[Solved] WRT3200ACM - Unable to flash LEDE successfully

My router:

----EPROM Manufacturer Data-----
mfg_data_version = 1
modelNumber = WRT3200ACM-EU
hw_version = 48SAM203.0GA
hw_mac_addr = xxx
manufacturer_date = 2017/11/04
serial_number = xxx
uuid_key = xxx
wps_device_pin = xxx

From the beginning I have installed this version of the software:
Firmware Version: 1.0.6.184351
Firmware Builddate: 2017-10-06 08:28
Product.type: production

Why do so many not bother reading the WRT AC Series device Wiki, of which is where one should start, and would have prevented the issues being experienced. The blind leading the blind is never a good idea

  1. First and foremost, there's a reason "It is highly recommended to invest in a USB - TTL cable" is the second bullet in the introduction of the device wiki...

    • While Linksys OEM firmware does not support SSH, serial always is.
  2. Each WRT AC Series router has a specific codename, of which must be what the image is named as if flashing via serial, and since there have been instances where flashing via LuCI when not doing this causes issues, it's best to rename if flashing via LuCI as well.

I would recommend the users with issues start with reading the device wiki, then revisit troubleshooting.

2018.03.02: Updated ToH wiki links to new ToH link (https://openwrt.org/toh/start)

2 Likes

@JW0914 My english is not perfect so I may understand you wrong, this is not about "finding the flash-button" and locating images, this is about getting no working LEDE after flashing it.

For the record, I did read the Wiki entry. What I did not read are the sections about flashing firmware via pins located on the routers board. I am not comfortable with opening the case of a brand new device and voiding its warranty.
The Wiki entry lists numerous images, many of them not longer maintained. The images suitable for flashing seem to be the stable LEDE branch, the daily snapshots and davidc502´s third party OpenWRT build. In the meantime I flashed all of them - no other results than those described above.

Did you get this router on eBay, or was it purchased new from a retail store?

I'm wondering if something else was flashed on partition #1 before you got it...

Even though you don't want DD-WRT, and you have nothing to lose at this point, I wonder if you can flash anything to that partition.

ftp://ftp.dd-wrt.com/betas/2017/12-14-2017-r34080/linksys-wrt3200acm/

(May need to copy and paste the ftp link)

You would select the factory-to-ddwrt.bin file to flash.

If that works, flash the Linksys stock firmware from the DD-WRT web GUI.

Then, try flashing LEDE stable again.

Of which is why a USB-TTL cable, UART, Arduino, or similar is recommended prior to flashing third party firmware, as it's the only way to troubleshoot a corrupted flash or recover a bricked router.

.

  1. There would not be any information provided in a wiki that would void your warranty.
  2. Opening the case DOES NOT void your warranty... Wouldn't it have been wise to read the warranty prior to making such an erroneous assumption?
  3. Linksys advertises the WRT AC Series as opensource ready and purposefully moved the location of the serial header on the board on every iteration following the 1900AC v1 to make it more convenient for those wishing to flash opensource firmware.

.

The non-maintained OpenWrt images on the wiki are clearly delineated as not maintained, and as it says in the wiki, these are not to be utilized (I'm the one who added those warnings to the wiki, just as I am the main maintainer of the WRT AC Series wiki).

  • I contemplated removing the OpenWrt listings (which are all the non-maintained versions), however I left them as placeholders for when the merge is completed since it's easier and more efficient to edit and remove unneeded content than re-adding content (especially if done by another user who hasn't read up on DokuWiki, especially the Wrap plugin, which is used heavily in the formatting of the wiki)

  • All of DavidC's images have been LEDE only for quite some time since OpenWrt has been dead for a year, and it's recommended one check out the Build Info and other links to learn more about his builds.

Until you're able to connect via serial, trying to troubleshoot your issues are pointless since everyone, including yourself, is flying blind with absolutely no way to determine what's occurring on your device.

  • Again, this is why I put it as the second bullet in the Introduction of the wiki that users should invest in a USB-TTL cable, as it's extremely important that anyone flashing 3rd party firmware has a way to access the serial interface.

What can void the warranty (from the PDF warranty detail information - US version)...

