Recently my WRT1900ACS v1 brick, so I want to unbrick

Hardware Questions and Recommendations
1

  1. I purchased CH340 USB2TTL cable.

  2. When I connect the USB2TTL into my laptop, Win11 24h2 (com3 found) Linux (/dev/ttyUSB0 found)

  3. Only 4 lines (White, Blue, Purple, Green) and I setup 3.3V instead of 5V because it is a jump switch.

    usb2TTL
    usb2TTL713×623 76.4 KB

  4. I connect GND on USB2TTL to WRT1900ACS pin 6 (the top left contre pin1 on the top right with a mark) with Green.

    wrt1900acs_original
    wrt1900acs_original664×327 50.8 KB

  5. I connect RXD on USB2TTL in Purple to WRT1900ACS pin5 TX

  6. I connec TXD on USB2TTL in Blue to WRT1900ACS pin 3 RX

    S1
    S11553×517 184 KB

  7. Start laptop, check device manager in Win11

    wrt1900acs-1
    wrt1900acs-1688×441 75.5 KB

9.start putty and then wait news. Same bad news on Linux, there is nothing displayed in putty or picocom .

Screenshot_20250424_175740
Screenshot_20250424_175740923×850 105 KB

Screenshot_20250424_175927
Screenshot_20250424_175927923×850 53.9 KB

Screenshot2
Screenshot2700×603 58 KB

  1. I am sure all cable connection is very stable and no short circuit. Some of those LED really works.
  2. I found that kwboot.tar & kwboot-patched.tar cannot download.
  3. Is there some one who can help me to fix it? Because I really do not know why there is nothing respons in putty ( sudo putty in linux)
  4. At last, I am sure those two partation is written wrong firmware. so chnge bootload different part is not working.
2

Start by reversing the Rx and Tx wires.

3

@ frollic
I try to following your suggestion. But it is the same trouble, still nothing display in putty.

@all
Does someone has the kwboot and kwboot-patched ?

4

Try to boot with RX (@ router) disconnected; IIRC that device has voltage leakage.

5

@ anomeome, I am sorry, i did not know exactly. if I disconnect RX@router, then only connect TX@router and GND@router to USB2TTL which connect laptop, then open putty monitor, and power-on router ? is it correct? final connect the RX@rounter with USB2TTL TX ?

6

In my case,it's Linksys EA8100v2. If we connect all 3 lines to the router before pressing power-on button.Nothing happen,Neither router-lights nor putty respond.
To make it works, USBTTL(rx)-router(tx) must connected after power-on. Just 1-2 seconds after power-on or immediatly router's first light begin is ok,too.

7

Thank you hayypreadygo, yes, following your steps, i can really see inside putty, and I

Net:

port Interface PHY address
egiga0 RGMII 0x01
egiga1 SGMII 0x00
egiga0 [PRIME], egiga1
Saving Environment to NAND...
U-ENV offset == 0x200000
Erasing Nand...
Writing to Nand... U-ENV offset == 0x200000
U-ENV offset == 0x200000
done

auto_recovery:1

auto_recovery_check changes bootcmd: run nandboot
Hit any key to stop autoboot: 3
Marvell>>
Marvell>>
Marvell>>
Marvell>> setenv ipaddr 192.168.1.1
Marvell>> setenv serverip 192.168.1.2
Marvell>> setenv firmwareName W1S.img
Marvell>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'W1S.img'.
Load address: 0x2000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#######################
1.9 MiB/s
done
Bytes transferred = 32768256 (1f40100 hex)

NAND erase: device 0 offset 0xa00000, size 0x2800000
Erasing at 0x31e0000 -- 100% complete.
OK

NAND erase: device 0 offset 0x3200000, size 0x2800000
Erasing at 0x59e0000 -- 100% complete.
OK

NAND write: device 0 offset 0xa00000, size 0x1f40100
32768256 bytes written: OK

NAND write: device 0 offset 0x3200000, size 0x1f40100
32768256 bytes written: OK
Marvell>> reset
.....

no response at all !
I was waiting long time... so I switch off, then power-on, now I can find the original wifi and connect, can ping 192.168.1.1 success because nic got 192.168.1.155

http://linksyssmartwifi.com:52000/ui/dynamic/setup/welcome.html?
and http(s)://192.168.1.1 cannot

try to reset button, no works.

if re-connect putty in that console, i can see lots of information, but cannot quit to type any command by Ctrl-C.

Sorry , I still need someone help

8

what doesn't response? the router can connect to the Internet now but can't access Linksys's config page in router?( or Luci).
What firmware(W1S) did you installed?
What do you see at the end of that console?

"but cannot quit to type any command by Ctrl-C"
I don't know what normally does Ctrl-C do in console? I never get into wrt1900acs console before. Do you have access to SSH in uboot?

