[BPI-R3 Mini] How to unbricked NAND and EMMC

Banana Pi Router design BPI-R3/R3 Mini(MT7986)
42

Hi Frank,

I’m encountering a problem on the BPI-R3 Mini while trying to back up the BL2 region of the SPI-NAND. When using sf read at any RAM address, the CPU triggers a Synchronous Abort, and the system resets. This happens even when splitting the read into smaller chunks.

Details:

  • Board: BPI-R3 Mini
  • SPI-NAND: Winbond 128 MiB, block 128 KiB, page 2048, OOB 64
  • Crash occurs during sf read 0x40000000 0x000000 0x40000 (and other addresses)
  • Similar behavior may occur on eMMC reads of low-level boot partitions
  • Using mtd read also fails unless careful RAM offsets are chosen

It looks like BL2 and other boot regions are protected or not directly accessible via SF read, and standard RAM addresses trigger a synchronous abort.

Could you advise the recommended procedure to safely back up BL2, FIP, factory, and UBI partitions on SPI-NAND and eMMC without causing CPU resets?

Thank you

43

Use mtd read/write for nand/nor.

Try to use loadaddr of >0x4500000 as ram starts afaik at 0x40000000 and some regmaps (e.g.clock,pinctrl,…) are mapped to this region.

44

Dear Community!

I have bought an BPI-R3 mini, and I want to use it with my own compiled OpenWRT. At this moment, the device has the stock 21.05 SNAPSHOT version on the NAND and something on the EMMC. I have followed the tutorial, and the result is always the same, after the power remove, switch to EMMC boot this screen is welcome me in serial port, after the uboot menu:

image
image1920×1200 130 KB
What do i wrong?

Thank you!

45

So you try to boot mainline openwrt from emmc after installing it with mainline instructions from pre-installed bpi-image on nand,right?

Looks like the fit does not contain the config name which is taken by the script. Either the fit image has changed or the script for booting specific configuration.

You can list your env variables with printenv. For available configurations i only know dumpimage in linux,but no uboot command. Afaik openwrt loads fit image itself from a storage block and not as file from partition you can only try get offset and size of fit from uboot and write this to file after booting linux.

this is the config-name which seems to be taken…but i do not know where openwrt creates the fit which has to include this config

seems like fit is loaded this way:

looks like there is a partition production where all is loaded from and than a fit is extracted from it

fit itself seems to be created from here:

have you a production partition on emmc and executed these steps with the r3mini (not R3) files?

dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
46

I’ve made a mistake at first time. At the first time Unfortunetly i was Inattentive, and i write the simple r3 Images, not the r3-mini. Is it problem? Since then i have wrote the r3-mini Images several time, but the result is the same every time.

47

the fip has to match the sysupgrade/recovery part. so if you flashed complete image for r3 you have to replace at least fip and the files above with r3mini files

you can check what’s in you r uboot environment set, if this is the right bootconf

printenv bootconf

this should be

bootconf=config-mt7986a-bananapi-bpi-r3-mini

if not you have to flash this

dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
48

If i try to boot from EMMC, and enter the command printenv bootconf in the uboot console: image

After I boot from NAND, and type the command:

dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3

image

Power off, EMMC uboot and the result is the same: image

What do i wrong?

49

So it is definitely the fip pointing to the wrong fit config name.

Are you sure you have downloaded the right file and not renamed or such?

50

I haven’t renamed anything. How can I restart the whole procedure from the start? I found the tutorial how can restore the default NAND layout, but nothing about EMMC. Is it possible to restore the default EMMC layout? Here is the EMMC layout now: image

51

What is default? :slight_smile:

Wasn’t there a gpt binary for openwrt?

dd if=/tmp/openwrt-*-r3-mini-emmc-gpt.bin of=/dev/mmcblk0

This should restore partition table after reboot.

52

Default i mean that the firmware i got from factory. 21.05 snapshot, same like on NAND.

In NAND uboot can i write mtk-bpi-r3mini-EMMC-20231115.img?

The command that You offer, is does nothing :frowning: i have done it several times (5-10) or my EMMC is read only or dead

53

I copied the command from the openwrt instructions and you have to reboot after it to see new partitions.

Of course you can write the old bpi image,but then you have no up-to-date openwrt.

54

I want to try the old image. If that isn’t work i need to think again… But how to write the image? To the NAND okay but to the EMMC how?

55

I do not understand? You have the image? Then just bootup linux from nand and flash via dd to mmcblk0

56

dd if=image.img of=/dev/mmcblk0

?

57

Yes,basicly like this

58

Okay! It works! Now I have 21.05-SNAPSHOT on NAND and EMMC too. So lets start again. I boot into NAND, and follow the instructions here, but now the correct images from 24.10.4 downloads: image

59

Thank You very much! Everything is okay, my EMMC has the latest 24.10.4 :slight_smile: In the future, if i want to upgrade i can do it from luci menu with the sysupgrade package right? And how can I use the whole size of EMMC? At this momet I see only this:

image
image1022×1040 33.4 KB

60

You should check your nand again after flashing mainline openwrt. Maybe it breaks it too as downstream openwrt uses the properitary nmbm layer. Consider install openwrt 24.10 to nand too.

For using full emmc size there are many threads here,not sure which way is working but this is a common limitation of openwrt which is tricky to fix due to the filesystem structure (r/o rootfs + squashfs/overlay).

61

If I try to write NAND I got his error:

root@BananaPI_BPI-R3_Mini:/tmp# mtd write /tmp/openwrt-*-bananapi_bpi-r3-mini-sn
and-preloader.bin /dev/mtd0
Could not open mtd device: /dev/mtd0
Can't open device for writing!
root@BananaPI_BPI-R3_Mini:/tmp#

For the resize on OpenWRT x86-64 I use this:

BOOT="$(sed -n -e "\|\s/boot\s.*$|{s///p;q}" /etc/mtab)"
PART="${BOOT##*[^0-9]}"
DISK="${BOOT%${PART}}"
ROOT="${DISK}$((PART+1))"
LOOP="$(losetup -f)"

echo fix | parted -l ---pretend-input-tty
parted -s ${DISK%p} resizepart $((PART+1)) 100%
losetup ${LOOP} ${ROOT}
resize2fs -f ${LOOP}
reboot

In /etc/uci-default/70-rootpt-resize . Could this work here too?