The binary build for Windows/Linux/MacOS of the promised utility is available on the release page:
mtk_uartboot can start a BL2 via bootrom recovery before bootrom tries anything on the flash.
With a purposely built BL2 to load FIP from serial, we can bypass the broken BL2/FIP on the flash and boot into OpenWrt.
The BL2 needs to be built with two extra arguments:
BOOT_DEVICE=ram RAM_BOOT_UART_DL=1
Here's one built with Github Action which should work on E8450:
bl2-mt7622-1ddr-ram.bin
Here's the usage:
Get the special BL2 built above, and the old FIP image:
openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
Do not use the new UBI-layout one from snapshots for recovery on old OpenWrt install or you may damage the wifi calibration data!
(I didn't verify whether the UBI FIP would break old eeprom but let's be cautious until someone checks that.)
Close any terminal software that might be using the serial port, disconnect the power to the router, connect your serial cable to the router and launch the utility:
/mtk_uartboot -p bl2-mt7622-1ddr-ram.bin -a -f openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
It should print this:
mtk_uartboot - 0.1.0
Using serial port: /dev/ttyUSB0
Handshake...
It automatically uses the first serial it finds, but if that's incorrect, restart the utility with -s <serial_port> argument, where <serial_port> is the name or path to your adapter. e.g. /dev/tty* on Linux, COM* on Windows, or /dev/cu.usbserial-*. (Thanks @_FailSafe !)
After the utility is launched with the correct serial port, power-on the router, and the utility should immediately start printing like this:
hw code: 0x7622
hw sub code: 0x8a00
hw ver: 0xcb00
sw ver: 0x100
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x2f4e
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE: BL2: v2.10.0 (release):v2.4-rc0-5845-gbacca82a8
NOTICE: BL2: Built : 11:44:01, Jan 18 2024
NOTICE: WDT: Cold boot
NOTICE: CPU: MT7622
NOTICE: WDT: disabled
NOTICE: Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE: Received FIP [size] @ 0x40400000 ...
==================================
and after the FIP is sent, you should be booting into your old OpenWrt install.
If it stuck at handshake or throws weird errors like Operation timed out, you can try with different USB-UART adapters. The cheap WCH CH34X works for me every time. But my fake FT232R doesn't work sometimes.
You'll need to boot the router with this utility on every reboot until you re-flashed BL2 and FIP.
The recovery procedure can be easier (with less boots over serial) if someone (maybe @daniel ) can build a u-boot FIP with special script to tftpboot the installer directly. I don't own this router so I can't help with this.