9

The 1st firmware I flash is FW_WRT1900ACS_1.0.3.182461_prod.img
The 2nd firmware I flash is 187766_prod.img.

Now, dhcp connected even if interface wlan0/1, nslookup can find the destination IP, but no function for surf, and cannot gui login .

Should I do “env default -a ; saveenv; reset” after press spacebar for serial connection in putty ?

10

When reset, the console of putty dead. No function.

11

This way failed

Code:

Bootloader
Corrupt Environment Recovery
If the U-Boot bootloader environment becomes corrupted, it can be reset or restored
Reset

Issue the following at the Marvell >> prompt:
env default -a
saveenv
reset

Result is

Code:
egiga0 [PRIME], egiga1
auto_recovery_check changes bootcmd: run altnandboot
Hit any key to stop autoboot: 0
Marvell>>env default -a

Resetting to default environment

Marvell>> saveenv
Saving Environment to NAND...
U-ENV offset == 0x200000
Erasing Nand...
Writing to Nand... U-ENV offset == 0x200000
U-ENV offset == 0x200000
done
Marvell>> reset
resetting ...

dead.

12

if connect with USb2TTL, and do not click spacebar. The IP 192.168.1.1 exist, WiFi/dns works, no routing.

Total log is
Code:

Net:

port Interface PHY address
egiga0 RGMII 0x01
egiga1 SGMII 0x00
egiga0 [PRIME], egiga1
auto_recovery_check changes bootcmd: run altnandboot
Hit any key to stop autoboot: 0

NAND read: device 0 offset 0x3200000, size 0x600000
6291456 bytes read: OK

Booting kernel from Legacy Image at 02000000 ...

Image Name: Linksys WRT1900ACS Router
Created: 2018-03-29 13:05:04 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4229843 Bytes = 4 MiB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.39 (root@build-vm) (gcc version 4.6.4 (Linaro GCC branch-4.6. 4. Marvell GCC Dev 201310-2126.3d181f66 64K MAXPAGESIZE ALIGN) ) #1 SMP Thu Mar 29 06:04:48 PDT 2018
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: Marvell Armada 380/381/382/385/388 (Device Tree), model: Marvell Armada 385 Development Board
bootconsole [earlycon0] enabled
Memory policy: ECC disabled, Data cache writealloc
PERCPU: Embedded 7 pages/cpu @c100a000 s8000 r8192 d12480 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock7 ro rootdelay=1 roo tfstype=jffs2 earlyprintk mtdparts=armada-nand:2048K(uboot)ro,256K(u_env),256K(s _env),1m@9m(devinfo),40m@10m(kernel),34m@16m(rootfs),40m@50m(alt_kernel),34m@56m (alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
allocated 1048576 bytes of page_cgroup
please try 'cgroup_disable=memory' option if you don't want memory cgroups
Memory: 512MB = 512MB total
Memory: 509744k/509744k available, 14544k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xe0800000 - 0xfff00000 ( 503 MB)
lowmem : 0xc0000000 - 0xe0000000 ( 512 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0008000 - 0xc0764cd4 (7540 kB)
.init : 0xc0765000 - 0xc07a4f40 ( 256 kB)
.data : 0xc07a6000 - 0xc07f5220 ( 317 kB)
.bss : 0xc07f5220 - 0xc08abe50 ( 732 kB)
Hierarchical RCU implementation.
RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
NR_IRQS:16 nr_irqs:16 16