This manufacturer's warranty does not apply if:

a) the product assembly seal has been removed or damaged,
b) the product has been altered or modified, except by Linksys
c) the product damage was caused by use with non-Linksys products
d) the product has not been installed, operated, repaired, or maintained
supplied by Linksys,
e) the product has been subjected to abnormal physical or electrical
accident,
f) the serial number on the product has been altered, defaced,
g) the product is supplied or licensed for beta, evaluation, testing

A.) There is no assembly seal on the WRT AC Series routers

  • Again, Linksys intended for the serial header to be used by consumers flashing 3rd party firmware, of which is why they moved it to a more convenient location on all devices after the 1900AC v1

B.) Refers to hardware modifcations
C.) Again, refers to hardware modifications
D.) Again, hardware related
E.) Again, hardware related
F.) Self-explanatory
G.) Self-explanatory

All of this is in the warranty under the definitions category

@JW0914 I have one of these. Using the correct pins it should work, right?
@jwoods It is a new one from a hardware dealer. Flashing DD-WRT was not successful.

You might consider just returning it, since it is advertised to be able to run OpenWrt and DD-WRT.

You're sure it's not the WRT32X router, is it? May want to take pictures of the labels on the router, who knows, maybe Linksys pulled a fast one and did a silent revision update (with different hardware) like some other vendors have done in the past.

Why would one return a product when no one, including @MacKlappstuhl, has any clue what the actual issue is since there has yet to be a connection via serial, of which would allow a serial flash, fixing whatever the issue is.

  • Why is it users are trying to diagnose an issue flying blind when there's no serial connection that has been made? The blind should never be leading the blind...

.
It would take all of 60 seconds to flash both partitions via serial, but I'm sure the inconvenience of returning a working product makes more sense...

.

I'm sure he knows what he has, as the two editions are quite easy to tell apart since one is all black with blue LEDs (WRT32X)

.

Yes, that's a USB to UART.

  • UART Rx pin to router Tx pin
  • UART Tx pin to router Rx pin
  • UART Gnd pin to router Gnd pin
  • Do not hook up any other pins

.
Also, while it's in the WRT AC Series device wiki, just in case you missed it, the WRT AC Series uses 3.3v, so ensure the UART is set for 3.3v, not 5v

  • Okay... weird... that used to be in the wiki, but it's no longer there. I've added it back under Serial Port
1 Like

@JW0914 You were right. Sorry for questioning you.

I established serial connection and flashed the image as described in the forum. The transfer was successful, booting up not so I established serial connection again and transfered the image a second time. After resetting the serial console shows a lot of repeating errors:

[ 1.374774] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry
[ 1.384972] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry
[ 1.401101] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry
[ 1.410690] ubi0 error: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read 64 bytes
[ 1.410693] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.4.92 #0
[ 1.410694] Hardware name: Marvell Armada 380/385 (Device Tree)
[ 1.410699] Function entered at [] from []
[ 1.410701] Function entered at [] from []
[ 1.410703] Function entered at [] from []
[ 1.410706] Function entered at [] from []
[ 1.410707] Function entered at [] from []
[ 1.410708] Function entered at [] from []
[ 1.410710] Function entered at [] from []
[ 1.410711] Function entered at [] from []
[ 1.410713] Function entered at [] from []
[ 1.410714] Function entered at [] from []
[ 1.410716] Function entered at [] from []

The full log can be found here: https://pastebin.com/x7801cS4

Could this be a hardware failure?

--- disregard... I didn't scroll down the paste bin far enough ---

After reading the bootlog following the flash, it's almost reminiscent of an issue we had with the WRT AC Series about 18 months ago or so where corruption of the nand flash was caused by something in the kernel IIRC. I'd recommend performing the fix we discovered back then and going from there:

Remain connected via serial through the entire process, as we'll need to compare boot logs from the OEM firmware and the LEDE firmware if this doesn't work (it should)

  • To make it more convenient for you, have PuTTY log all console output to a log file.
    • In PuTTY:
      • Session > Logging > Session Logging: Tick All session ouput
        • Session > Logging > Log file name: Set it to C:\putty.log (otherwise it will log to %ProgramFiles%\PuTTY\putty.log

