WRT1900AC V2 unable to load non-linksys firmware through USB-TTL or WEBGUI

Some context in this thread:

Essentially, the only images I've been able to successfully flash from the Marvell>> serial prompt have been OEM stock firmware from linksys. I will try the suggestion to load LEDE trunk firmware and see where it goes from here.

I am getting the same failures when flashing any other firmware other than stock, which is quite puzzling. Is there a different way to mark or clean the bad nand blocks?

I tried doing nand erase.part ubifs from this link, didn't help, but it seemed to lower the number of bad blocks seemingly. Is it safe to erase more marked partitions?

I keep getting this error:

[ 1.374106] UBI error: no valid UBI magic found inside mtd5[ 1.379703] mvsw61xx 10.mvsw61xx: Found MV88E6176 at f1072004.mdio-mi:10
[ 1.386431] mvsw61xx 10.mvsw61xx: Using direct addressing
[ 1.400894] armada38x-rtc f10a3800.rtc: setting system clock to 2003-12-11 07:56:05 UTC (1071129365)
[ 1.410374] Waiting 1 sec before mounting root device...
[ 2.481415] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 2.488915] Please append a correct "root=" boot option; here are the available partitions:
[ 2.497299] 1f00 2048 mtdblock0 [ 2.501314] (driver?)
[ 2.503686] 1f01 256 mtdblock1 [ 2.507701] (driver?)
[ 2.510065] 1f02 256 mtdblock2 [ 2.514084] (driver?)
[ 2.516449] 1f03 1024 mtdblock3 [ 2.520464] (driver?)
[ 2.522832] 1f04 40960 mtdblock4 [ 2.526848] (driver?)
[ 2.529211] 1f05 34816 mtdblock5 [ 2.533231] (driver?)
[ 2.535594] 1f06 40960 mtdblock6 [ 2.539609] (driver?)
[ 2.541976] 1f07 34816 mtdblock7 [ 2.545992] (driver?)
[ 2.548356] 1f08 38912 mtdblock8 [ 2.552375] (driver?)
[ 2.554738] 1f09 6656 mtdblock9 [ 2.558753] (driver?)
[ 2.561116] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 2.569400] CPU1: stopping
[ 2.572114] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.20 #0
[ 2.578046] Hardware name: Marvell Armada 380/385 (Device Tree)
[ 2.583993] [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[ 2.591757] [] (show_stack) from [] (dump_stack+0x7c/0x9c)
[ 2.598998] [] (dump_stack) from [] (handle_IPI+0xcc/0x184)
[ 2.606324] [] (handle_IPI) from [] (gic_handle_irq+0x78/0x94)
[ 2.613911] [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90)
[ 2.621409] Exception stack(0xdf475f90 to 0xdf475fd8)
[ 2.626472] 5f80: 00000001 00000000 00000000 c001b160
[ 2.634668] 5fa0: 00000000 df474000 c061efe4 00000002 c0619138 00000000 df475fe8 00000001
[ 2.642864] 5fc0: df46c040 df475fe0 c000f808 c000f80c 60000013 ffffffff
[ 2.649495] [] (__irq_svc) from [] (arch_cpu_idle+0x2c/0x38)
[ 2.656913] [] (arch_cpu_idle) from [] (cpu_startup_entry+0xf0/0x19c)
[ 2.665112] [] (cpu_startup_entry) from [<000095ac>] (0x95ac)
[ 2.672143] Rebooting in 1 seconds..
BootROM - 1.73
Booting from NAND flash

I am seeing similar posts from this goldencoin5 as well at http://community.linksys.com/t5/facebookforums/facebooksingletopicpage/facebook-app/467606153260351/message-uid/810750/tab/board/page/76. Going to follow his/her journey and see where it takes me. Hopefully me documenting this helps someone else in the future who's unfortunate enough to run into this issue.

I ran
Marvell>> nand bad

Device 0 bad blocks:
fa0000 (kernel -- higher than a00000, lower than 1000000)
1260000 (rootfs -- higher than 1000000, lower than 3200000)
26c0000 (rootfs -- higher than 1000000, lower than 3200000)
2e20000 (rootfs -- higher than 1000000, lower than 3200000)
32a0000 (alt_kernel -- higher than 1000000, lower than 3200000)
7f00000 (syscfg -- higher than 5a00000)
7f20000 (syscfg -- higher than 5a00000)
7f40000 (syscfg -- higher than 5a00000)
7f60000 (syscfg -- higher than 5a00000)
7f80000 (syscfg -- higher than 5a00000)
7fa0000 (syscfg -- higher than 5a00000)
7fc0000 (syscfg -- higher than 5a00000)
7fe0000 (syscfg -- higher than 5a00000)

Marvell>> mtdparts

device nand0 , # parts = 10
#: name size offset mask_flags
0: uboot 0x000000200000 0x000000000000 1
1: u_env 0x000000040000 0x000000200000 0
2: s_env 0x000000040000 0x000000240000 0
3: devinfo 0x000000100000 0x000000900000 0
4: ubifs 0x000005000000 0x000000a00000 0
5: kernel 0x000002800000 0x000000a00000 0
6: rootfs 0x000002200000 0x000001000000 0
7: alt_kernel 0x000002800000 0x000003200000 0
8: alt_rootfs 0x000002200000 0x000003800000 0
9: syscfg 0x000002600000 0x000005a00000 0

active partition: nand0,0 - (uboot) 0x000000200000 @ 0x000000000000

defaults:
mtdids : none
mtdparts: none

So I need to figure out which parts are bad and erase that part.