LSP version: linux-3.10.39-2014_T3.0p5

sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
L310 cache controller enabled
l2x0: 16 ways, CACHE_ID 0x410054c9, AUX_CTRL 0x16070000, Cache size: 1048576 B
Console: colour dummy device 80x30
Calibrating delay loop... 3188.32 BogoMIPS (lpj=15941632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys memory
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0xc05a1568 - 0xc05a15c0
mvebu-pmsu: Initializing Power Management Service Unit
Initializing CPU Reset module
CPU1: Booted secondary processor
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (6376.65 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
mvebu-soc-id: MVEBU SoC ID=0x6820, Rev=0x4
xor: measuring software checksum speed
arm4regs : 2836.800 MB/sec
8regs : 1915.600 MB/sec
32regs : 1633.600 MB/sec
xor: using function: arm4regs (2836.800 MB/sec)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
irq: Cannot allocate irq_descs @ IRQ195, assuming pre-allocated
irq: Cannot allocate irq_descs @ IRQ227, assuming pre-allocated
bio: create slab at 0
raid6: int32x1 203 MB/s
raid6: int32x2 294 MB/s
raid6: int32x4 374 MB/s
raid6: int32x8 380 MB/s
raid6: using algorithm int32x8 (380 MB/s)
raid6: using intx1 recovery algorithm
mvebu-pcie pcie-controller.6: PCIe0.0: link up
mvebu-pcie pcie-controller.6: PCIe1.0: link up
mvebu-pcie pcie-controller.6: ignoring PCIe DT node, missing pcie-port property
mvebu-pcie pcie-controller.6: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x1000-0xfffff]
pci_bus 0000:00: root bus resource [mem 0xe0000000-0xe8000000]
pci_bus 0000:00: root bus resource [bus 00-ff]
PCI: bus0: Fast back to back transfers disabled
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
PCI: bus1: Fast back to back transfers disabled
PCI: bus2: Fast back to back transfers disabled
pci 0000:00:01.0: BAR 8: assigned [mem 0xe0000000-0xe01fffff]
pci 0000:00:02.0: BAR 8: assigned [mem 0xe0200000-0xe03fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0xe0000000-0xe00fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0xe0100000-0xe01fffff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 01]
pci 0000:00:01.0: bridge window [mem 0xe0000000-0xe01fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0xe0200000-0xe02fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0xe0300000-0xe03fffff 64bit pref]
pci 0000:00:02.0: PCI bridge to [bus 02]
pci 0000:00:02.0: bridge window [mem 0xe0200000-0xe03fffff]
PCI: enabling device 0000:00:01.0 (0140 -> 0143)
PCI: enabling device 0000:00:02.0 (0140 -> 0143)
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@l inux.it>
PTP clock support registered
Bluetooth: Core ver 2.16
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource armada_370_xp_clocksource
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
msgmni has been set to 995
async_tx: api initialized (async)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
armada-38x-pinctrl f1018000.pinctrl: registered pinctrl driver
mv_xor f1060800.xor: Marvell shared XOR driver
mv_xor f1060800.xor: Marvell XOR: ( xor cpy intr )
mv_xor f1060800.xor: freeing 1 in use descriptors!
mv_xor f1060800.xor: Marvell XOR: ( crc32c )
mv_xor f1060900.xor: Marvell shared XOR driver
mv_xor f1060900.xor: Marvell XOR: ( xor cpy intr )
mv_xor f1060900.xor: freeing 1 in use descriptors!
mv_xor f1060900.xor: Marvell XOR: ( crc32c )
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 44) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
ahci_mv f10a8000.sata: AHCI 0001.0000 32 slots 2 ports 6 Gbps 0x3 impl platform mode
ahci_mv f10a8000.sata: flags: 64bit ncq sntf led only pmp fbs pio slum part sxs
scsi0 : ahci_mv_platform
scsi1 : ahci_mv_platform
ata1: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x100 irq 58
ata2: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x180 irq 58
armada-nand f10d0000.nand: Initialize HAL based NFC in 8bit mode with DMA Disabl ed using BCH 4bit ECC
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
10 cmdlinepart partitions found on MTD device armada-nand
Creating 10 MTD partitions on "armada-nand":
0x000000000000-0x000000200000 : "uboot"
0x000000200000-0x000000240000 : "u_env"
0x000000240000-0x000000280000 : "s_env"
0x000000900000-0x000000a00000 : "devinfo"
0x000000a00000-0x000003200000 : "kernel"
0x000001000000-0x000003200000 : "rootfs"
0x000003200000-0x000005a00000 : "alt_kernel"
0x000003800000-0x000005a00000 : "alt_rootfs"
0x000000a00000-0x000005a00000 : "ubifs"
0x000005a00000-0x000008000000 : "syscfg"
bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com
SoC: model = 0x6820, revision = 0x4
mvPncVirtBase = 0xe0c00000, pncTcamSize = 1024
o 3 Giga ports supported
o SKB recycle supported (Disabled)
o NETA acceleration mode 4
o BM supported for CPU: 4 BM pools
o PnC supported (Enabled)
o RX Queue support: 8 Queues * 256 Descriptors
o TX Queue support: 8 Queues * 532 Descriptors
o GSO supported
o Receive checksum offload supported
o Transmit checksum offload supported

port #0: is_sgmii=0, is_rgmii=1, phy_addr=0
o Loading network interface(s) for port #0: cpu_mask=0x3, tx_csum_limit=9800

o Port 0 is connected to Linux netdevice
o eth0, ifindex = 3, GbE port = 0
giga p=0: mtu=1500, mac=00:50:43:56:9a:91 (hw config)

port #2: is_sgmii=1, is_rgmii=0, phy_addr=1
o Loading network interface(s) for port #2: cpu_mask=0x3, tx_csum_limit=2048

o Port 2 is connected to Linux netdevice
o eth1, ifindex = 4, GbE port = 2
giga p=2: mtu=1500, mac=0e:33:22:2c:b5:92 (random)

o Loading Switch QuarterDeck driver
o Device ID : 0x176
o No. of Ports : 7
o CPU Port : 5
Switch driver init:
o preset mode = Transparent
o tag mode = No Tag
port #0 establish switch connection