.
--- Updated with corrected information ---

  1. Download the latest Linksys OEM Firmware
  2. Rename it to rango.img
  3. Flash it via serial to both partitions, then reboot router via: reset
  4. Interrupt the boot process, then issue: run altnandboot
  5. Allow the router to fully boot... it will take ~2 - 3min before you're able to access the OEM webUI, and once you can, reboot the router to the Uboot cli (i.e. interrupt the boot process).
  6. issue run nandboot
  7. Allow the router to fully boot... it will take ~2 - 3min before you're able to access the OEM webUI, and once you can, reboot the router to the Uboot cli
  8. Flash the LEDE Factory Image
    • Verify the SHA256 hash via QuickHash
      • SHA256: 2f325bdd9c0102273ff4af205601d06335a101a4a3bc6dd470885d64651ef144
  9. Reboot router via reset
  10. The ECC errors should be gone.
    • If they're not, check the OEM boot log to see if the same errors are there. If they are not, and the hashes match, this appears to be an issue with the 17.01.4 WRT3200ACM image.
      • I still haven't bothered to open the WRT3200 I got back in April, but I will when I get home to determine if I can replicate. In the meantime, try a different LEDE WRT3200 Factory Image
        • I'd recommend DavidC502's, as this will rule out an issue with any one image
          • SHA256: c2d08cef323439cbc973b83bb4f1355b26d259077c18c4b1cfdad98f532adc87
1 Like

Stuck here, neither of the commands work:

Marvell>> run_linksysaltnandboot
Unknown command 'run_linksysaltnandboot' - try 'help'
Marvell>> run linksysaltnandboot
Error: "linksysaltnandboot" not defined

Linksys must have changed that in all devices after the 1900ACS... you'll need to manually switch partitions then.

  • You can do the below, but I think I found the correct commands... drop linksys from the command for the WRT3200
    • i.e. run nandboot and run altnandboot
      .
  1. In place of run linksysaltnandboot, simply issue reset
  2. In place of run linksysnandboot, you'll need to perform the Firmware Recovery steps to manually switch it to the alternate boot partition.

This router is cursed.

https://pastebin.com/H7c3RQS1
The correct command is run nandboot with whitespace (line 244 to line 246) but there is a kernel panic on line 584.

Try flipping the power switch... perhaps Uboot must be rebooted prior to loading a new kernel.

Currently, it's unable to fully load the kernel and mount the rootfs, as it should resemble:

  • I missed it the first time around... have you already fully booted the Linksys OEM firmware twice, as the kernel version it's trying to load is 4.4.92 [LEDE's], not Linksys', which is 3.10.70
    • This makes me believe I gave the wrong instructions, as it appears reset should be utilized after flashing, at which point the run commands can be issued afterwards.

.
I've updated my prior post with corrected information from this post and your previous
.

