[BPI-R3 Mini] How to unbricked NAND and EMMC

Ufuk_Delibas · July 12, 2024, 2:59pm

Do I have to follow those steps because I have the usb fonction now ?

frank-w · July 12, 2024, 3:06pm

i guess this guide is similar…have not tried flashing openwrt yet, so i cannot report from own experience

Ufuk_Delibas · July 12, 2024, 4:01pm

Ok it didn’t work.

And my bootmenu lokk like this.

What do you suggest ?

frank-w · July 12, 2024, 6:19pm

The files i have provided do not have the openwrt specific vars like emmc_write_production

The link in the posting i linked shows manual install in linux

dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5

As you are “only” in uboot you have to convert it to uboot commands

So printing the correct filenames

ls usb 0:1
load usb 0:1 $loadaddr filename
mmc write ...

the problem is that mmc write needs offsets and cannot write to partitions…

one option would be starting a linux-kernel with initrd and doing the linux-steps i linked, or chainloading a openwrt u-boot (load …$uaddr u-boot.bin;go $uaddr) to do the steps manually.

https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/boot/uboot-mediatek/patches/442-add-bpi-r3-mini.patch;h=5409f7fa0de71ed406727c1d53cc5a1e733afdeb;hb=HEAD#l533

i have an initrd here:

you can set it in my uboot with “setenv initrd rootfs.cpio.zst” and running newboot

so when all files on usb basicly

run useusb
setenv initrd rootfs.cpio.zst
setenv fit bpi-r3.itb # needs to be a kernel with config for r3mini (you can use a recent bpi-r3.itb from my kernel-repo)
run newboot

Ufuk_Delibas · July 12, 2024, 9:17pm

I get an error.

frank-w · July 13, 2024, 6:15am

what is the output of

printenv bootconf

?

It should show name of this config

github.com

frank-w/BPI-Router-Linux/blob/6.6-main/bpi-r3.its#L95


      
          		};
          		conf-emmc {
          			description = "Boot Linux kernel with EMMC FDT blob";
          			kernel = "kernel-1";
          			fdt = "fdt-base", "fdt-ov-emmc";
          			//ramdisk = "ramdisk-1";
          			hash-1 {
          				algo = "sha1";
          			};
          		};
          		conf-emmc-mini {
          			description = "Boot Linux kernel with R3mini + EMMC FDT blob";
          			kernel = "kernel-1";
          			fdt = "fdt-base-mini", "fdt-ov-emmc";
          			//ramdisk = "ramdisk-1";
          			hash-1 {
          				algo = "sha1";
          			};
          		};
          		conf-sd-nand {
          			description = "Boot Linux kernel with SD+NAND FDT blob";

If not please set it like this (maybe with # before)

Amd you have downloaded bpi-r3.itb from 6.6-main release? Previous images have no r3mini support.

But it is possible that bootconf is overwritten by setbootconf as r3 has a detection of devices…So could you do

printenv setbootconf

And if there is the detection (checkmmc,checkspi) just change it to fixed bootconf

setenv setbootconf 'setenv bootconf "#conf-emmc-mini"'

Ufuk_Delibas · July 14, 2024, 1:43pm

Ok it works.

Do I have to put root as login and follow the link in the posting in a Linux terminal or UART console ?

frank-w · July 14, 2024, 1:55pm

Yes simply use username root…no pw in initrd

Ufuk_Delibas · July 14, 2024, 2:39pm

Ok and do I have to follow those steps on a Linux terminal ?

dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5

frank-w · July 14, 2024, 3:37pm

Yes,it is possible you have to disable boot0 readonly mode first

Ufuk_Delibas · July 14, 2024, 11:20pm

I think I did it. I just follow your guide for the BPI R3.

Ufuk_Delibas · July 14, 2024, 11:51pm

Now its asking me to do tftp for the recovery file but it dosn’t work.

frank-w · July 15, 2024, 5:31am

I cannot help much with openwrt specific stuff,but it looks it loads something from mmc first without error…only has error with the leds (missing config option in uboot?). You can try adding the uboot option to uboot (but i do not know how).

