Linksys E8450 failed to boot after reboot

I flashed openwrt (UBI) in two routers of the same model (Linksys E8450) and they worked well for around 4 to 5 months until one router suddenly failed (OKOD). The other router still working well.

First attempt using serial connection I was able to boot openwrt and access via Luci but messed up by flashing recovery. This is where I am now, its stuck at "Loading". I need help from the experts if anything can be done to recover. Appreciate if the steps are given. Thanks.

    ( ( ( OpenWrt ) ) )       U-Boot 2024.01-OpenWrt-r25978-ea609fe486 (Apr 
      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from flash.
      4. Boot recovery system from flash.
      5. Load production system via TFTP then write to flash.
      6. Load recovery system via TFTP then write to flash.
      7. Load BL31+U-Boot FIP via TFTP then write to flash.
      8. Load BL2 preloader via TFTP then write to flash.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip'.
Load address: 0x48000000
Loading: *
ARP Retry count exceeded; starting again
Press ENTER to return to menu Using ethernet@1b100000 device

        ( ( ( OpenWrt ) ) )       U-Boot 2024.01-OpenWrt-r25978-ea609fe486 (Apr 
      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from flash.
      4. Boot recovery system from flash.
      5. Load production system via TFTP then write to flash.
      6. Load recovery system via TFTP then write to flash.
      7. Load BL31+U-Boot FIP via TFTP then write to flash.
      8. Load BL2 preloader via TFTP then write to flash.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
ubi0 error: scan_peb: bad image sequence number 396298369 in PEB 20, expected 794684215
Erase counter header dump:
        magic          0x55424923
        version        1
        ec             5
        vid_hdr_offset 2048
        data_offset    4096
        image_seq      396298369
        hdr_crc        0x4a90466
erase counter header hexdump:
00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 05 00 00 08 00 00 00 10 00 17 9f 08 81 00 00 00 00  UBI#............................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 a9 04 66  ...............................f
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd2, error -22
UBI error: cannot attach mtd2
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)
Error, no UBI device selected!
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Error, no UBI device selected!
Error, no UBI device selected!
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Error, no UBI device selected!
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb'.
Load address: 0x48000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@1b100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb'.
Load address: 0x48000000
Loading: *

If I'm reading this right, it's acting as if it can't find the UBI partition where it is supposed to be in the flash layout. This is very alarming, since that version of U-Boot should not be present on the device unless it itself is stored within the UBI space. By any chance did you flash the new (snapshot) bl2 and/or bl3.1/u-boot directly from the u-boot boot menu while your device had been partitioned for the stable 23.05.x or older OpenWRT firmware? If so, then that's your problem. A few months back, a new version of the bootloader was released and it requires an entirely new partitioning of the flash memory. If either the OpenWRT image expecting that bootloader or that bootloader gets flashed without the proper partitioning and data realignment having been completed first, it renders the device unbootable. First question: If this is indeed what you did, then did you previously take a backup of your factory partition? You're most likely going to need it to recover from this.

1 Like

This was first when I am still able to boot using serial connection.

F0: 102B 0000                                                                   
F6: 0000 0000                                                                   
V0: 0000 0000 [0001]                                                            
00: 0000 0000                                                                   
BP: 0400 0041 [0000]                                                            
G0: 1190 0000                                                                   
T0: 0000 02D4 [000F]                                                            
Jump to BL                                                                      
                                                                                
NOTICE:  BL2: v2.9(release):OpenWrt v2023-07-24-00ac6db3-2 (mt7622-snand-1ddr)  
NOTICE:  BL2: Built : 21:45:35, Oct  9 2023                                     
NOTICE:  CPU: MT7622                                                            
NOTICE:  WDT: Cold boot                                                         
NOTICE:  WDT: disabled                                                          
NOTICE:  SPI-NAND: FM35Q1GA (128MB)                                             
ERROR:   BL2: Failed to load image id 5 (-2)  

This was after I messed up

mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7622
hw sub code: 0x8a00
hw ver: 0xcb00
sw ver: 0x100
Baud rate set to 115200
sending payload to 0x201000...
Checksum: 0xdac6
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.4-rc0-5845-gbacca82a8
NOTICE:  BL2: Built : 19:21:54, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  CPU: MT7622
NOTICE:  WDT: disabled
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xf7354 @ 0x40400000 ...
==================================

I have the sysupgrade from openwrt firmware selector, sysupgrade from github as well as the recovery installer ( Releases ยท dangowrt/owrt-ubi-installer (github.com). But I can't remember exactly which one I flashed to make it worse.