libphy: orion_mdio_bus: probed
mdio_bus f1072004.mdio-mi: cannot get PHY at address 0
mdio_bus f1072004.mdio-mi: cannot get PHY at address 1
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
ehci-orion: EHCI orion driver
orion-ehci f1058000.usb: EHCI Host Controller
orion-ehci f1058000.usb: new USB bus registered, assigned bus number 1
orion-ehci f1058000.usb: irq 50, io mem 0xf1058000
orion-ehci f1058000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
xhci-hcd f10f0000.usb3: xHCI Host Controller
xhci-hcd f10f0000.usb3: new USB bus registered, assigned bus number 2
xhci-hcd f10f0000.usb3: irq 48, io mem 0xf10f0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
xhci-hcd f10f0000.usb3: xHCI Host Controller
xhci-hcd f10f0000.usb3: new USB bus registered, assigned bus number 3
ata2: SATA link down (SStatus 0 SControl 300)
ata1: SATA link down (SStatus 0 SControl 300)
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
xhci-hcd f10f8000.usb3: xHCI Host Controller
xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 4
xhci-hcd f10f8000.usb3: irq 49, io mem 0xf10f8000
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
xhci-hcd f10f8000.usb3: xHCI Host Controller
xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 5
hub 5-0:1.0: USB hub found
hub 5-0:1.0: 1 port detected
mvebu-rtc f10a3800.rtc: rtc core: registered f10a3800.rtc as rtc0
i2c /dev entries driver
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
cpuidle: using governor ladder
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
mmc0: SDHCI controller on f10d8000.sdhci [f10d8000.sdhci] using ADMA
sdhci-pltfm: SDHCI platform and OF driver helper
armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources: Total CESA HW channels s upported 2
armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources: CESA feature: int_coales cing(1)
armada-cesa-ocf f109d000.crypto: mv_get_cesa_resources threshold 0x2, threshold_ time 0xff
mvCesaInit: channels=2, session=640, queue=256
armada-cesa-ocf f109d000.crypto: cesa_ocf_probe: CESA driver operate in ocf(0) m ode
cesadev_init(c07810f0)
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
NET: Registered protocol family 26
u32 classifier
Netfilter messages via NETLINK v0.30.
nfnl_acct: registering with nfnetlink.
nf_conntrack version 0.5.0 (7964 buckets, 31856 max)
ctnetlink v0.93: registering with nfnetlink.
nf_conntrack_rtsp v0.7 loading
ipip: IPv4 over IPv4 tunneling driver
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
nf_nat_rtsp v0.7 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Key type dns_resolver registered
Port 3: Link-up, Full-duplex, Speed-1000Mbps.
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
input: gpio_keys.4 as /devices/soc.0/internal-regs.1/gpio_keys.4/input/input0
mvebu-rtc f10a3800.rtc: setting system clock to 1970-01-01 00:00:01 UTC (1)
Waiting 1sec before mounting root device...
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...
md: ... autorun DONE.
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0000: 0x4c2e instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0004: 0x534b instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0008: 0x302e instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a000c: 0x3030 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0010: 0x5742 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0014: 0x3931 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0018: 0x4341 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a001c: 0x2020 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0020: 0x3936 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x019a0024: 0x3334 instead
jffs2: Further such events for this erase block will not be printed
VFS: Mounted root (jffs2 filesystem) readonly on device 31:7.
devtmpfs: mounted
Freeing unused kernel memory: 252K (c0765000 - c07a4000)

          _        _  __    _    __ _____ __   __ _____
         | |      | ||  \  | |  / // ____]\ \ / // ____]TM
         | |      | ||   \ | | / /| (___   \ V /| (____
         | |      | || |\ \| |\ \  \____ \  \ /  \____ \
         | |_____ | || | \   | \ \  ____) | | |   ____) |
         |_______||_||_|  \__|  \_\[____ /  |_|  [_____/

(c) 2014 Belkin International, Inc. and/or its affiliates. All rights reserved.
Booting shelby (firmware version 1.0.3.187766)