NAND read: device 0 offset 0xa00000, size 0x600000
 6291456 bytes read: OK
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linksys WRT3200 Router
   Created:      2017-05-05   1:24:26 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4640379 Bytes = 4.4 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.70 (root@build-vm) (gcc version 4.6.4 (Linaro GCC branch-4.6.4. Marvell GCC Dev 201310-2126.3d181f66 64K MAXPAGESIZE ALIGN) ) #1 SMP Thu May 4 18:24:10 PDT 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Marvell Armada 380/381/382/383/384/385/388 (Device Tree), model: Marvell Armada 385 Development Board
[    0.000000] bootconsole [earlycon0] enabled
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] PERCPU: Embedded 7 pages/cpu @c1151000 s7488 r8192 d12992 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 130048
[    0.000000] Kernel command line: console=ttyS0,115200 root=/dev/mtdblock6 ro rootdelay=1 rootfstype=jffs2 earlyprintk mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),1920K@8320K(sysdiag),80m@10m(kernel),74m@16m(rootfs),80m@90m(alt_kernel),74m@96m(alt_rootfs),160m@10m(ubifs),-@170m(syscfg)
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] allocated 1048576 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you dont want memory cgroups
[    0.000000] Memory: 512MB = 512MB total
[    0.000000] Memory: 508768k/508768k available, 15520k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xe0800000 - 0xfff00000   ( 503 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xe0000000   ( 512 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc08417c8   (8422 kB)
[    0.000000]       .init : 0xc0842000 - 0xc0883d40   ( 264 kB)
[    0.000000]       .data : 0xc0884000 - 0xc08d81e0   ( 337 kB)
[    0.000000]        .bss : 0xc08d81e0 - 0xc099f04c   ( 796 kB)
[    0.000000] Hierarchical RCU implementation.
[    0.000000]     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] 
[    0.000000]   LSP version: linux-3.10.70-2015_T1.1p7
[    0.000000] 
[    0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
[    0.000000] L310 cache controller enabled
[    0.000000] l2x0: 16 ways, CACHE_ID 0x410054c9, AUX_CTRL 0x16070000, Cache size: 1048576 B
[    0.000000] Console: colour dummy device 80x30
[    0.017254] Calibrating delay loop... 3726.54 BogoMIPS (lpj=18632704)
[    0.082983] pid_max: default: 32768 minimum: 301
[    0.087709] Mount-cache hash table entries: 512
[    0.092536] Initializing cgroup subsys memory
[    0.096973] CPU: Testing write buffer coherency: ok
[    0.102003] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.107717] Calibrating local timer... 933.34MHz.
[    0.171169] Setting up static identity map for 0xc0642ff8 - 0xc0643050
[    0.177857] mvebu-pmsu: Initializing Power Management Service Unit
[    0.184118] Initializing CPU Reset module
[    0.188629] CPU1: Booted secondary processor
[    0.241173] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.241225] Brought up 2 CPUs
[    0.254306] SMP: Total of 2 processors activated (7453.08 BogoMIPS).
[    0.260710] CPU: All CPU(s) started in SVC mode.
[    0.265582] devtmpfs: initialized
[    0.270707] mvebu-soc-id: MVEBU SoC ID=0x6820, Rev=0x4
[    0.276033] xor: measuring software checksum speed
[    0.371153]    arm4regs  :  3309.200 MB/sec
[    0.471154]    8regs     :  2234.800 MB/sec
[    0.571155]    32regs    :  1905.600 MB/sec
[    0.575401] xor: using function: arm4regs (3309.200 MB/sec)
[    0.581030] pinctrl core: initialized pinctrl subsystem
[    0.586480] regulator-dummy: no parameters
[    0.590743] NET: Registered protocol family 16
[    0.595684] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.604160] irq: Cannot allocate irq_descs @ IRQ195, assuming pre-allocated
[    0.611435] irq: Cannot allocate irq_descs @ IRQ227, assuming pre-allocated
[    0.628304] bio: create slab <bio-0> at 0
[    0.801265] raid6: int32x1    232 MB/s
[    0.971268] raid6: int32x2    344 MB/s
[    1.141186] raid6: int32x4    437 MB/s
[    1.311286] raid6: int32x8    444 MB/s
[    1.315098] raid6: using algorithm int32x8 (444 MB/s)
[    1.320206] raid6: using intx1 recovery algorithm
[    1.325179] mvebu-pcie pcie-controller.6: PCIe0.0: link up
[    1.330734] mvebu-pcie pcie-controller.6: PCIe1.0: link up
[    1.336360] mvebu-pcie pcie-controller.6: PCI host bridge to bus 0000:00
[    1.343119] pci_bus 0000:00: root bus resource [io  0x1000-0xfffff]
[    1.349439] pci_bus 0000:00: root bus resource [mem 0xe0000000-0xe7ffffff]