"If this is indeed what you did, then did you previously take a backup of your factory partition? You're most likely going to need it to recover from this."

I have couple of backups, probably the right one. In case if it's not the right backup, can I get a backup from my working router and use it?

If it's the right backup, how can I use it to recover?

We might be able to recover the data, but no guarantees. If you have it backed up from before, it's much safer to start with that since it's known good. It's possible that the data on the router has already been partially or fully overwritten, thanks to the differing data layout and shifted offsets.

I recognize that you're not sure which installer you used. Can you at least say whether it was v1.0.3 or earlier? If it was running OpenWRT 23.05.x stable or a snapshot from prior to 2024, then the answer is most likely yes.

Some hope here. Mine was 23.05.2 prior to brick. The sysupgrade i downloaded (probably used) was from the openwrt firmware selector, 23.05.03, not the snapshot.

Appreciate if you can help to state the steps in order to recover.

ok! Then let's cross our fingers and hope that nothing has been overwritten, and what was included above is nothing more than having accidentally selected the wrong file for recovery. That said, we'll start with the standard OKD recovery procedure since it's the easiest and fastest. Here's what you'll need:

  • mtk_uartboot and its bl2-for-mtk_uartboot.bin file (I think you already have this)
  • From the OpenWRT firmware selector site, we need the bl31-uboot.fip file for 23.05.3.
  • an installed copy of puTTY as a serial terminal

Once you have the above, follow the steps from https://openwrt.org/toh/linksys/e8450?s[]=linksys&s[]=e8450&s[]=ubi#recovery_from_openwrt_kiss_of_death_okd that are marked with the heading of 'did not run the v1.1.1 UBI installer'
In other words, make sure your newly acquired .fip is in the same folder as mtk_uartboot.
Open up a command window.
In the command window, switch to the folder containing your mtk_uartboot, its bl2, and the new .fip.
From there, issue the command:

mtk_uartboot -a -s COM3 -p bl2-for-mtk_uartboot.bin -f openwrt-23.05.3-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip && putty.exe -serial COM3 -sercfg 115200,8,n,1,N

Note that in the above command, I'm assuming your serial adapter is still COM3 as that is what you used previously.
Once the command has completed and the serial terminal window has opened, you want to select U-Boot Console from the menu presented either by using the arrow keys or with the letter to the left of the option. Please keep in mind that there is a time limit for this operation, so it needs to be done quickly after the window opens.

From the U-Boot console, issue the commands:

mtd read fip $loadaddr 0x0 0x140000 && mtd write fip $loadaddr 0x0 0x140000

Once the command has completed, please copy the results here.

This is the result

MT7622> mtd read fip $loadaddr 0x0 0x140000 && mtd write fip $loadaddr 0x0 0x140000
Reading 1310720 byte(s) (640 page(s)) at offset 0x00000000
Writing 1310720 byte(s) (640 page(s)) at offset 0x00000000
MT7622>

So far so good. Now, we can see if this was simply an issue of OKD. You can now issue the 'reset' command and we can see if it boots successfully. If it does, you'll want to check and make sure that it's not in recovery mode and that the MAC addresses for the wifi and ethernet are correct. If it doesn't boot, please provide the error that comes up on the serial console. Additionally, if it doesn't boot, now would be the time to find that backup file.