OCCaGO · January 23, 2025, 2:04am

Hello, can not flash nand or emmc, there is no even nand device listed by lsblk. But i have a programmer. Has anyone dump for bpi r3 mini, please?

Manivannan_Maran · August 18, 2025, 6:37pm

Hello, Frank-W

I have a Banana Pi R3 Mini (MT7986 SoC) that is now bricked. The problem started when I switched the boot source between eMMC and SNAND.

Now, when powering on, the serial log always stops at:


F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 0000 0000 [0200]
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 016F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):
NOTICE:  BL2: Built : 20:16:38, May  7 2023
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (1998MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 2048MB
NOTICE:  EMI: complex R/W mem test passed
ERROR:   BL2: Failed to load image id 3 (-2)

The board has no SD card slot, only SNAND + eMMC + USB.
I tried to force USB Boot (BootROM) with mtkclient by holding the reset button while powering on, but there is no BootROM handshake.
The device always tries to boot SNAND/eMMC instead of entering BootROM.

I have access to:

Serial console (Waveshare FT232/CH343 USB-TTL).
mtkclient installed on PC.

I need your help to:

Force the board into BootROM mode (USB/UART download) — maybe via DIP switch, jumper, or shorting boot strap pins.
Reflash U-Boot / BL2 into SNAND or eMMC so the board can boot again.
Confirm if recovery via UART (X/Ymodem transfer) is possible if BootROM is not accessible.

Thank you.

frank-w · August 18, 2025, 6:46pm

The uartboot should work independ of bootswitch position.

You need a bl2 and fip for ramboot (you can find them in releases page of my uboot repo) and the mtk_uartboot binary (i have only tested in linux).

https://wiki.fw-web.de/doku.php?id=en:bpi-r3mini:start#fix_bricked_boot

Just start the mtk_uartboot application with parameters pointing to ram bl2+fip and then poweron your r3mini.

After mtk_uartboot exits start minicom or your preferered uart application on same device and you should have uboot console.

There you can reinstall your preferered os.

Manivannan_Maran · August 31, 2025, 2:18pm

Hello Frank-W,

I have a Banana Pi R3 Mini (MT7986 SoC) that is currently not booting properly. The problem started after switching the boot source between eMMC and SPI NAND.

I have mtk_uartboot working to load BL2 + FIP into RAM. Using this, I can reach the U-Boot console via serial.

However, when attempting to boot the board, the serial log shows the following BL2 error:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 021F [010F]
Jump to BL

NOTICE:  BL2: v2.13.0(release): OpenWrt v2025.07.11~78a0dfd9-1 (mt7986-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 19:55:48, Aug 14 2025
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 2048MB
NOTICE:  complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  UBI: scanning [0x200000 - 0x8000000] ...
NOTICE:  UBI: Bad VID magic in block 12 54000090
NOTICE:  UBI: Bad VID magic in block 13 4c520294
NOTICE:  UBI: Bad VID magic in block 14 e01f40f9
NOTICE:  UBI: Bad VID magic in block 15 2540052a
NOTICE:  UBI: Bad VID magic in block 16 ff0300b9
NOTICE:  UBI: Bad VID magic in block 17 fd7bc3a8
NOTICE:  UBI: Bad VID magic in block 18 00000000
NOTICE:  UBI: Bad VID magic in block 19 65747279
NOTICE:  UBI: Bad VID magic in block 20 00000000
NOTICE:  UBI: Bad EC magic in block 21 ffffffff
NOTICE:  UBI: Bad EC magic in block 22 ffffffff
NOTICE:  UBI: Bad EC magic in block 23 ffffffff
NOTICE:  UBI: Bad EC magic in block 24 ffffffff
NOTICE:  UBI: Bad EC magic in block 25 ffffffff
NOTICE:  UBI: Bad EC magic in block 26 ffffffff
NOTICE:  UBI: Bad EC magic in block 27 ffffffff
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   io_dev_init failed for FIP image id 0 (-2)
ERROR:   Image id 3 open failed with -2
ERROR:   BL2: Failed to load image id 3 (-2)

I have attempted to write the OpenWrt SNAND image via U-Boot using RAM-loaded commands, but the board still fails to boot.