[    1.356396] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.362159] PCI: bus0: Fast back to back transfers disabled
[    1.367791] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.375851] pci 0000:00:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.384134] PCI: bus1: Fast back to back transfers disabled
[    1.390015] PCI: bus2: Fast back to back transfers disabled
[    1.395718] pci 0000:00:01.0: BAR 8: assigned [mem 0xe0000000-0xe02fffff]
[    1.402566] pci 0000:00:02.0: BAR 8: assigned [mem 0xe0400000-0xe06fffff]
[    1.409406] pci 0000:01:00.0: BAR 0: assigned [mem 0xe0000000-0xe01fffff 64bit pref]
[    1.417209] pci 0000:01:00.0: BAR 2: assigned [mem 0xe0200000-0xe02fffff 64bit pref]
[    1.425008] pci 0000:00:01.0: PCI bridge to [bus 01]
[    1.430032] pci 0000:00:01.0:   bridge window [mem 0xe0000000-0xe02fffff]
[    1.436881] pci 0000:02:00.0: BAR 0: assigned [mem 0xe0400000-0xe05fffff 64bit pref]
[    1.444682] pci 0000:02:00.0: BAR 2: assigned [mem 0xe0600000-0xe06fffff 64bit pref]
[    1.452480] pci 0000:00:02.0: PCI bridge to [bus 02]
[    1.457504] pci 0000:00:02.0:   bridge window [mem 0xe0400000-0xe06fffff]
[    1.464351] PCI: enabling device 0000:00:01.0 (0140 -> 0143)
[    1.470069] PCI: enabling device 0000:00:02.0 (0140 -> 0143)
[    1.476108] SCSI subsystem initialized
[    1.480226] usbcore: registered new interface driver usbfs
[    1.485813] usbcore: registered new interface driver hub
[    1.491231] usbcore: registered new device driver usb
[    1.496530] pps_core: LinuxPPS API ver. 1 registered
[    1.501557] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    1.510754] PTP clock support registered
[    1.515221] Bluetooth: Core ver 2.16
[    1.518898] NET: Registered protocol family 31
[    1.523409] Bluetooth: HCI device and connection manager initialized
[    1.529816] Bluetooth: HCI socket layer initialized
[    1.534758] Bluetooth: L2CAP socket layer initialized
[    1.539871] Bluetooth: SCO socket layer initialized
[    1.545020] Switching to clocksource armada_370_xp_clocksource
[    1.550922] cfg80211: Calling CRDA to update world regulatory domain
[    1.561221] NET: Registered protocol family 2
[    1.565908] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    1.573041] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    1.579560] TCP: Hash tables configured (established 4096 bind 4096)
[    1.585987] TCP: reno registered
[    1.589283] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    1.595180] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    1.601584] NET: Registered protocol family 1
[    1.606092] RPC: Registered named UNIX socket transport module.
[    1.612078] RPC: Registered udp transport module.
[    1.616840] RPC: Registered tcp transport module.
[    1.621611] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.628976] jffs2: version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
[    1.636137] fuse init (API version 7.22)
[    1.640225] msgmni has been set to 993
[    1.644345] async_tx: api initialized (async)
[    1.648806] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
[    1.656257] io scheduler noop registered
[    1.660242] io scheduler deadline registered
[    1.664584] io scheduler cfq registered (default)
[    1.669727] armada-38x-pinctrl f1018000.pinctrl: registered pinctrl driver
[    1.676876] mv_xor f1060800.xor: Marvell shared XOR driver
[    1.721190] mv_xor f1060800.xor: Marvell XOR (Descriptor Mode): ( xor cpy intr pq )
[    1.751183] mv_xor f1060800.xor: freeing 1 in use descriptors!
[    1.757073] mv_xor f1060800.xor: Marvell XOR (Descriptor Mode): ( intr crc32c )
[    1.765083] mv_xor f1060900.xor: Marvell shared XOR driver
[    1.811179] mv_xor f1060900.xor: Marvell XOR (Descriptor Mode): ( xor cpy intr pq )
[    1.841183] mv_xor f1060900.xor: freeing 1 in use descriptors!
[    1.847073] mv_xor f1060900.xor: Marvell XOR (Descriptor Mode): ( intr crc32c )
[    1.878290] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[    1.905543] f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 44) is a 16550A
[    1.912657] console [ttyS0] enabled, bootconsole disabled
[    1.912657] console [ttyS0] enabled, bootconsole disabled
[    1.924027] ahci_mv f10a8000.sata: AHCI 0001.0000 32 slots 2 ports 6 Gbps 0x3 impl platform mode
[    1.932865] ahci_mv f10a8000.sata: flags: 64bit ncq sntf led only pmp fbs pio slum part sxs 
[    1.943180] scsi0 : ahci_mv_platform
[    1.946928] scsi1 : ahci_mv_platform
[    1.950624] ata1: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x100 irq 58