It's attempting boot but

        ( ( ( OpenWrt ) ) )       U-Boot 2023.07.02-OpenWrt-r23809-234f1a2efa (M
      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from flash.
      4. Boot recovery system from flash.
      5. Load production system via TFTP then write to flash.
      6. Load recovery system via TFTP then write to flash.
      7. Load BL31+U-Boot FIP via TFTP then write to flash.
      8. Load BL2 preloader via TFTP then write to flash.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
UBI partition 'ubi' already selected
No size specified -> Using max size (10285056)
Read 10285056 bytes from volume fit to 0000000048000000

## Checking Image at 48000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-6.1.79
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x48001000
     Data Size:    5741025 Bytes = 5.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   9ec3705d
     Hash algo:    sha1
     Hash value:   4010bd2bb643ab1843fdf7018d6e6b6c45eb6513
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt linksys_e8450-ubi device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4857b000
     Data Size:    31412 Bytes = 30.7 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   af97354e
     Hash algo:    sha1
     Hash value:   9d4ed8f8a9e9781c422a7dad68464d4dbbba45de
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt linksys_e8450-ubi rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x48583000
     Data Size:    4386816 Bytes = 4.2 MiB
     Hash algo:    crc32
     Hash value:   46b1ef0d
     Hash algo:    sha1
     Hash value:   b81de205ec5e60fea2c280b6be96e046b0606dc9
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt linksys_e8450-ubi
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 48000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
   Hash(es) for Image 2 (rootfs-1): crc32+ sha1+
## Loading kernel from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.1.79
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x48001000
     Data Size:    5741025 Bytes = 5.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   9ec3705d
     Hash algo:    sha1
     Hash value:   4010bd2bb643ab1843fdf7018d6e6b6c45eb6513
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4857b000
     Data Size:    31412 Bytes = 30.7 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   af97354e
     Hash algo:    sha1
     Hash value:   9d4ed8f8a9e9781c422a7dad68464d4dbbba45de
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4857b000
Working FDT set to 4857b000
## Loading loadables from FIT Image at 48000000 ...
   Trying 'rootfs-1' loadables subimage
     Description:  ARM64 OpenWrt linksys_e8450-ubi rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x48583000
     Data Size:    4386816 Bytes = 4.2 MiB
     Hash algo:    crc32
     Hash value:   46b1ef0d
     Hash algo:    sha1
     Hash value:   b81de205ec5e60fea2c280b6be96e046b0606dc9
   Verifying Hash Integrity ... crc32+ sha1+ OK