I recommend you load McDebian.

Then follow the McDebian wiki instructions to load LEDE firmware onto both image locations. This for sure will update the bad blocks tables. I recommend flashing it like this a few times to be sure all the bad blocks are marked.

I will try the McDebian install as you recommend from https://github.com/Chadster766/McDebian/wiki/2.-Firmware-Uploading. Can I use the OEM stock webUI to upload the image, or should I stick to using USB-TTL method?

I tried loading ddwrt image again through flash this time instead of webgui to both partitions. The altnandboot partition is showing the same error about bad blocks. The nandboot partition gets further in the boot process, but eventually errors out with the following. This seems to indicate that things might be getting more corrupted? I'm going to try McDebian next when I'm back from work in the evening.

reset boot counter
sh: can't create /sys/class/hwmon/hwmon0/pwm1: Permission denied
[ 6.283780] random: nonblocking pool is initialized
cannot open /proc/irq/195/smp_affinity
[USB] checking...
umount: can't unmount /mnt: No such file or directory
Name: lan_ifname Value: br0
Name: lan_ifnames Value: eth1 eth0 ath0 ath1
Name: wan_ifname Value: eth0
Name: wan_ifname2 Value: eth0
Name: wan_ifnames Value: eth0
Name: wan_default Value: eth0
ath9k deconfigure_single: phy0 ath0
ath9k deconfigure_single: phy1 ath1
ifconfig: invali[ 8.031622] device br0 entered promiscuous mode
d hw-addr
killall: ead: no process killed
[ 8.302367] device eth1 entered promiscuous mode
sh: [ 8.308420] device br0 left promiscuous mode
ead: not found
[ 8.314073] device br0 entered promiscuous mode
ifconfig: ioctl 0x8914 failed: A[ 8.322935] device br0 left promiscuous mode
ddress not available
ath9k deconfigure_single: phy0 ath0
ath9k decon[ 8.336419] cfg80211: Regulatory domain changed to country: US
figure_single: p[ 8.342674] cfg80211: DFS Master region: FCC
hy1 ath1
[ 8.342675] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[ 8.342681] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[ 8.342683] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2300 mBm), (N/A)
[ 8.342685] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (N/A)
[ 8.342688] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2300 mBm), (N/A)
[ 8.342690] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[ 8.342692] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[ 10.301154] mvneta f1070000.ethernet eth1: link up
[ 10.305967] br0: port 1(eth1) entered forwarding state
[ 10.311127] br0: port 1(eth1) entered forwarding state
resetbutton: factory default.
send dhcp lease release signal
[ 12.301139] br0: port 1(eth1) entered forwarding state
ath9k configure_single: phy0 ath0
sh: can't create /sys/kernel/debug/ieee80211/phy0/ath9k/chanbw: nonexistent directory
sh: can't create /sys/kernel/debug/ieee80211/phy0/ath9k/ani: nonexistent directory
command failed: Not supported (-95)
call mac80211autochannel for interface: ath0
Sending SIGTERM [ 12.785323] watchdog watchdog0: watchdog did not stop!
to all processes
Sending SIGKILL to all processes
unmounting /
unmounting /

Here's my output from flashing, if that helps identify bad blocks further:

Marvell>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'cobra.img'.
Load address: 0x2000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##########
7.3 MiB/s
done
Bytes transferred = 30671104 (1d40100 hex)

NAND erase: device 0 offset 0xa00000, size 0x2800000
Skipping bad block at 0x00fa0000
Skipping bad block at 0x01260000
Skipping bad block at 0x026c0000
Skipping bad block at 0x02e20000
Erasing at 0x31e0000 -- 100% complete.
OK

NAND erase: device 0 offset 0x3200000, size 0x2800000
Skipping bad block at 0x032a0000
Erasing at 0x59e0000 -- 100% complete.
OK

NAND write: device 0 offset 0xa00000, size 0x1d40100
Skip bad block 0x00fa0000
Skip bad block 0x01260000
Skip bad block 0x026c0000
30671104 bytes written: OK

NAND write: device 0 offset 0x3200000, size 0x1d40100
Skip bad block 0x032a0000
30671104 bytes written: OK

Lots of bad block in the primary image location.

If you continue to have problems try the McDebian flash technique from a clean McDebian install because the output will show bad blocks as being marked bad. Then see what happens when you load LEDE.