Could you please advise:

How to properly install OpenWrt on SNAND using RAM-loaded U-Boot.
Any necessary steps for creating/formatting UBI volumes on SPI NAND before flashing.
If there is a recommended sequence of writing BL2/FIP and OpenWrt images to ensure the board boots correctly.

Thank you for your guidance.

frank-w · August 31, 2025, 3:06pm

Your ubi does not have a partition with fip label

UBI error: No volume named fip could be found

As i do not use openwrt i have no exact instructions to write.

Creating ubi from uboot is bit complex,so better bootup an kernel with initrd (for example from my kernel and buildroot repo)

Bpi-r3.itb with bootconf conf-emmc-mini (bootm $loadaddr#conf-emmc-mini)

This is how i did for my image on R4

https://wiki.fw-web.de/doku.php?id=en:bpi-r4:start#ubi

This is for openwrt

github.com

openwrt/openwrt/blob/main/package/boot/uboot-mediatek/patches/442-add-bpi-r3-mini.patch#L344


      
          +part_default=production
          +part_recovery=recovery
          +reset_factory=mw $loadaddr 0xff 0x1f000 ; ubi write $loadaddr ubootenv 0x1f000 ; ubi write $loadaddr ubootenv2 0x1f000 ; ubi remove rootfs_data
          +snand_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr 0x0 0x40000 && mtd write bl2 $loadaddr 0x40000 0x40000 && mtd write bl2 $loadaddr 0x80000 0x40000 && mtd write bl2 $loadaddr 0xc0000 0x40000
          +ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x1f000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x1f000 dynamic
          +ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
          +ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
          +ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
          +ubi_read_emmc_install=ubi check emmc_install && ubi read $loadaddr emmc_install
          +ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
          +ubi_write_fip=run ubi_remove_rootfs ; ubi check fip && ubi remove fip ; ubi create fip 0x200000 static ; ubi write $loadaddr fip 0x200000
          +ubi_write_en8811h_fw=ubi check en8811h-fw && ubi remove en8811h-fw ; ubi create en8811h-fw 0x24000 static ; ubi write $loadaddr en8811h-fw 0x24000
          +ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
          +ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
          +_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
          +_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
          +_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
          +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
          --- /dev/null
          +++ b/defenvs/bananapi_bpi-r3-mini_emmc_env
          @@ -0,0 +1,59 @@

I found this here in forum: BPI-R3 Mini NAND Restore - #12 by nino_0

ericwoud · August 31, 2025, 4:07pm

If it helps, there is a way to get into Linux directly with mtk_uartboot, skipping uboot all together…

Also, perhaps it is easier to get emmc booting again first.

Manivannan_Maran · September 8, 2025, 9:12pm

BPi-R3 Mini Full Flashing Workflow — Detailed Guide Tools & Hardware

Essential Hardware

PC / Laptop (Windows or Linux)

USB-TTL serial adapter → UART console (for BL2, U-Boot, and OpenWrt shell)

USB Flash Drive (FAT32 formatted, for USB boot / sysupgrade)

Ethernet cable → PC ↔ BPi-R3 Mini WAN port

Software

Flashing & Console

MTK UART Boot Tool (mtk_uartboot.exe) → load BL2 + FIP into RAM via UART

Serial monitor → PuTTY, Tera Term, minicom → UART console

TFTP server → serve NAND/eMMC images (Windows: tftpd64 / Linux: tftpd-hpa)