Error: ethernet@1b100000 address ff:ff:ff:ff:ff:ff illegal value
   Uncompressing Kernel Image
   Loading Device Tree to 000000005e7e3000, end 000000005e7edab3 ... OK
Working FDT set to 5e7e3000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.1.79 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r25361-a86ff06d2e) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Fri Mar  1 01:42:36 2024
[    0.000000] Machine model: Linksys E8450 (UBI)
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.4
[    0.000000] percpu: Embedded 18 pages/cpu s33896 r8192 d31640 u73728
[    0.000000] pcpu-alloc: s33896 r8192 d31640 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512 ubi.block=0,fit root=/dev/fit0
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 500636K/524288K available (8768K kernel code, 910K rwdata, 2480K rodata, 448K init, 310K bss, 23652K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 80ns, wraps every 4398046511080ns
[    0.008279] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.018679] pid_max: default: 32768 minimum: 301
[    0.023594] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.030942] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.039984] cblist_init_generic: Setting adjustable number of callback queues.
[    0.047274] cblist_init_generic: Setting shift to 1 and lim to 1.
[    0.053517] rcu: Hierarchical SRCU implementation.
[    0.058329] rcu:     Max phase no-delay instances is 1000.
[    0.064069] smp: Bringing up secondary CPUs ...
[    0.069009] Detected VIPT I-cache on CPU1
[    0.069020] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x00000000bebc20, CPU1: 0x00000000000000
[    0.069043] CPU features: Unsupported CPU feature variation detected.
[    0.069123] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.069194] smp: Brought up 1 node, 2 CPUs
[    0.102118] SMP: Total of 2 processors activated.
[    0.106834] CPU features: detected: 32-bit EL0 Support
[    0.111990] CPU features: detected: CRC32 instructions
[    0.117170] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.125557] CPU: All CPU(s) started at EL2
[    0.129661] alternatives: applying system-wide alternatives
[    0.139969] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.149865] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.156810] pinctrl core: initialized pinctrl subsystem
[    0.162988] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.169267] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.176384] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.184175] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.192581] thermal_sys: Registered thermal governor 'fair_share'
[    0.192587] thermal_sys: Registered thermal governor 'bang_bang'
[    0.198699] thermal_sys: Registered thermal governor 'step_wise'
[    0.204733] thermal_sys: Registered thermal governor 'user_space'
[    0.210836] ASID allocator initialised with 65536 entries
[    0.222773] pstore: Registered ramoops as persistent store backend
[    0.228980] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.254728] cryptd: max_cpu_qlen set to 1000
[    0.260454] SCSI subsystem initialized
[    0.264419] libata version 3.00 loaded.
[    0.269661] clocksource: Switched to clocksource arch_sys_counter
[    0.276530] NET: Registered PF_INET protocol family
[    0.281604] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.289525] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.297940] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.305722] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.313530] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.320879] TCP: Hash tables configured (established 4096 bind 4096)
[    0.327356] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.333930] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.341093] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.346795] PCI: CLS 0 bytes, default 64
[    0.351944] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.362203] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.368069] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.410333] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.419159] mt7622-pinctrl 10211000.pinctrl: invalid group "pwm_ch7_2" for function "pwm"
[    0.432165] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    0.454758] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.463641] printk: console [ttyS0] disabled
[    0.488105] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 118, base_baud = 1562500) is a ST16650V2
[    0.497436] printk: console [ttyS0] enabled
[    0.497436] printk: console [ttyS0] enabled
[    0.505810] printk: bootconsole [uart8250] disabled
[    0.505810] printk: bootconsole [uart8250] disabled
[    0.536436] 11004000.serial: ttyS1 at MMIO 0x11004000 (irq = 119, base_baud = 1562500) is a ST16650V2
[    0.547042] mtk_rng 1020f000.rng: registered RNG driver
[    0.547206] random: crng init done
[    0.560208] loop: module loaded
[    0.563560] Loading iSCSI transport class v2.0-870.
[    0.569877] mtk-ecc 1100e000.ecc: probed
[    0.577400] spi-nand spi2.0: Fidelix SPI NAND was found.
[    0.582774] spi-nand spi2.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.590951] mtk-snand 1100d000.spi: ECC strength: 4 bits per 512 bytes