Do you mean these instructions here?:

I have the USB prepped to go with the root filesystem. Just waiting until the evening when I get home to try it again. I hope it's able to flash the Mcdebian image enough to access the USB.

So essentially I will be doing the following steps:

  1. Plug in USB prepped with contents of http://www.protechs-online.com/downloads/McDebian/rootfs/mcdebian-router-WRT-1900-1200-3200-Kernel_4_9_12-base.gz
  2. Boot to Marvell>> prompt using USB-TTL cable
  3. Throw http://www.protechs-online.com/downloads/McDebian/firmwares/McDebian-WRT1900AC-V2-FW_VER1_kernel_4.9.12.img on to my TFTP server (and rename to cobra.img)
  4. Using Marvell>>run update_both_images, flash this to both partitions
  5. Marvell>>reset
  6. Wait for McDebian to start up
  7. From within McDebian (probably over SSH over wired ethernet) download LEDE image somewhere.
  8. Follow the instructions that say: Erase the primary and alternate firmware MTD partition

WRT1900AC\S V1\V2, WRT1200AC V1\V2

flash_erase /dev/mtd4 0 0
flash_erase /dev/mtd5 0 0
flash_erase /dev/mtd6 0 0
flash_erase /dev/mtd7 0 0
9) Flash the firmware to the primary and alternate MTD partitions

WRT1900AC\S V1\V2, WRT1200AC V1\V2

nandwrite -p /dev/mtd4 LEDE-firmware-filename
nandwrite -p /dev/mtd6 LEDE-firmware-filename

  1. Reboot, hopefully it should boot into LEDE?

Does McDebian clean up the bad blocks when it is installed? Is it step 8 where we flash_erase and write 0s to the nand partitions that does it?

And if that doesn't work, I see other users have had similar problems with nand blocks being bad:

http://community.linksys.com/t5/Wireless-Routers/WRT1900AC-and-OpenWrt/m-p/963018#M306183
https://forum.openwrt.org/viewtopic.php?pid=286838#p286838
https://forum.openwrt.org/viewtopic.php?pid=286815#p286815

I am going to give this set of commands a try if McDebian install doesn't work:

ValCher wrote:
I said the team "nand markbad off" one bad, tried to clean it
nand scrub.part, but nothing happened. Bad remained not know can
something not done. Remove it could only nand scrub.chip.
Prior to this team, and I copied Uboot Devinfo in memory of the router.
How to do it:
Uboot
nand read 2000000 0 100000
Devinfo
nand read 3000000 900000 100000

nand scrub.chip
nand erase.chip
nand write 2000000 0 100000
nand write 3000000 900000 100000

setenv ipaddr 192.168.1.1
setenv netmask 255.255.255.0
setenv serverip 192.168.1.254
setenv firmware_name FW_WRT1900AC_1.1.10.167514_prod.img
run update_both_images

Yes you got it.

I can't remember which but its either step 8 or 9.

I don't recommend running "nand scrub.chip" this will erase all MTD partitions including u-boot, u-boot env and the Linksys devinfo partitions. You will have to reinstall the boot loader and recover the Linksys partition information if you didn't back it up. :fearful:

Won't this part write those back from memory? Or will it need still need a boot loader re-install? The steps seem to indicate that this part will recover it.
nand read 2000000 0 100000
nand read 3000000 900000 100000
nand write 2000000 0 100000
nand write 3000000 900000 100000

So, the McDebian image isn't working. I flashed McDebian-WRT1900AC-V2-FW_VER1_kernel_4.9.12.img to both partitions (The initial TTT is from when I forgot to plug in my ethernet cable):

Marvell>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'cobra.img'.
Load address: 0x2000000
Loading: T T T #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
         242.2 KiB/s
done
Bytes transferred = 3853073 (3acb11 hex)

NAND erase: device 0 offset 0xa00000, size 0x2800000
Skipping bad block at  0x00fa0000
Skipping bad block at  0x01260000
Skipping bad block at  0x026c0000
Skipping bad block at  0x02e20000
Erasing at 0x31e0000 -- 100% complete.
OK

NAND erase: device 0 offset 0x3200000, size 0x2800000
Skipping bad block at  0x032a0000
Erasing at 0x59e0000 -- 100% complete.
OK

NAND write: device 0 offset 0xa00000, size 0x3acb11
 3853073 bytes written: OK

NAND write: device 0 offset 0x3200000, size 0x3acb11
Skip bad block 0x032a0000
 3853073 bytes written: OK
Marvell>> reset

Then here is output of a failed boot from nandboot partition

auto_recovery_check changes bootcmd: run nandboot
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0xa00000, size 0x600000
Skipping bad block 0x00fa0000
 6291456 bytes read: OK
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   linux
   Created:      2017-02-25  11:20:23 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3853009 Bytes = 3.7 MiB
   Load Address: 00200000
   Entry Point:  00200000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK


    1.361096] xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 3
[    1.368643] usb usb3: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.377036] hub 3-0:1.0: USB hub found
[    1.380807] hub 3-0:1.0: 1 port detected
[    1.385146] input: gpio_keys as /devices/platform/gpio_keys/input/input0
[    1.392449] Waiting 5 sec before mounting root device...
[    5.691706] usb 2-1: new high-speed USB device number 2 using xhci-hcd
[    5.864136] usb-storage 2-1:1.0: USB Mass Storage device detected
[    5.870334] scsi host2: usb-storage 2-1:1.0
[    6.481771] VFS: Cannot open root device "sda1" or unknown-block(0,0): error -6
[    6.489096] Please append a correct "root=" boot option; here are the available partitions:
[    6.497479] 1f00            2048 mtdblock0 [    6.501495]  (driver?)
[    6.503866] 1f01             256 mtdblock1 [    6.507881]  (driver?)
[    6.510244] 1f02             256 mtdblock2 [    6.514263]  (driver?)
[    6.516627] 1f03            1024 mtdblock3 [    6.520641]  (driver?)
[    6.523010] 1f04           40960 mtdblock4 [    6.527025]  (driver?)
[    6.529388] 1f05           34816 mtdblock5 [    6.533407]  (driver?)
[    6.535770] 1f06           40960 mtdblock6 [    6.539785]  (driver?)
[    6.542151] 1f07           34816 mtdblock7 [    6.546166]  (driver?)
[    6.548529] 1f08           38912 mtdblock8 [    6.552548]  (driver?)
[    6.554911] 1f09            6656 mtdblock9 [    6.558926]  (driver?)
[    6.561289] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    6.569572] CPU1: stopping
[    6.572286] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.12 #13
[    6.578305] Hardware name: Marvell Armada 380/385 (Device Tree)
[    6.584250] [<c010f658>] (unwind_backtrace) from [<c010b404>] (show_stack+0x10/0x14)
[    6.592016] [<c010b404>] (show_stack) from [<c0331a8c>] (dump_stack+0x90/0xa4)
[    6.599257] [<c0331a8c>] (dump_stack) from [<c010e49c>] (handle_IPI+0x170/0x190)
[    6.606670] [<c010e49c>] (handle_IPI) from [<c0101530>] (gic_handle_irq+0x88/0x8c)
[    6.614257] [<c0101530>] (gic_handle_irq) from [<c010bf0c>] (__irq_svc+0x6c/0x90)
[    6.621755] Exception stack(0xdf469f88 to 0xdf469fd0)
[    6.626818] 9f80:                   00000001 00000000 df469fe0 c0118260 df468000 c0a03080
[    6.635014] 9fa0: c0a0302c 00000002 00000000 00000000 c094e5c8 c0a03088 c094c3c0 df469fd8
[    6.643209] 9fc0: c010818c c0108190 60000013 ffffffff
[    6.648272] [<c010bf0c>] (__irq_svc) from [<c0108190>] (arch_cpu_idle+0x38/0x3c)
[    6.655687] [<c0108190>] (arch_cpu_idle) from [<c01592d0>] (cpu_startup_entry+0x180/0x210)
[    6.663971] [<c01592d0>] (cpu_startup_entry) from [<0010166c>] (0x10166c)
[    6.670775] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

I also tried the altnandboot:
Marvell>> run altnandboot

NAND read: device 0 offset 0x3200000, size 0x600000
Skipping bad block 0x032a0000
 6291456 bytes read: OK
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   linux
   Created:      2017-02-25  11:20:23 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3853009 Bytes = 3.7 MiB
   Load Address: 00200000
   Entry Point:  00200000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK


[    1.303665] Registering SWP/SWPB emulation handler
[    1.309522] xhci-hcd f10f8000.usb3: xHCI Host Controller
[    1.314871] xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 2
[    1.322436] xhci-hcd f10f8000.usb3: hcc params 0x0a000990 hci version 0x100 quirks 0x00010010
[    1.330997] xhci-hcd f10f8000.usb3: irq 43, io mem 0xf10f8000
[    1.337108] hub 2-0:1.0: USB hub found
[    1.340882] hub 2-0:1.0: 1 port detected
[    1.344952] xhci-hcd f10f8000.usb3: xHCI Host Controller
[    1.347946] ata2: SATA link down (SStatus 0 SControl 300)
[    1.347972] ata1: SATA link down (SStatus 0 SControl 300)
[    1.361105] xhci-hcd f10f8000.usb3: new USB bus registered, assigned bus number 3
[    1.368657] usb usb3: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.377053] hub 3-0:1.0: USB hub found
[    1.380824] hub 3-0:1.0: 1 port detected
[    1.385163] input: gpio_keys as /devices/platform/gpio_keys/input/input0
[    1.392842] Waiting 5 sec before mounting root device...
[    5.691738] usb 2-1: new high-speed USB device number 2 using xhci-hcd
[    5.864175] usb-storage 2-1:1.0: USB Mass Storage device detected
[    5.870375] scsi host2: usb-storage 2-1:1.0
[    6.481803] VFS: Cannot open root device "sda1" or unknown-block(0,0): error -6
[    6.489128] Please append a correct "root=" boot option; here are the available partitions:
[    6.497510] 1f00            2048 mtdblock0 [    6.501525]  (driver?)
[    6.503896] 1f01             256 mtdblock1 [    6.507912]  (driver?)
[    6.510276] 1f02             256 mtdblock2 [    6.514296]  (driver?)
[    6.516660] 1f03            1024 mtdblock3 [    6.520675]  (driver?)
[    6.523044] 1f04           40960 mtdblock4 [    6.527058]  (driver?)
[    6.529421] 1f05           34816 mtdblock5 [    6.533439]  (driver?)
[    6.535803] 1f06           40960 mtdblock6 [    6.539818]  (driver?)
[    6.542186] 1f07           34816 mtdblock7 [    6.546200]  (driver?)
[    6.548564] 1f08           38912 mtdblock8 [    6.552583]  (driver?)
[    6.554947] 1f09            6656 mtdblock9 [    6.558962]  (driver?)
[    6.561326] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    6.569609] CPU1: stopping
[    6.572324] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.12 #13
[    6.578342] Hardware name: Marvell Armada 380/385 (Device Tree)
[    6.584287] [<c010f658>] (unwind_backtrace) from [<c010b404>] (show_stack+0x10/0x14)
[    6.592053] [<c010b404>] (show_stack) from [<c0331a8c>] (dump_stack+0x90/0xa4)
[    6.599293] [<c0331a8c>] (dump_stack) from [<c010e49c>] (handle_IPI+0x170/0x190)
[    6.606707] [<c010e49c>] (handle_IPI) from [<c0101530>] (gic_handle_irq+0x88/0x8c)
[    6.614294] [<c0101530>] (gic_handle_irq) from [<c010bf0c>] (__irq_svc+0x6c/0x90)
[    6.621792] Exception stack(0xdf469f88 to 0xdf469fd0)
[    6.626854] 9f80:                   00000001 00000000 df469fe0 c0118260 df468000 c0a03080
[    6.635050] 9fa0: c0a0302c 00000002 00000000 00000000 c094e5c8 c0a03088 c094c3c0 df469fd8
[    6.643245] 9fc0: c010818c c0108190 60000013 ffffffff
[    6.648309] [<c010bf0c>] (__irq_svc) from [<c0108190>] (arch_cpu_idle+0x38/0x3c)
[    6.655724] [<c0108190>] (arch_cpu_idle) from [<c01592d0>] (cpu_startup_entry+0x180/0x210)
[    6.664008] [<c01592d0>] (cpu_startup_entry) from [<0010166c>] (0x10166c)
[    6.670812] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

I have no idea what to do next. I'm scared/concerned that if I try nand scrub, even the OEM image won't work.

Plug the McDebian usb key into the usb2 and reboot.

I flashed Linksys OEM firmware, and then loaded McDebian from within it, while having USB plugged in, and rebooted. Now I have McDebian working. I assume I proceed with the flash_erase instructions?

[ 1.392540] Waiting 5 sec before mounting root device...
[ 1.701712] usb 2-1: new high-speed USB device number 2 using xhci-hcd
[ 1.874142] usb-storage 2-1:1.0: USB Mass Storage device detected
[ 1.880342] scsi host2: usb-storage 2-1:1.0
[ 2.962101] scsi 2:0:0:0: Direct-Access ADATA USB Flash Drive 0.00 PQ: 0 ANSI: 2
[ 2.970705] sd 2:0:0:0: [sda] 15806464 512-byte logical blocks: (8.09 GB/7.54 GiB)
[ 2.978417] sd 2:0:0:0: [sda] Write Protect is off
[ 2.983330] sd 2:0:0:0: [sda] Asking for cache data failed
[ 2.988827] sd 2:0:0:0: [sda] Assuming drive cache: write through
[ 2.996441] sda: sda1
[ 3.007736] sd 2:0:0:0: [sda] Attached SCSI removable disk
[ 6.482358] EXT4-fs (sda1): couldn't mount as ext3 due to feature incompatibilities
[ 6.559287] random: fast init done
[ 8.211071] EXT4-fs (sda1): recovery complete
[ 8.220490] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null)
[ 8.228188] VFS: Mounted root (ext4 filesystem) on device 8:1.
[ 8.240399] devtmpfs: mounted
[ 8.243800] Freeing unused kernel memory: 1024K (c0900000 - c0a00000)
[ 8.382297] systemd[1]: systemd 215 running in system mode. (+PAM +AUDIT +SELINUX +IMA +SYSVINIT +LIBCRYPTSETUP +GCRYPT +ACL +XZ -SECCOMP -APPARMOR)
[ 8.395756] systemd[1]: Detected architecture 'arm'.