[utopia][init] System Initialization
[utopia][init] Creating /proc
[utopia][init] Creating /sys
[utopia][init] Creating /dev
[utopia][init] Creating /tmp
[utopia][init] Allocating 100M for /tmp
[utopia][init] Prepairing /dev/pts
[utopia][init] Setting /tmp and /var permissions
[utopia][init] Starting udev..
orion_wdt: Initial timeout 171 sec
Attempting mount of ubifs syscfg partition
UBI device number 0, total 296 LEBs (37584896 bytes, 35.8 MiB), available 8 LEBs (1015808 bytes, 992.0 KiB), LEB size 126976 bytes (124.0 KiB)
mkdir: cannot create directory '/var/config/syscfg': Read-only file system
[utopia][init] Using persistent syscfg data from /var/config/syscfg
[utopia][init] Starting system logging
[utopia][init] Starting sysevent subsystem
net.netfilter.nf_conntrack_acct = 1
watchdog running
[utopia][init] Setting any unset system values to default
[utopia][init] no persistence config file (/var/config/pstcfg) found
mac_setup.sh, setting up MAC addresses for all interfaces based on 14:91:82:C4:6A:C6
Error: internal error handling tmp file
NTP Servers do not need to be updated
[utopia][init] committing default syscfg values
checking for interactive script start up...
Error: internal error handling tmp file
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
touch: /var/config/files-to-keep.conf: Read-only file system
/etc/init.d/service_autofwup.sh: line 445: can't create /var/config/files-to-keep.conf: Read-only file system
cat: can't open '/var/config/files-to-keep.conf': No such file or directory
Updating BootCount Page[32]:10000 ... Done

/etc/system/wait: line 278: can't create /var/config/.sysinfo_pswd: Read-only file system
cpu temp monitor created
Thu Oct 11 06:00:00 UTC 2012
wan, sysevent received: wan-start
wdev0 no private ioctls.

wdev1 no private ioctls.

/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
wdev0ap0 no private ioctls.

wdev0ap1 no private ioctls.

wdev0ap2 no private ioctls.

wdev0ap3 no private ioctls.

wdev1ap0 no private ioctls.

wdev1ap1 no private ioctls.

wdev1ap2 no private ioctls.

wifi, sysevent received: lan-started (Wed Oct 10 23:00:03 PDT 2012)
wifi, service_start()
Lighttpd Model Base: WRT1900ACS
Generating Rainier lighttpd config
lua: /etc/init.d/service_httpd/lighttpd-rainier-conf.lua:10: IPA_Initialize failed
stack traceback:
[C]: in function 'new'
/etc/init.d/service_httpd/lighttpd-rainier-conf.lua:10: in main chunk
[C]: ?
Creating /tmp/var/config/license
mkdir: cannot create directory '/tmp/var/config/license': Read-only file system
cp: cannot create '/tmp/var/config/license/fw_license.pdf.gz': No such file or directory
Build temporary www configuration directory:
mkdir: cannot create directory '/var/config/esm': Read-only file system
mkdir: cannot create directory '/var/config/events': Read-only file system
mkdir: cannot create directory '/var/config/ewps': Read-only file system
TSLIIHauhEfGE
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
2012-10-11 06:00:04: (configfile.c.1294) a default document-root has to be set
2012-10-11 06:00:04: (server.c.654) setting default values failed
Power cycle Ethernet ports.
Registering Service myrouter._http._tcp.local port 80
/usr/bin/lua: /etc/init.d/service_devidentd/deviceupdate.lua:36: IPA_Initialize failed
stack traceback:
[C]: in function 'new'
/etc/init.d/service_devidentd/deviceupdate.lua:36: in main chunk
[C]: ?
Error: internal error handling tmp file
Got a reply for myrouter._http._tcp.local.: Name now registered and active
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
SKU is WRT1900ACS-CA
Error: internal error handling tmp file
wifi, wifi_physical_start(wdev0)
touch: /var/config/detected_hosts_history: Read-only file system
mkdir: cannot create directory '/var/config/esm': Read-only file system
mkdir: cannot create directory '/var/config/events': Read-only file system
mkdir: cannot create directory '/var/config/ewps': Read-only file system
Restarting nfqrecv service...
wifi_physical, iwconfig wdev0 commit
wifi, wifi_virtual_start(wdev0)
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
wifi, wifi_user_start(wdev0)
/etc/init.d/service_vsftpd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_vsftpd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
[utopia] Not setting ppp_clamp_mtu
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
wifi, primary AP: wdev0ap0 is up
grep: /var/config/syspwl.lst: No such file or directory
mv: cannot create '/var/config/syspwl.lst': Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
wifi, wifi_guest_start(wdev0)
wifi, guest wdev0ap1 is disabled, do not start wifi guest
wifi, wifi_physical_start(wdev1)
wifi_physical, iwconfig wdev1 commit
wifi, wifi_virtual_start(wdev1)
wifi, wifi_user_start(wdev1)
wifi, primary AP: wdev1ap0 is up
wifi, wifi_guest_start(wdev1)
wifi, guest wdev1ap1 is disabled, do not start wifi guest
wifi, start_hostapd()
Configuration file: /tmp/hostapd-wdev1ap0.conf
Using interface wdev1ap0 with hwaddr 14:91:82:c4:6a:c7 and ssid "Linksys04063"
random: Only 17/20 bytes of strong random data available from /dev/random
random: Not enough entropy pool available for secure operations
WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects
Configuration file: /tmp/hostapd-wdev0ap0.conf
Using interface wdev0ap0 with hwaddr 14:91:82:c4:6a:c8 and ssid "Linksys04063_5GHz"
random: Cannot read from /dev/random: Resource temporarily unavailable
random: Only 17/20 bytes of strong random data available from /dev/random
random: Not enough entropy pool available for secure operations
WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects
Error: internal error handling tmp file
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
[utopia] Not setting ppp_clamp_mtu on dslite protocol
wan, sysevent received: phylink_wan_state
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
iptables v1.4.21: invalid port/service --jump' specified Try iptables -h' or 'iptables --help' for more information.
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_vsftpd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_vsftpd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
grep: /var/config/syspwl.lst: No such file or directory
mv: cannot create '/var/config/syspwl.lst': Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_smbd.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
grep: /var/config/syspwl.lst: No such file or directory
mv: cannot create '/var/config/syspwl.lst': Read-only file system
cat: can't open '/var/config/syspwl.lst': No such file or directory
cat: can't open '/var/config/syspwl.lst': No such file or directory
Starting smbd ...
Restarting nfqrecv service...
Restarting nfqrecv service...
Restarting nfqrecv service...
Restarting nfqrecv service...
Restarting nfqrecv service...