[    0.597809] 2 fixed-partitions partitions found on MTD device spi2.0
[    0.604204] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    0.610520] OF: Bad cell count for /spi@1100d000/flash@0/partitions
[    0.617029] Creating 2 MTD partitions on "spi2.0":
[    0.621832] 0x000000000000-0x000000080000 : "bl2"
[    0.627628] 0x000000080000-0x000008000000 : "ubi"
[    0.764354] ubi0: default fastmap pool size: 50
[    0.768893] ubi0: default fastmap WL pool size: 25
[    0.773702] ubi0: attaching mtd1
[    0.782653] ubi0 error: scan_peb: bad image sequence number 396298369 in PEB 20, expected 794684215
[    0.791720] Erase counter header dump:
[    0.795459]  magic          0x55424923
[    0.799198]  version        1
[    0.802162]  ec             5
[    0.805119]  vid_hdr_offset 2048
[    0.808337]  data_offset    4096
[    0.811561]  image_seq      396298369
[    0.815213]  hdr_crc        0x4a90466
[    0.818865] erase counter header hexdump:
[    0.822870] 00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 05 00 00 08 00 00 00 10 00 17 9f 08 81 00 00 00 00  UBI#............................
[    0.836426] 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 a9 04 66  ...............................f
[    0.849986] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22
[    0.991396] i2c_dev: i2c /dev entries driver
[    0.997315] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.007737] NET: Registered PF_INET6 protocol family
[    1.013481] Segment Routing with IPv6
[    1.017162] In-situ OAM (IOAM) with IPv6
[    1.021198] NET: Registered PF_PACKET protocol family
[    1.026274] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.039727] 8021q: 802.1Q VLAN Support v1.8
[    1.045552] pstore: Using crash dump compression: deflate
[    1.063245] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    1.069844] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    1.075679] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    1.346074] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    1.352298] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.357786] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    1.364672] pci_bus 0000:00: scanning bus
[    1.368844] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    1.375038] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    1.385319] pci_bus 0000:00: fixups for bus
[    1.389516] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    1.396232] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.404313] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    1.411453] pci_bus 0000:01: scanning bus
[    1.415619] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    1.421816] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    1.429143] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    1.436473] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    1.444458] pci 0000:01:00.0: supports D1 D2
[    1.448724] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.455363] pci 0000:01:00.0: PME# disabled
[    1.459894] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.499942] pci_bus 0000:01: fixups for bus
[    1.504144] pci_bus 0000:01: bus scan returning with max=01
[    1.509746] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.516384] pci_bus 0000:00: bus scan returning with max=01
[    1.521993] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    1.529666] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    1.537675] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    1.544484] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    1.552333] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    1.560186] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    1.568022] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.573005] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    1.580013] pcieport 0000:00:00.0: assign IRQ: got 130
[    1.585165] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    1.591299] pcieport 0000:00:00.0: enabling bus mastering
[    1.596782] mtk-pcie 1a143000.pcie: msi#0 address_hi 0x0 address_lo 0x44f0d0c0
[    1.604318] pcieport 0000:00:00.0: PME: Signaling with IRQ 130
[    1.610346] pcieport 0000:00:00.0: saving config space at offset 0x0 (reading 0x325814c3)
[    1.618537] pcieport 0000:00:00.0: saving config space at offset 0x4 (reading 0x100006)
[    1.626574] pcieport 0000:00:00.0: saving config space at offset 0x8 (reading 0x6040000)
[    1.634682] pcieport 0000:00:00.0: saving config space at offset 0xc (reading 0x10000)
[    1.642611] pcieport 0000:00:00.0: saving config space at offset 0x10 (reading 0xc)
[    1.650279] pcieport 0000:00:00.0: saving config space at offset 0x14 (reading 0x0)
[    1.657936] pcieport 0000:00:00.0: saving config space at offset 0x18 (reading 0x40010100)
[    1.666212] pcieport 0000:00:00.0: saving config space at offset 0x1c (reading 0x4200000)
[    1.674401] pcieport 0000:00:00.0: saving config space at offset 0x20 (reading 0x20102000)
[    1.682684] pcieport 0000:00:00.0: saving config space at offset 0x24 (reading 0x0)
[    1.690353] pcieport 0000:00:00.0: saving config space at offset 0x28 (reading 0x0)