Welcome to Debian GNU/Linux 8 (jessie)!

[ 8.786338] NET: Registered protocol family 10
[ 8.791283] systemd[1]: Inserted module 'ipv6'
[ 8.799049] systemd[1]: Set hostname to .

Ok I've erased mtd partitions, here comes the flash....

Last login: Wed Dec 31 18:00:22 CST 1969 on ttyS0
Linux MCDEBIAN 4.9.12 #13 SMP Sat Feb 25 05:18:48 CST 2017 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@MCDEBIAN:~# ls
root@MCDEBIAN:~# cd /tmp/
root@MCDEBIAN:/tmp# dir
lede-mvebu-linksys-wrt1900acv2-squashfs-factory\ (2).img
systemd-private-7b3710bbe48a4bb0a0441bc8ffe2be9a-dibbler-client.service-KBvAGP
).img CDEBIAN:/tmp# md5sum lede-mvebu-linksys-wrt1900acv2-squashfs-factory\ \(2\)
0e9a41d30d5ed1d7d334610361a4c40e  lede-mvebu-linksys-wrt1900acv2-squashfs-factory (2).img
root@MCDEBIAN:/tmp# flash_erase /dev/mtd4 0 0
Erasing 128 Kibyte @ 580000 -- 13 % complete flash_erase: Skipping bad block at 005a0000
Erasing 128 Kibyte @ 840000 -- 20 % complete flash_erase: Skipping bad block at 00860000
Erasing 128 Kibyte @ 1ca0000 -- 71 % complete flash_erase: Skipping bad block at 01cc0000
Erasing 128 Kibyte @ 2400000 -- 90 % complete flash_erase: Skipping bad block at 02420000
Erasing 128 Kibyte @ 27e0000 -- 100 % complete
root@MCDEBIAN:/tmp# flash_erase /dev/mtd5 0 0
Erasing 128 Kibyte @ 240000 --  6 % complete flash_erase: Skipping bad block at 00260000
Erasing 128 Kibyte @ 16a0000 -- 66 % complete flash_erase: Skipping bad block at 016c0000
Erasing 128 Kibyte @ 1e00000 -- 88 % complete flash_erase: Skipping bad block at 01e20000
Erasing 128 Kibyte @ 21e0000 -- 100 % complete
root@MCDEBIAN:/tmp# flash_erase /dev/mtd6 0 0
Erasing 128 Kibyte @ 80000 --  1 % complete flash_erase: Skipping bad block at 000a0000
Erasing 128 Kibyte @ 27e0000 -- 100 % complete
root@MCDEBIAN:/tmp# flash_erase /dev/mtd7 0 0
Erasing 128 Kibyte @ 21e0000 -- 100 % complete
root@MCDEBIAN:/tmp#

Partitions written. About to reboot. Formatting got messed up since I'm doing it through putty connection.