in this case, dns and wifi, wired works, no routing for any web, no way (telnet, ssh only usb2ttl) access linksys web gui

13

if Serial
Connect via Serial:
reboot
At 3 second autoboot interrupt delay, press any key
Boot
Primary Partition
Armada 385
run nandboot
or run altnandboot.

It real boot the router. result almost same as above.

Marvell>>
Marvell>>
Marvell>> run altnandboot

NAND read: device 0 offset 0x3200000, size 0x600000
6291456 bytes read: OK

Booting kernel from Legacy Image at 02000000 ...

Image Name: Linksys WRT1900ACS Router
Created: 2018-03-29 13:05:04 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4229843 Bytes = 4 MiB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.39 (root@build-vm) (gcc version 4.6.4 (Linaro GCC branch-4.6.4. Marvell GCC Dev 201310-2126.3d181f66 64K MAXPAGESIZE ALIGN) ) #1 SMP Thu Mar 29 06:04:48 PDT 2018
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: Marvell Armada 380/381/382/385/388 (Device Tree), model: Marvell Armada 385 Development Board
bootconsole [earlycon0] enabled
Memory policy: ECC disabled, Data cache writealloc
PERCPU: Embedded 7 pages/cpu @c100a000 s8000 r8192 d12480 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock7 ro rootdelay=1 rootfstype=jffs2 earlyprintk mtdparts=armada-nand:2048K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),34m@16m(rootfs),40m@50m(alt_kernel),34m@56m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
allocated 1048576 bytes of page_cgroup
please try 'cgroup_disable=memory' option if you don't want memory cgroups
Memory: 512MB = 512MB total
Memory: 509744k/509744k available, 14544k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xe0800000 - 0xfff00000 ( 503 MB)
lowmem : 0xc0000000 - 0xe0000000 ( 512 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0008000 - 0xc0764cd4 (7540 kB)
.init : 0xc0765000 - 0xc07a4f40 ( 256 kB)
.data : 0xc07a6000 - 0xc07f5220 ( 317 kB)
.bss : 0xc07f5220 - 0xc08abe50 ( 732 kB)
Hierarchical RCU implementation.
RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
NR_IRQS:16 nr_irqs:16 16

