sora:

Device problem occurs on:
Linksys E2000
Version:
LEDE 17.01.5
Steps to reproduce:
Recently, I tried to upgrade my E2000 router to 17.01.5 from 17.01.4, but it fails to boot. The kernel freezes after "[ 1.079877] Freeing unused kernel memory: 188K", the serial console dmesg information below:
Programming...done. 3739648 bytes written
Check CRC of image1
Len: 0x391000 (3739648) (0xBC040000)
Offset0: 0x1C (28) (0xBC04001C)
Offset1: 0x924 (2340) (0xBC040924)
Offset2: 0x127C00 (1211392) (0xBC167C00)
Header CRC: 0x3CD1BFBF
Calculate CRC: 0x3CD1BFBF
Image 1 is OK
Try to load image 1.
CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3864 bytes read

Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[ 0.000000] Linux version 4.4.140 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Fri Jul 13 19:25:14 2018
[ 0.000000] CPU0 revision is: 00019740 (MIPS 74Kc)
[ 0.000000] bcm47xx: Using bcma bus
[ 0.000000] bcma: bus0: Found chip with id 0x4716, rev 0x01 and package 0x09
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] HighMem empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: noinitrd console=ttyS0,115200
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 28388K/32768K available (3006K kernel code, 139K rwdata, 368K rodata, 188K init, 294K bss, 4380K reserved, 0K cma-reserved, 0K highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:128
[ 0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x1F, class 0x0)
[ 0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x11, class 0x0)
[ 0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x00, class 0x0)
[ 0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x01, class 0x0)
[ 0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x04, class 0x0)
[ 0.000000] bcma: bus0: Core 5 found: PCIe (manuf 0x4BF, id 0x820, rev 0x0E, class 0x0)
[ 0.000000] bcma: bus0: Core 6 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x01, class 0x0)
[ 0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x07, class 0x0)
[ 0.000000] bcma: bus0: Core 8 found: I2S (manuf 0x4BF, id 0x834, rev 0x00, class 0x0)
[ 0.000000] bcma: bus0: Found M25P64 serial flash (size: 8192KiB, blocksize: 0x10000, blocks: 128)
[ 0.000000] bcma: bus0: Early bus registered
[ 0.000000] MIPS: machine is Linksys E2000 V1
[ 0.000000] bcm47xx: Setting up vectored interrupts
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 10798081617 ns
[ 0.000020] sched_clock: 32 bits at 177MHz, resolution 5ns, wraps every 12132675581ns
[ 0.000109] Calibrating delay loop... 176.53 BogoMIPS (lpj=882688)
[ 0.070062] pid_max: default: 32768 minimum: 301
[ 0.070386] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.070427] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.075432] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.075502] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.077078] NET: Registered protocol family 16
[ 0.078382] Can't analyze schedule() prologue at 800077c8
[ 0.103997] clocksource: Switched to clocksource MIPS
[ 0.106695] NET: Registered protocol family 2
[ 0.108779] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.108854] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.108905] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.109114] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.109179] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.109744] NET: Registered protocol family 1
[ 0.174175] bcma: bus0: PCIEcore in host mode found
[ 0.174199] bcma: bus0: This PCIE core is disabled and not working
[ 0.176094] bcma: bus0: Bus registered
[ 0.177860] Crashlog allocated RAM at address 0x1f00000
[ 0.219991] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.220033] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.226594] io scheduler noop registered
[ 0.226640] io scheduler deadline registered (default)
[ 0.227125] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.233654] console [ttyS0] disabled
[ 0.253970] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[ 0.701827] console [ttyS0] enabled
[ 0.729337] 6 bcm47xxpart partitions found on MTD device bcm47xxsflash
[ 0.736082] Creating 6 MTD partitions on "bcm47xxsflash":
[ 0.741607] 0x000000000000-0x000000040000 : "boot"
[ 0.752006] 0x000000040000-0x0000007f0000 : "firmware"
[ 0.761309] 0x0000007f0000-0x000000800000 : "nvram"
[ 0.770305] 0x00000004001c-0x000000040924 : "loader"
[ 0.779403] 0x000000040924-0x000000167c00 : "linux"
[ 0.788495] 0x000000167c00-0x0000007f0000 : "rootfs"
[ 0.797620] mtd: device 5 (rootfs) set to be root filesystem
[ 0.803445] 1 squashfs-split partitions found on MTD device rootfs
[ 0.809896] 0x000000390000-0x0000007f0000 : "rootfs_data"
[ 0.823599] libphy: Fixed MDIO Bus: probed
[ 0.828246] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[ 0.838253] libphy: bcma_mdio mii bus: probed
[ 0.842742] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[ 1.001205] b53_common: found switch: BCM53115, rev 8
[ 1.008180] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[ 1.014819] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[ 1.025508] NET: Registered protocol family 10
[ 1.037913] NET: Registered protocol family 17
[ 1.042628] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 1.055588] 8021q: 802.1Q VLAN Support v1.8
[ 1.071003] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 1.079877] Freeing unused kernel memory: 188K

I tried to fix the problem by clear nvram//flash back to stock firmware then flash 17.01.5//standard-squashfs.trx but none of them works, the problem is still..

But if I downupgrade back to 17.01.4, it works..

bug firmware involved:
https://downloads.openwrt.org/releases/17.01.5/targets/brcm47xx/mips74k/linksys-e2000-v1-squashfs.bin 80c51af0991489d910c260896f47c47e29d912d0e05410489f906bf4f55dcbb4