0: [mem 0x000000004f700000-0x000000004fefffff]
[    0.000000]   node   0: [mem 0x000000004ff00000-0x000000013fffffff]
      .
      .
      .
[    0.000000] Kernel command line: console=ttyS0,115200n1 pci=pcie_bus_perf root=/dev/fit0 rootwait ubi.block=0,fit
      .
      .
      .
[    0.040864] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
      .
      .
      .
[    1.160191] spi-nand spi0.0: Winbond SPI NAND was found.
[    1.165541] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.174019] 2 fixed-partitions partitions found on MTD device spi0.0
[    1.180512] Creating 2 MTD partitions on "spi0.0":
[    1.185308] 0x000000000000-0x000000200000 : "bl2"
[    1.191341] 0x000000200000-0x000008000000 : "ubi"
[    1.265400] ubi0: default fastmap pool size: 50
[    1.269926] ubi0: default fastmap WL pool size: 25
[    1.274715] ubi0: attaching mtd1
[    1.623231] ubi0: scanning is finished
[    1.630982] ubi0: attached mtd1 (name "ubi", size 126 MiB)
[    1.636463] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.643330] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.650107] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.657060] ubi0: good PEBs: 1008, bad PEBs: 0, corrupted PEBs: 0
[    1.663152] ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
[    1.670362] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
[    1.678702] ubi0: available PEBs: 0, total reserved PEBs: 1008, PEBs reserved for bad PEB handling: 40
[    1.688001] ubi0: background thread "ubi_bgt0d" started, PID 295
[    1.688470] block ubiblock0_4: created from ubi0:4(fit)
      .
      .
      .
[    3.358672] FIT: Detected U-Boot 2025.10-OpenWrt-r32912-6639b15f62
[    3.364853] FIT: Selected configuration: "config-mt7988a-bananapi-bpi-r4" (OpenWrt bananapi_bpi-r4)
[    3.373896] FIT:           kernel sub-image 0x00001000..0x0059c5da "kernel-1" (ARM64 OpenWrt Linux-6.12.85) 
[    3.383718] FIT:          flat_dt sub-image 0x0059d000..0x005a7bc7 "fdt-1" (ARM64 OpenWrt bananapi_bpi-r4 device tree blob) 
[    3.394929] FIT:          flat_dt sub-image 0x005a8000..0x005a85fd "fdt-mt7988a-bananapi-bpi-r4-emmc" (ARM64 OpenWrt bananapi_bpi-r4 device tree overlay mt7988a-bananapi-bpi-r4-emmc) 
[    3.411261] FIT:          flat_dt sub-image 0x005a9000..0x005a911c "fdt-mt7988a-bananapi-bpi-r4-rtc" (ARM64 OpenWrt bananapi_bpi-r4 device tree overlay mt7988a-bananapi-bpi-r4-rtc) 
[    3.427417] FIT:          flat_dt sub-image 0x005aa000..0x005aa5b5 "fdt-mt7988a-bananapi-bpi-r4-sd" (ARM64 OpenWrt bananapi_bpi-r4 device tree overlay mt7988a-bananapi-bpi-r4-sd) 
[    3.443399] FIT:          flat_dt sub-image 0x005ab000..0x005ad0ca "fdt-mt798
8a-bananapi-bpi-r4-wifi-be14" (ARM64 OpenWrt bananapi_bpi-r4 device tree overlay mt7988a-bananapi-bpi-r4-wifi-be14) 
[    3.460593] FIT:       filesystem sub-image 0x005ae000..0x01547fff "rootfs-1" (ARM64 OpenWrt bananapi_bpi-r4 rootfs) 
[    3.471424] block ubiblock0_4: mapped 1 uImage.FIT filesystem sub-image as /dev/fit0
      .
      .
      .
[    9.343728] UBIFS (ubi0:6): Mounting in unauthenticated mode
[    9.349452] UBIFS (ubi0:6): background thread "ubifs_bgt0_6" started, PID 1014
[    9.368243] UBIFS (ubi0:6): recovery needed
[    9.446086] UBIFS (ubi0:6): recovery completed
[    9.450557] UBIFS (ubi0:6): UBIFS: mounted UBI device 0, volume 6, name "rootfs_data"
[    9.458381] UBIFS (ubi0:6): LEB size: 126976 bytes (124 KiB), min./max. I/O u
nit sizes: 2048 bytes/2048 bytes
[    9.468285] UBIFS (ubi0:6): FS size: 70344704 bytes (67 MiB, 554 LEBs), max 564 LEBs, journal size 3555328 bytes (3 MiB, 28 LEBs)
[    9.479924] UBIFS (ubi0:6): reserved for root: 3322554 bytes (3244 KiB)
[    9.486530] UBIFS (ubi0:6): media format: w5/r0 (latest is w5/r0), UUID 4048392B-2587-4920-9C8C-98A3D0B86C67, small LPT model
[    9.499830] mount_root: switching to ubifs overlay
[    9.507392] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.

Appreciate your time!

25

Then it would seem your ATF is build with the wrong NAND_TYPE

26

Hmm. I downloaded the OpenWRT files from the BPR4 firmware page,

https://firmware-selector.openwrt.org/?version=25.12.3&target=mediatek%2Ffilogic&id=bananapi_bpi-r4

I will try the previous release and see if this solves the issue, if indeed it is the firmware.

27

What I meant only involves bl2. So it would be enough to overwrite that only. See if it helps if you find one that has 128MB Nand instead of 256GB.