Web browser → OpenWrt WebUI flash

Optional

Rufus → format USB flash drive to FAT32

scp / wget / curl → copy files to running OpenWrt shell

Firmware / Image Files

UART → RAM loader

bpi-r3mini_ram_bl2.bin → BL2 Preloader

bpi-r3mini_ram_fip.bin → BL31 + U-Boot FIP

Source: UART Loader Google Drive

Old / Official OpenWrt single-image

mtk-bpi-r3mini-mac80211-NAND-YYYYMMDD-single-image.bin → NAND flash

mtk-bpi-r3mini-mac80211-EMMC-YYYYMMDD-single-image.bin → eMMC flash

Source: Old OpenWrt Google Drive

Latest OpenWrt

openwrt-24.10.2-…-initramfs-recovery.itb → RAM boot for safe sysupgrade

openwrt-24.10.2-…-emmc.img → final sysupgrade for eMMC

Files for eMMC flash via old OpenWrt shell

openwrt-emmc-gpt.bin → GPT partition table

openwrt-emmc-preloader.bin → BL2 / preloader

openwrt-emmc-bl31-uboot.fip → BL31 + U-Boot FIP

Step-by-Step Flashing Workflow A. NAND Single-Image via UART Recovery

Boot BL2 + FIP into RAM

“C:\Program Files\mtk_uartboot\target\release\mtk_uartboot.exe” -s COM3 -p bpi-r3mini_ram_bl2.bin --aarch64 -f bpi-r3mini_ram_fip.bin

Temporary U-Boot console appears in RAM.

Configure U-Boot environment

setenv serverip 192.168.1.13 setenv ipaddr 192.168.1.1 setenv loadaddr 0x46000000 saveenv

Load NAND single-image via TFTP

tftpboot ${loadaddr} mtk-bpi-r3mini-mac80211-NAND-YYYYMMDD-single-image.bin

Prepare NAND

ubi detach mtd erase bl2 mtd erase factory mtd erase fip mtd erase ubi

Write the single-image

mtd write spi-nand0 ${loadaddr} 0 ${filesize}

Verify

mtd read spi-nand0 ${loadaddr} 0 0x10000 md ${loadaddr} 0x40

Reboot

reset

Board boots into OpenWrt NAND.

B. eMMC Single-Image via UART Recovery (Optional if NAND failed)

Boot BL2 + FIP into RAM (if eMMC corrupted) Configure U-Boot network Load eMMC single-image via TFTP Calculate block count and erase eMMC Write image to eMMC Verify Reboot

Board boots directly from eMMC.

C. Flash GPT / BL2 / BL31 via Old OpenWrt Shell (booted from NAND)

Goal: Write GPT, BL2, and BL31 + U-Boot FIP to eMMC without UART loader, using old OpenWrt shell from NAND.

Copy files to /tmp

cd /tmp tftp -g -r openwrt-emmc-gpt.bin 192.168.1.13 tftp -g -r openwrt-emmc-preloader.bin 192.168.1.13 tftp -g -r openwrt-emmc-bl31-uboot.fip 192.168.1.13

Flash GPT table

dd if=/tmp/openwrt-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync fdisk -l /dev/mmcblk0

Flash BL2 / Preloader

echo 0 > /sys/block/mmcblk0boot0/force_ro dd if=/tmp/openwrt-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync echo 1 > /sys/block/mmcblk0boot0/force_ro

Flash BL31 + U-Boot FIP

dd if=/tmp/openwrt-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync

Verify

dd if=/dev/mmcblk0 bs=512 skip=13312 count=2048 of=/tmp/bl31_readback.bin cmp /tmp/bl31_readback.bin /tmp/openwrt-emmc-bl31-uboot.fip

eMMC now bootable, U-Boot runs from eMMC.

D. Sysupgrade via USB → RAM → WebUI (booted from eMMC)

Boot into eMMC U-Boot

Power-cycle the board → board runs U-Boot from eMMC

Load Sysupgrade to RAM from USB

usb start fatload usb 0:1 0x46000000 openwrt-24.10.2-…-emmc.img bootm 0x46000000

Access OpenWrt WebUI

Navigate: System → Backup / Flash Firmware → Flash new firmware

Select the sysupgrade image (already in RAM or uploaded)

Reboot & verify

lsblk df -h

Confirm rootfs and partitions are correct. Acknowledgment Special thanks to Frank-W for the guidance and support during the BPi-R3 Mini flashing workflow.

Note: This guide was AI-assisted in its preparation. If you find any inaccuracies, typos, or procedural errors, please feel free to correct them. The author and contributors appreciate any feedback to improve clarity and safety.