[    1.958594] ata2: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x180 irq 58
[    1.967261] armada-nand f10d0000.nand: Initialize HAL based NFC in 8bit mode with DMA Disabled using BCH 4bit ECC
[    1.981637] NAND device: Manufacturer ID: 0x01, Chip ID: 0xda (AMD/Spansion NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 64
[    1.994342] Bad block table found at page 131008, version 0x01
[    2.000587] Bad block table found at page 130944, version 0x01
[    2.006676] 11 cmdlinepart partitions found on MTD device armada-nand
[    2.013173] Creating 11 MTD partitions on "armada-nand":
[    2.018505] 0x000000000000-0x000000200000 : "uboot"
[    2.023754] 0x000000200000-0x000000220000 : "u_env"
[    2.028947] 0x000000220000-0x000000260000 : "s_env"
[    2.034151] 0x0000007e0000-0x000000820000 : "devinfo"
[    2.039513] 0x000000820000-0x000000a00000 : "sysdiag"
[    2.044893] 0x000000a00000-0x000005a00000 : "kernel"
[    2.050202] 0x000001000000-0x000005a00000 : "rootfs"
[    2.055520] 0x000005a00000-0x00000aa00000 : "alt_kernel"
[    2.061197] 0x000006000000-0x00000aa00000 : "alt_rootfs"
[    2.066854] 0x000000a00000-0x00000aa00000 : "ubifs"
[    2.072155] 0x00000aa00000-0x000010000000 : "syscfg"
[    2.077810] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[    2.086522] tun: Universal TUN/TAP device driver, 1.6
[    2.091601] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.098248] SoC: model = 0x6820, revision = 0x4
[    2.102851] mvPncVirtBase = 0xe0c00000, pncTcamSize = 1024
[    2.108357]   o 3 Giga ports supported
[    2.112123]   o SKB recycle supported for SWF (Disabled)
[    2.117453]   o NETA acceleration mode 4
[    2.121391]   o BM supported for CPU: 4 BM pools
[    2.126024]   o PnC supported (Enabled)
[    2.129872]   o RX Queue support: 8 Queues * 2048 Descriptors
[    2.135640]   o TX Queue support: 8 Queues * 532 Descriptors
[    2.141321]   o GSO supported
[    2.144297]   o GRO supported
[    2.147273]   o Receive checksum offload supported
[    2.152082]   o Transmit checksum offload supported
[    2.156977]   o Driver ERROR statistics enabled
[    2.161524]   o Driver INFO statistics enabled
[    2.165982]   o Driver DEBUG statistics enabled
[    2.170527] 
[    2.172903] port #0: is_sgmii=0, is_rgmii=1, phy_addr=0
[    2.178171]   o Loading network interface(s) for port #0: cpu_mask=0x3, tx_csum_limit=9800
[    2.186488] 
[    2.187983]   o Port 0 is connected to Linux netdevice
[    2.193883]     o eth0, ifindex = 3, GbE port = 0
[    2.202034]     giga p=0: mtu=1500, mac=00:50:43:e4:27:07 (hw config)
[    2.208239] 
[    2.209814] port #2: is_sgmii=1, is_rgmii=0, phy_addr=1
[    2.215105]   o Loading network interface(s) for port #2: cpu_mask=0x3, tx_csum_limit=2048
[    2.223426] 
[    2.224920]   o Port 2 is connected to Linux netdevice
[    2.230829]     o eth1, ifindex = 4, GbE port = 2
[    2.238981]     giga p=2: mtu=1500, mac=36:c0:44:c8:0f:06 (random)
[    2.244932] 
[    2.246699] (error) mv_switch_probe(5780) (rc=-22): read switch fdt file failed
[    2.254054] mv_soho_switch: probe of switch.3 failed with error 1
[    2.260184]   o Loading Switch QuarterDeck driver
[    2.269122]     o Device ID     : 0x352
[    2.272977]     o No. of Ports  : 7
[    2.276476]     o CPU Port      : 5
[    2.282385]     o Setting Switch Port #5 connected to GMAC port for 1000 Full with FC
[    2.292438]     o Setting Switch Port #6 connected to GMAC port for 1000 Full with FC
[    2.310927] ata2: SATA link down (SStatus 0 SControl 300)
[    2.316367] ata1: SATA link down (SStatus 0 SControl 300)
[    2.330202] Switch driver init:
[    2.333355]     o preset mode = Transparent
[    2.337552]     o tag mode    = No Tag
[    2.347267] port #0 establish switch connection
[    2.347267] 
[    2.353932] libphy: orion_mdio_bus: probed
[    2.358212] mdio_bus f1072004.mdio-mi: cannot get PHY at address 0
[    2.364584] mdio_bus f1072004.mdio-mi: cannot get PHY at address 1
[    2.370983] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI
[    2.378058] e1000: Copyright (c) 1999-2006 Intel Corporation.
[    2.383875] e1000e: Intel(R) PRO/1000 Network Driver - 2.3.2-k
[    2.389729] e1000e: Copyright(c) 1999 - 2013 Intel Corporation.
[    2.395724] PPP generic driver version 2.4.2
[    2.400092] PPP BSD Compression module registered
[    2.404837] PPP Deflate Compression module registered
[    2.409908] NET: Registered protocol family 24
[    2.414379] PPTP driver version 0.8.5