[    1.698011] pcieport 0000:00:00.0: saving config space at offset 0x2c (reading 0x0)
[    1.705679] pcieport 0000:00:00.0: saving config space at offset 0x30 (reading 0x0)
[    1.713346] pcieport 0000:00:00.0: saving config space at offset 0x34 (reading 0x50)
[    1.721105] pcieport 0000:00:00.0: saving config space at offset 0x38 (reading 0x0)
[    1.728764] pcieport 0000:00:00.0: saving config space at offset 0x3c (reading 0x20182)
[    1.737603] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    1.744212] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    1.750074] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    2.089742] mtk-pcie 1a145000.pcie: Port1 link down
[    2.094828] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    2.101047] pci_bus 0001:00: root bus resource [bus 00-ff]
[    2.106536] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    2.113417] pci_bus 0001:00: scanning bus
[    2.118941] pci_bus 0001:00: fixups for bus
[    2.123136] pci_bus 0001:00: bus scan returning with max=00
[    2.129618] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    2.391225] OF: ERROR: Bad of_node_put() on /wed@1020a000
[    2.396666] CPU: 1 PID: 34 Comm: kworker/u4:1 Tainted: G S                 6.1.79 #0
[    2.404420] Hardware name: Linksys E8450 (UBI) (DT)
[    2.409299] Workqueue: events_unbound deferred_probe_work_func
[    2.415156] Call trace:
[    2.417600]  dump_backtrace.part.0+0xb8/0xc4
[    2.421887]  show_stack+0x14/0x20
[    2.425212]  dump_stack_lvl+0x60/0x78
[    2.428884]  dump_stack+0x14/0x2c
[    2.432208]  of_node_release+0x13c/0x140
[    2.436147]  kobject_put+0xa4/0xf0
[    2.439555]  of_node_put+0x14/0x20
[    2.442970]  mtk_wed_exit+0x4c/0xf0
[    2.446466]  mtk_probe+0x894/0x10b0
[    2.449969]  platform_probe+0x64/0xbc
[    2.453646]  really_probe+0xb8/0x2d0
[    2.457231]  __driver_probe_device+0x74/0x110
[    2.461598]  driver_probe_device+0x3c/0x110
[    2.465791]  __device_attach_driver+0xac/0x124
[    2.470246]  bus_for_each_drv+0x64/0xa0
[    2.474090]  __device_attach+0x98/0x18c
[    2.477935]  device_initial_probe+0x10/0x20
[    2.482129]  bus_probe_device+0x94/0x9c
[    2.485974]  deferred_probe_work_func+0x80/0xb4
[    2.490514]  process_one_work+0x210/0x394
[    2.494532]  worker_thread+0x250/0x4b4
[    2.498290]  kthread+0xd4/0xe0
[    2.501350]  ret_from_fork+0x10/0x20
[    2.505310] OF: ERROR: Bad of_node_put() on /wed@1020b000
[    2.510753] CPU: 1 PID: 34 Comm: kworker/u4:1 Tainted: G S                 6.1.79 #0
[    2.518507] Hardware name: Linksys E8450 (UBI) (DT)
[    2.523386] Workqueue: events_unbound deferred_probe_work_func
[    2.529234] Call trace:
[    2.531677]  dump_backtrace.part.0+0xb8/0xc4
[    2.535958]  show_stack+0x14/0x20
[    2.539283]  dump_stack_lvl+0x60/0x78
[    2.542955]  dump_stack+0x14/0x2c
[    2.546277]  of_node_release+0x13c/0x140
[    2.550215]  kobject_put+0xa4/0xf0
[    2.553622]  of_node_put+0x14/0x20
[    2.557037]  mtk_wed_exit+0x4c/0xf0
[    2.560532]  mtk_probe+0x894/0x10b0
[    2.564033]  platform_probe+0x64/0xbc
[    2.567711]  really_probe+0xb8/0x2d0
[    2.571296]  __driver_probe_device+0x74/0x110
[    2.575664]  driver_probe_device+0x3c/0x110
[    2.579858]  __device_attach_driver+0xac/0x124
[    2.584312]  bus_for_each_drv+0x64/0xa0
[    2.588155]  __device_attach+0x98/0x18c
[    2.592002]  device_initial_probe+0x10/0x20
[    2.596196]  bus_probe_device+0x94/0x9c
[    2.600040]  deferred_probe_work_func+0x80/0xb4
[    2.604580]  process_one_work+0x210/0x394
[    2.608599]  worker_thread+0x250/0x4b4
[    2.612355]  kthread+0xd4/0xe0
[    2.615415]  ret_from_fork+0x10/0x20
[    2.619932] UBI: auto-attach mtd1
[    2.623272] ubi0: default fastmap pool size: 50
[    2.627794] ubi0: default fastmap WL pool size: 25
[    2.632589] ubi0: attaching mtd1
[    2.641585] ubi0 error: scan_peb: bad image sequence number 396298369 in PEB 20, expected 794684215
[    2.650656] Erase counter header dump:
[    2.654395]  magic          0x55424923
[    2.658135]  version        1
[    2.661100]  ec             5
[    2.664059]  vid_hdr_offset 2048
[    2.667277]  data_offset    4096
[    2.670501]  image_seq      396298369
[    2.674154]  hdr_crc        0x4a90466
[    2.677806] erase counter header hexdump:
[    2.681814] 00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 05 00 00 08 00 00 00 10 00 17 9f 08 81 00 00 00 00  UBI#............................
[    2.695371] 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 a9 04 66  ...............................f
[    2.708936] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22
[    2.716043] UBI error: cannot attach mtd1
[    2.721094] /dev/root: Can't open blockdev
[    2.725200] VFS: Cannot open root device "fit0" or unknown-block(0,0): error -6
[    2.732518] Please append a correct "root=" boot option; here are the available partitions:
[    2.740886] 1f00             512 mtdblock0
[    2.740892]  (driver?)
[    2.747413] 1f01          130560 mtdblock1
[    2.747417]  (driver?)
[    2.753947] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.762201] SMP: stopping secondary CPUs
[    2.766115] Kernel Offset: disabled
[    2.769593] CPU features: 0x00000,00400000,0000400b
[    2.774462] Memory Limit: none
[    2.781494] Rebooting in 1 seconds..