fs-factory\ \(2\).img ndwrite -p /dev/mtd4 lede-mvebu-linksys-wrt1900acv2-squashf
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
Writing data to block 20 at offset 0x280000
Writing data to block 21 at offset 0x2a0000
Writing data to block 22 at offset 0x2c0000
Writing data to block 23 at offset 0x2e0000
Writing data to block 24 at offset 0x300000
Writing data to block 25 at offset 0x320000
Writing data to block 26 at offset 0x340000
Writing data to block 27 at offset 0x360000
Writing data to block 28 at offset 0x380000
Writing data to block 29 at offset 0x3a0000
Writing data to block 30 at offset 0x3c0000
Writing data to block 31 at offset 0x3e0000
Writing data to block 32 at offset 0x400000
Writing data to block 33 at offset 0x420000
Writing data to block 34 at offset 0x440000
Writing data to block 35 at offset 0x460000
Writing data to block 36 at offset 0x480000
Writing data to block 37 at offset 0x4a0000
Writing data to block 38 at offset 0x4c0000
Writing data to block 39 at offset 0x4e0000
Writing data to block 40 at offset 0x500000
Writing data to block 41 at offset 0x520000
Writing data to block 42 at offset 0x540000
Writing data to block 43 at offset 0x560000
Writing data to block 44 at offset 0x580000
Writing data to block 45 at offset 0x5a0000
Bad block at 5a0000, 1 block(s) from 5a0000 will be skipped
Writing data to block 46 at offset 0x5c0000
Writing data to block 47 at offset 0x5e0000
Writing data to block 48 at offset 0x600000
Writing data to block 49 at offset 0x620000
Writing data to block 50 at offset 0x640000
Writing data to block 51 at offset 0x660000
Writing data to block 52 at offset 0x680000
Writing data to block 53 at offset 0x6a0000
Writing data to block 54 at offset 0x6c0000
Writing data to block 55 at offset 0x6e0000
Writing data to block 56 at offset 0x700000
Writing data to block 57 at offset 0x720000
Writing data to block 58 at offset 0x740000
Writing data to block 59 at offset 0x760000
Writing data to block 60 at offset 0x780000
Writing data to block 61 at offset 0x7a0000
Writing data to block 62 at offset 0x7c0000
Writing data to block 63 at offset 0x7e0000
Writing data to block 64 at offset 0x800000
Writing data to block 65 at offset 0x820000
Writing data to block 66 at offset 0x840000
Writing data to block 67 at offset 0x860000
Bad block at 860000, 1 block(s) from 860000 will be skipped
Writing data to block 68 at offset 0x880000
Writing data to block 69 at offset 0x8a0000
Writing data to block 70 at offset 0x8c0000
Writing data to block 71 at offset 0x8e0000
Writing data to block 72 at offset 0x900000
Writing data to block 73 at offset 0x920000
Writing data to block 74 at offset 0x940000
Writing data to block 75 at offset 0x960000
Writing data to block 76 at offset 0x980000
Writing data to block 77 at offset 0x9a0000
Writing data to block 78 at offset 0x9c0000
Writing data to block 79 at offset 0x9e0000
Writing data to block 80 at offset 0xa00000
Writing data to block 81 at offset 0xa20000
Writing data to block 82 at offset 0xa40000
Writing data to block 83 at offset 0xa60000
Writing data to block 84 at offset 0xa80000
Writing data to block 85 at offset 0xaa0000
Writing data to block 86 at offset 0xac0000
Writing data to block 87 at offset 0xae0000
Writing data to block 88 at offset 0xb00000
Writing data to block 89 at offset 0xb20000
Writing data to block 90 at offset 0xb40000
Writing data to block 91 at offset 0xb60000
Writing data to block 92 at offset 0xb80000
Writing data to block 93 at offset 0xba0000
Writing data to block 94 at offset 0xbc0000
Writing data to block 95 at offset 0xbe0000
Writing data to block 96 at offset 0xc00000
Writing data to block 97 at offset 0xc20000
Writing data to block 98 at offset 0xc40000
Writing data to block 99 at offset 0xc60000
Writing data to block 100 at offset 0xc80000
Writing data to block 101 at offset 0xca0000
Writing data to block 102 at offset 0xcc0000
Writing data to block 103 at offset 0xce0000
Writing data to block 104 at offset 0xd00000
Writing data to block 105 at offset 0xd20000
Writing data to block 106 at offset 0xd40000
Writing data to block 107 at offset 0xd60000
Writing data to block 108 at offset 0xd80000
Writing data to block 109 at offset 0xda0000
Writing data to block 110 at offset 0xdc0000
Writing data to block 111 at offset 0xde0000
Writing data to block 112 at offset 0xe00000
Writing data to block 113 at offset 0xe20000
Writing data to block 114 at offset 0xe40000
Writing data to block 115 at offset 0xe60000
Writing data to block 116 at offset 0xe80000          ot@MCDEBIAN:/tmp# nandwrite -p /dev/mtd6/tmp# nandwrite -p /dev/mtd6 lede-mvebu-linksys-wrt1900acv2-squashfslinksys-wrt1900acv2-squashfs
Writing data to block 0 at offset 0x0/mtd4 lede-mvebu-linksys-wrt1900acv2-squashf
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Bad block at a0000, 1 block(s) from a0000 will be skipped
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
Writing data to block 20 at offset 0x280000
Writing data to block 21 at offset 0x2a0000
Writing data to block 22 at offset 0x2c0000
Writing data to block 23 at offset 0x2e0000
Writing data to block 24 at offset 0x300000
Writing data to block 25 at offset 0x320000
Writing data to block 26 at offset 0x340000
Writing data to block 27 at offset 0x360000
Writing data to block 28 at offset 0x380000
Writing data to block 29 at offset 0x3a0000
Writing data to block 30 at offset 0x3c0000
Writing data to block 31 at offset 0x3e0000
Writing data to block 32 at offset 0x400000
Writing data to block 33 at offset 0x420000
Writing data to block 34 at offset 0x440000
Writing data to block 35 at offset 0x460000
Writing data to block 36 at offset 0x480000
Writing data to block 37 at offset 0x4a0000
Writing data to block 38 at offset 0x4c0000
Writing data to block 39 at offset 0x4e0000
Writing data to block 40 at offset 0x500000
Writing data to block 41 at offset 0x520000
Writing data to block 42 at offset 0x540000
Writing data to block 43 at offset 0x560000
Writing data to block 44 at offset 0x580000
Writing data to block 45 at offset 0x5a0000
Writing data to block 46 at offset 0x5c0000
Writing data to block 47 at offset 0x5e0000
Writing data to block 48 at offset 0x600000
Writing data to block 49 at offset 0x620000
Writing data to block 50 at offset 0x640000
Writing data to block 51 at offset 0x660000
Writing data to block 52 at offset 0x680000
Writing data to block 53 at offset 0x6a0000
Writing data to block 54 at offset 0x6c0000
Writing data to block 55 at offset 0x6e0000
Writing data to block 56 at offset 0x700000
Writing data to block 57 at offset 0x720000
Writing data to block 58 at offset 0x740000
Writing data to block 59 at offset 0x760000
Writing data to block 60 at offset 0x780000
Writing data to block 61 at offset 0x7a0000
Writing data to block 62 at offset 0x7c0000
Writing data to block 63 at offset 0x7e0000
Writing data to block 64 at offset 0x800000
Writing data to block 65 at offset 0x820000
Writing data to block 66 at offset 0x840000
Writing data to block 67 at offset 0x860000
Writing data to block 68 at offset 0x880000
Writing data to block 69 at offset 0x8a0000
Writing data to block 70 at offset 0x8c0000
Writing data to block 71 at offset 0x8e0000
Writing data to block 72 at offset 0x900000
Writing data to block 73 at offset 0x920000
Writing data to block 74 at offset 0x940000
Writing data to block 75 at offset 0x960000
Writing data to block 76 at offset 0x980000
Writing data to block 77 at offset 0x9a0000
Writing data to block 78 at offset 0x9c0000
Writing data to block 79 at offset 0x9e0000
Writing data to block 80 at offset 0xa00000
Writing data to block 81 at offset 0xa20000
Writing data to block 82 at offset 0xa40000
Writing data to block 83 at offset 0xa60000
Writing data to block 84 at offset 0xa80000
Writing data to block 85 at offset 0xaa0000
Writing data to block 86 at offset 0xac0000
Writing data to block 87 at offset 0xae0000
Writing data to block 88 at offset 0xb00000
Writing data to block 89 at offset 0xb20000
Writing data to block 90 at offset 0xb40000
Writing data to block 91 at offset 0xb60000
Writing data to block 92 at offset 0xb80000
Writing data to block 93 at offset 0xba0000
Writing data to block 94 at offset 0xbc0000
Writing data to block 95 at offset 0xbe0000
Writing data to block 96 at offset 0xc00000
Writing data to block 97 at offset 0xc20000
Writing data to block 98 at offset 0xc40000
Writing data to block 99 at offset 0xc60000
Writing data to block 100 at offset 0xc80000
Writing data to block 101 at offset 0xca0000
Writing data to block 102 at offset 0xcc0000
Writing data to block 103 at offset 0xce0000
Writing data to block 104 at offset 0xd00000
Writing data to block 105 at offset 0xd20000
Writing data to block 106 at offset 0xd40000
Writing data to block 107 at offset 0xd60000
Writing data to block 108 at offset 0xd80000
Writing data to block 109 at offset 0xda0000
Writing data to block 110 at offset 0xdc0000
Writing data to block 111 at offset 0xde0000
Writing data to block 112 at offset 0xe00000
Writing data to block 113 at offset 0xe20000
Writing data to block 114 at offset 0xe40000
Writing data to block 115 at offset 0xe60000
Writing data to block 116 at offset 0xe80000
root@MCDEBIAN:/tmp#