[    2.418180] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.424742] ehci-pci: EHCI PCI platform driver
[    2.429254] ehci-orion: EHCI orion driver
[    2.433357] orion-ehci f1058000.usb: EHCI Host Controller
[    2.438783] orion-ehci f1058000.usb: new USB bus registered, assigned bus number 1
[    2.446434] orion-ehci f1058000.usb: irq 50, io mem 0xf1058000
[    2.470940] orion-ehci f1058000.usb: USB 2.0 started, EHCI 1.00
[    2.477105] hub 1-0:1.0: USB hub found
[    2.480872] hub 1-0:1.0: 1 port detected
[    2.485022] xhci-hcd f10f0000.usb3: xHCI Host Controller
[    2.490361] xhci-hcd f10f0000.usb3: new USB bus registered, assigned bus number 2
[    2.497977] xhci-hcd f10f0000.usb3: irq 48, io mem 0xf10f0000
[    2.503975] hub 2-0:1.0: USB hub found
[    2.507742] hub 2-0:1.0: 1 port detected
[    2.511734] xhci-hcd f10f0000.usb3: xHCI Host Controller
[    2.517069] xhci-hcd f10f0000.usb3: new USB bus registered, assigned bus number 3
[    2.524784] hub 3-0:1.0: USB hub found
[    2.528551] hub 3-0:1.0: 1 port detected
[    2.532561] xhci-hcd f10f8000.usb3: xHCI Host Controller
[    2.537898] xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 4
[    2.545504] xhci-hcd f10f8000.usb3: irq 49, io mem 0xf10f8000
[    2.551483] hub 4-0:1.0: USB hub found
[    2.555249] hub 4-0:1.0: 1 port detected
[    2.559233] xhci-hcd f10f8000.usb3: xHCI Host Controller
[    2.564582] xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 5
[    2.572295] hub 5-0:1.0: USB hub found
[    2.576062] hub 5-0:1.0: 1 port detected
[    3.081224] mvebu-rtc f10a3800.rtc: rtc core: registered f10a3800.rtc as rtc0
[    3.131010] i2c /dev entries driver
[    3.145156] armada_thermal f10e4078.thermal: Overheat threshold between 92..107
[    3.152667] md: raid0 personality registered for level 0
[    3.157998] md: raid1 personality registered for level 1
[    3.163335] md: raid6 personality registered for level 6
[    3.168665] md: raid5 personality registered for level 5
[    3.174020] md: raid4 personality registered for level 4
[    3.179432] device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: dm-devel@redhat.com
[    3.187940] dm_crypt using the OCF package.
[    3.192144] Bluetooth: Virtual HCI driver ver 1.3
[    3.196917] Bluetooth: HCI UART driver ver 2.2
[    3.201442] usbcore: registered new interface driver bcm203x
[    3.207164] usbcore: registered new interface driver bpa10x
[    3.212804] usbcore: registered new interface driver bfusb
[    3.218352] usbcore: registered new interface driver btusb
[    3.223864] Bluetooth: Generic Bluetooth SDIO driver ver 0.1
[    3.229608] cpuidle: using governor ladder
[    3.233761] sdhci: Secure Digital Host Controller Interface driver
[    3.239964] sdhci: Copyright(c) Pierre Ossman
[    3.244416] mmc0: no vqmmc regulator found
[    3.248527] mmc0: no vmmc regulator found
[    3.290933] mmc0: SDHCI controller on f10d8000.sdhci [f10d8000.sdhci] using ADMA
[    3.298512] sdhci-pltfm: SDHCI platform and OF driver helper
[    3.316469] mmc0: new high speed SDIO card at address 0001
[    3.340077] Port 2: Link-up, Full-duplex, Speed-1000Mbps.
[    3.340229] armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources: Total CESA HW channels supported 2
[    3.340232] armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources: CESA feature: int_coalescing(1)
[    3.340236] armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources threshold 0x2, threshold_time 0xfffff
[    3.340398] mvCesaInit: channels=2, session=640, queue=256
[    3.348648] armada-cesa-ocf f109d000.crypto: cesa_ocf_probe: CESA driver operate in ocf(0) mode
[    3.348889] cesadev_init(c085f288)
[    3.349136] usbcore: registered new interface driver usbhid
[    3.349136] usbhid: USB HID core driver
[    3.349192] Loading Marvell spi device
[    3.404324] NET: Registered protocol family 26
[    3.408789] u32 classifier
[    3.411514] Netfilter messages via NETLINK v0.30.
[    3.416237] nfnl_acct: registering with nfnetlink.
[    3.421070] nf_conntrack version 0.5.0 (7949 buckets, 31796 max)
[    3.427172] ctnetlink v0.93: registering with nfnetlink.
[    3.432516] nf_conntrack_rtsp v0.7 loading
[    3.436697] ipip: IPv4 over IPv4 tunneling driver
[    3.441697] gre: GRE over IPv4 demultiplexor driver
[    3.446593] ip_gre: GRE over IPv4 tunneling driver
[    3.451883] nf_nat_rtsp v0.7 loading
[    3.455480] ip_tables: (C) 2000-2006 Netfilter Core Team
[    3.460877] arp_tables: (C) 2002 David S. Miller
[    3.465565] TCP: cubic registered
[    3.468920] NET: Registered protocol family 10