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02D3 [000F]
Jump to BL

NOTICE:  BL2: v2.9(release):OpenWrt v2023-07-24-00ac6db3-2 (mt7622-snand-1ddr)
NOTICE:  BL2: Built : 21:45:35, Oct  9 2023
NOTICE:  CPU: MT7622
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
ERROR:   BL2: Failed to load image id 3 (-2)

Ok, so now we can at least see where some things are. The image installed has been updated to something too new to boot with the old layout.

Reboot the device and go back to the U-Boot console when it gives you the option. When you get there, please show me the results from the command ubi list.

MT7622> ubi list
0: ubootenv
1: ubootenv2
2: fit
MT7622>

Ok, the UBI space is definitely missing a lot of what it needs. Now, issue the command mtd dump factory. You can PM the result to me if you wish, as it does (or should) contain one of the device MAC addresses, assuming the data is valid.

I just sent you that via PM.

Thank you. All right, we know the state of your router. The factory partition does appear to have been at least partially overwritten, so we definitely need that backup file. We also need a copy of the 'kernel' file for version 23.05.3 from the OpenWRT firmware selector.

You're going to need to set up a tftp server on your network or on your computer. In the folder shared by the tftp server, you will need to place both the factory partition backup file and the kernel file downloaded from the OpenWRT website. The tftp server needs to be accessible by the router. By default, the router will have IP 192.168.1.1 and it will expect the tftp server to be at 192.168.1.254. The kernel file should be named openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb and we can leave the factory partition with any name you choose, but I'll refer to it as factory.bin for simplicity.

If necessary, we can change the IPs for the router and the TFTP server. However, doing so will take a few more steps. Are you able to provide the IP addresses that the device expects, or should we proceed with changing the IPs?

When I created the backup I don't have any file with .bin extension. There are few files reside inside the "etc" folder which was originally zipped and called as backup-OpenWrt-2023-11-14.tar.gz. I need to check my the other PC to reconfirm that.

As for the IP's is it alright to left it as 192.168.1.254 for the TFTP and 192.168.1.1 for the router?

The factory partition isn't backed up as part of the luci config backup. Backing up the factory data and factory boot information was a separate step that was strongly suggested on the page where the installer was first run.

As for the IPs, it's perfectly fine to leave them as they are, as long as your computer is able to talk to the router across the network.

Is the backup will look like this because I only done that for the other working router OpenWrt.mtdx.bin

Excellent! That may very well be it. Do you have OpenWrt.mtd2.bin? It should be around 1024k in size.

Yes, I have it. It is OpenWrt.mtd2.bin 1024KB.

Ok, good. We can use that. You said this was from another router of the same type? If so, we'll need to make some changes to it before we can put it on this router. You should also know that the file from a different router will not be properly optimized. This router may not work as well as it did previously. However, if you don't have the file from this router, then this is better than not having one at all. You'll need a hex editor application in order to make the changes.