LSP version: linux-3.10.39-2014_T3.0p5

sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
L310 cache controller enabled
l2x0: 16 ways, CACHE_ID 0x410054c9, AUX_CTRL 0x16070000, Cache size: 1048576 B
Console: colour dummy device 80x30
Calibrating delay loop... 3188.32 BogoMIPS (lpj=15941632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys memory
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0xc05a1568 - 0xc05a15c0
mvebu-pmsu: Initializing Power Management Service Unit
Initializing CPU Reset module
CPU1: Booted secondary processor
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (6376.65 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
mvebu-soc-id: MVEBU SoC ID=0x6820, Rev=0x4
xor: measuring software checksum speed
arm4regs : 2836.800 MB/sec
8regs : 1915.600 MB/sec
32regs : 1633.600 MB/sec
xor: using function: arm4regs (2836.800 MB/sec)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
irq: Cannot allocate irq_descs @ IRQ195, assuming pre-allocated
irq: Cannot allocate irq_descs @ IRQ227, assuming pre-allocated
bio: create slab at 0
raid6: int32x1 203 MB/s
raid6: int32x2 294 MB/s
raid6: int32x4 374 MB/s
raid6: int32x8 380 MB/s
raid6: using algorithm int32x8 (380 MB/s)
raid6: using intx1 recovery algorithm
mvebu-pcie pcie-controller.6: PCIe0.0: link up
mvebu-pcie pcie-controller.6: PCIe1.0: link up
mvebu-pcie pcie-controller.6: ignoring PCIe DT node, missing pcie-port property
mvebu-pcie pcie-controller.6: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x1000-0xfffff]
pci_bus 0000:00: root bus resource [mem 0xe0000000-0xe8000000]
pci_bus 0000:00: root bus resource [bus 00-ff]
PCI: bus0: Fast back to back transfers disabled
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
PCI: bus1: Fast back to back transfers disabled
PCI: bus2: Fast back to back transfers disabled
pci 0000:00:01.0: BAR 8: assigned [mem 0xe0000000-0xe01fffff]
pci 0000:00:02.0: BAR 8: assigned [mem 0xe0200000-0xe03fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0xe0000000-0xe00fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0xe0100000-0xe01fffff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 01]
pci 0000:00:01.0: bridge window [mem 0xe0000000-0xe01fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0xe0200000-0xe02fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0xe0300000-0xe03fffff 64bit pref]
pci 0000:00:02.0: PCI bridge to [bus 02]
pci 0000:00:02.0: bridge window [mem 0xe0200000-0xe03fffff]
PCI: enabling device 0000:00:01.0 (0140 -> 0143)
PCI: enabling device 0000:00:02.0 (0140 -> 0143)
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti giometti@linux.it
PTP clock support registered
Bluetooth: Core ver 2.16
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource armada_370_xp_clocksource
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
msgmni has been set to 995
async_tx: api initialized (async)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
armada-38x-pinctrl f1018000.pinctrl: registered pinctrl driver
mv_xor f1060800.xor: Marvell shared XOR driver
mv_xor f1060800.xor: Marvell XOR: ( xor cpy intr )
mv_xor f1060800.xor: freeing 1 in use descriptors!
mv_xor f1060800.xor: Marvell XOR: ( crc32c )
mv_xor f1060900.xor: Marvell shared XOR driver
mv_xor f1060900.xor: Marvell XOR: ( xor cpy intr )
mv_xor f1060900.xor: freeing 1 in use descriptors!
mv_xor f1060900.xor: Marvell XOR: ( crc32c )
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 44) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
ahci_mv f10a8000.sata: AHCI 0001.0000 32 slots 2 ports 6 Gbps 0x3 impl platform mode
ahci_mv f10a8000.sata: flags: 64bit ncq sntf led only pmp fbs pio slum part sxs
scsi0 : ahci_mv_platform
scsi1 : ahci_mv_platform
ata1: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x100 irq 58
ata2: SATA max UDMA/133 mmio [mem 0xf10a8000-0xf10a9fff] port 0x180 irq 58
armada-nand f10d0000.nand: Initialize HAL based NFC in 8bit mode with DMA Disabled using BCH 4bit ECC
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
10 cmdlinepart partitions found on MTD device armada-nand
Creating 10 MTD partitions on "armada-nand":
0x000000000000-0x000000200000 : "uboot"
0x000000200000-0x000000240000 : "u_env"
0x000000240000-0x000000280000 : "s_env"
0x000000900000-0x000000a00000 : "devinfo"
0x000000a00000-0x000003200000 : "kernel"
0x000001000000-0x000003200000 : "rootfs"
0x000003200000-0x000005a00000 : "alt_kernel"
0x000003800000-0x000005a00000 : "alt_rootfs"
0x000000a00000-0x000005a00000 : "ubifs"
0x000005a00000-0x000008000000 : "syscfg"
bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com
SoC: model = 0x6820, revision = 0x4
mvPncVirtBase = 0xe0c00000, pncTcamSize = 1024
o 3 Giga ports supported
o SKB recycle supported (Disabled)
o NETA acceleration mode 4
o BM supported for CPU: 4 BM pools
o PnC supported (Enabled)
o RX Queue support: 8 Queues * 256 Descriptors
o TX Queue support: 8 Queues * 532 Descriptors
o GSO supported
o Receive checksum offload supported
o Transmit checksum offload supported

port #0: is_sgmii=0, is_rgmii=1, phy_addr=0
o Loading network interface(s) for port #0: cpu_mask=0x3, tx_csum_limit=9800

o Port 0 is connected to Linux netdevice
o eth0, ifindex = 3, GbE port = 0
giga p=0: mtu=1500, mac=00:50:43:56:9a:91 (hw config)

port #2: is_sgmii=1, is_rgmii=0, phy_addr=1
o Loading network interface(s) for port #2: cpu_mask=0x3, tx_csum_limit=2048

o Port 2 is connected to Linux netdevice
o eth1, ifindex = 4, GbE port = 2
giga p=2: mtu=1500, mac=76:f1:7f:31:b4:25 (random)

o Loading Switch QuarterDeck driver
o Device ID : 0x176
o No. of Ports : 7
o CPU Port : 5
Switch driver init:
o preset mode = Transparent
o tag mode = No Tag
port #0 establish switch connection

libphy: orion_mdio_bus: probed
mdio_bus f1072004.mdio-mi: cannot get PHY at address 0
mdio_bus f1072004.mdio-mi: cannot get PHY at address 1
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered

14 
UBI device number 0, total 296 LEBs (37584896 bytes, 35.8 MiB), available 8 LEBs (1015808 bytes, 992.0 KiB), LEB size 126976 bytes (124.0 KiB)
mkdir: cannot create directory '/var/config/syscfg': Read-only file system

This line in comment 12 is the begining of something wrong. Follow by many unable to create file ,can't open file error. I don't know,I guess writing is locked and read-only. Someone else may help explain this or unlock this.

Example 1 of many error

Error: internal error handling tmp file
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
/etc/init.d/service_file_sharing.sh: /etc/init.d/user_functions.sh: line 14: can't create /var/config/syspwl.lst: Read-only file system
touch: /var/config/files-to-keep.conf: Read-only file system
/etc/init.d/service_autofwup.sh: line 445: can't create /var/config/files-to-keep.conf: Read-only file system
cat: can't open '/var/config/files-to-keep.conf': No such file or directory

Also better try to install openwrt 24.10.0 "KERNEL" first to see what happen.
https://firmware-selector.openwrt.org/
IF we can see openwrt-GUI then Install **Openwrt 24.10.0 "FACTORY"**could it writeable?.
Then follow the step "Return to Stock Firmware"

15

now, no telnet, no ssh, no webGUI, no internet, only serial flash!.

I also wonder whether directly flash openwrt 24.10.1 kernel img (factory) safe or not.

Those errors, I think it is because of two partations sizes of original and ddwrt were not same.

It happened after I flashed 4-4-2025 firmware twice for two partations. then waiting the usb2ttl cable, and finally get your key suggestion. so that i can entre marval mode.

linksysWeb
linksysWeb689×1033 192 KB

direct4connectotherwifi
direct4connectotherwifi966×715 50.2 KB

2nd picture is when my laptop cannot access wrt router but the 1st router can, only cannot verified.

wrt router wan connect 1st router lan to get 10.184.43.1.
my laptop got 10.184.43.156, yes, it can ping 43.1 success, and can nslookup youtube.com success,
because 1st router lan 192.168.1.1, can all access internet.

i also try to do reset after flash by tftp success. but all failed.

This way failed

Code:

Bootloader
Corrupt Environment Recovery

If the U-Boot bootloader environment becomes corrupted, it can be reset or restored
Reset

Issue the following at the Marvell >> prompt:

env default -a
saveenv
reset

Result is

Code:
egiga0 [PRIME], egiga1
auto_recovery_check changes bootcmd: run altnandboot
Hit any key to stop autoboot: 0
Marvell>>env default -a

Resetting to default environment

Marvell>> saveenv
Saving Environment to NAND...
U-ENV offset == 0x200000
Erasing Nand...
Writing to Nand... U-ENV offset == 0x200000
U-ENV offset == 0x200000
done
Marvell>> reset
resetting ...

yes, putty dead

16

Here is latest news for my semi-brick wrt1900acs.
Open putty with correct COMx, and connect usb-nic with defined 192.168.1.254/24 to wrt1900acsv1 lan 1,
When Marvell>> displayed by press spacebar after boot router and connect the USBTTL(rx)-router(tx) immediately. of couse,
make sure tftp via IP 192.168.1.254 and assign the target folder.

Marvell>>
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
setenv firmwareName FW_WRT1900ACS_1.0.3.187766_prod.img
run update_both_images

setenv firmwareName divested-wrt-snapshot-r29344+9-9073b48e96-mvebu-cortexa9-linksys_wrt1900acs-squashfs-factory.img ## you can openwrt-24.10.1-mvebu-cortexa9-linksys_wrt1900acs-squashfs-factory.img
run flash_alt_image
run altnandboot

Yes, it really works. openwrt works with ssh.
I try to SSH terminal:
cd /tmp && sysupgrade -F -n -v FW_WRT1900ACS_1.0.3.187766_prod.img

But the same trouble again, without normal internet, complete give up.

GUI in openwrt or ssh, divested-wrt-snapshot-r29344+9-9073b48e96-mvebu-cortexa9-linksys_wrt1900acs-squashfs-sysupgrade.bin without any saving.

I also try to micro edge success, but the kernel is older.

The openwrt firmware for wrt1900acs advantage is kernel 6.6.xx, the disadvantge is wan speed is 66M vs ddwrt 110M, and less 16MiB for some app.

Anyway, it can works better than a bricker.
Be patient waiting. finally it works