[    3.473834] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    3.479332] sit: IPv6 over IPv4 tunneling driver
[    3.484513] NET: Registered protocol family 17
[    3.489008] Bridge firewalling registered
[    3.493043] Ebtables v2.0 registered
[    3.496698] Bluetooth: RFCOMM TTY layer initialized
[    3.501640] Bluetooth: RFCOMM socket layer initialized
[    3.506797] Bluetooth: RFCOMM ver 1.11
[    3.510559] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    3.515894] Bluetooth: BNEP filters: protocol multicast
[    3.521144] Bluetooth: BNEP socket layer initialized
[    3.526126] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    3.532073] Bluetooth: HIDP socket layer initialized
[    3.537069] l2tp_core: L2TP core driver, V2.0
[    3.541447] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    3.546255] 8021q: 802.1Q VLAN Support v1.8
[    3.550473] Key type dns_resolver registered
[    3.554832] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    3.562921] regulator-dummy: disabling
[    3.567155] input: gpio_keys.4 as /devices/soc.0/internal-regs.1/gpio_keys.4/input/input0
[    3.575597] mvebu-rtc f10a3800.rtc: setting system clock to 1970-01-01 00:00:00 UTC (0)
[    3.583894] Waiting 1sec before mounting root device...
[    4.590931] md: Waiting for all devices to be available before autodetect
[    4.597746] md: If you dont use raid, use raid=noautodetect
[    4.603695] md: Autodetecting RAID arrays.
[    4.607806] md: Scanned 0 and added 0 devices.
[    4.612273] md: autorun ...
[    4.615075] md: ... autorun DONE.
[    4.858209] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0000: 0x4c2e instead
[    4.867735] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0004: 0x534b instead
[    4.877257] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0008: 0x302e instead
[    4.886777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e000c: 0x3030 instead
[    4.896297] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0010: 0x5742 instead
[    4.905818] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0014: 0x3233 instead
[    4.915338] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0018: 0x4341 instead
[    4.924857] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e001c: 0x2020 instead
[    4.934377] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0020: 0x3842 instead
[    4.943897] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x021e0024: 0x3643 instead
[    4.953415] jffs2: Further such events for this erase block will not be printed
[    5.426208] VFS: Mounted root (jffs2 filesystem) readonly on device 31:6.
[    5.433070] devtmpfs: mounted
[    5.436137] Freeing unused kernel memory: 260K (c0842000 - c0883000)
*********************************************************************************
              _        _  __    _    __ _____ __   __ _____
             | |      | ||  \  | |  / // ____]\ \ / // ____]TM
             | |      | ||   \ | | / /| (___   \ V /| (____
             | |      | || |\ \| |\ \  \____ \  \ /  \____ \
             | |_____ | || | \   | \ \  ____) | | |   ____) |
             |_______||_||_|  \__|  \_\[____ /  |_|  [_____/

 (c) 2014 Belkin International, Inc. and/or its affiliates. All rights reserved.
 Booting rango (firmware version 1.0.6.181063) 
*********************************************************************************
[utopia][init] System Initialization

Redid everything with the updated instructions, the kernel panic still occurs at step 4.

Just to make sure: Flashing to both partitions is done via run update_both_images which is followed by the three setenv commands described in the OpenWRT forum?

I think you meant preceded by the three setenv commands, and if so yes.

  • When you go to boot the Linksys OEM firmware, the second line after Starting kernel ... will have the kernel version of the image it's trying to boot... is the version correct to the image being booted (4.4 or 4.9 for LEDE, 3.10 for Linksys).

  • Also, verify that NAND read: device 0 offset 0xa00000, is correct for the partition being booted from

    • Primary partition: 0xa00000
    • Alternate partition: 0x5a00000
      .

You can see if flashing the partitions separately makes a difference:

  • Primary partition flash: run flash_pri_image
  • Alternate partition flash: run flash_alt_image
    .

The issue currently doesn't appear to be hardware related, but a corrupted kernel image preceding the primary partition (mtd6) and/or alternate partition (mtd8).