FFFUUUUUUUUUUUUUUUUUUUUUUU, it's failing with the same kernel panic with a LEDE image.

[    1.369876] hub 3-0:1.0: 1 port detected
[    1.374134] UBI error: no valid UBI magic found inside mtd5[    1.379727] mvsw61xx 10.mvsw61xx: Found MV88E6176 at f1072004.mdio-mi:10
[    1.386455] mvsw61xx 10.mvsw61xx: Using direct addressing
[    1.400745] armada38x-rtc f10a3800.rtc: setting system clock to 1970-01-01 00:15:21 UTC (921)
[    1.409615] Waiting 1 sec before mounting root device...
[    2.481464] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.488964] Please append a correct "root=" boot option; here are the available partitions:
[    2.497348] 1f00            2048 mtdblock0 [    2.501364]  (driver?)
[    2.503736] 1f01             256 mtdblock1 [    2.507752]  (driver?)
[    2.510116] 1f02             256 mtdblock2 [    2.514135]  (driver?)
[    2.516499] 1f03            1024 mtdblock3 [    2.520514]  (driver?)
[    2.522882] 1f04           40960 mtdblock4 [    2.526897]  (driver?)
[    2.529261] 1f05           34816 mtdblock5 [    2.533279]  (driver?)
[    2.535643] 1f06           40960 mtdblock6 [    2.539658]  (driver?)
[    2.542026] 1f07           34816 mtdblock7 [    2.546041]  (driver?)
[    2.548405] 1f08           38912 mtdblock8 [    2.552424]  (driver?)
[    2.554789] 1f09            6656 mtdblock9 [    2.558803]  (driver?)
[    2.561168] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.569451] CPU1: stopping
[    2.572167] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.20 #0
[    2.578098] Hardware name: Marvell Armada 380/385 (Device Tree)
[    2.584045] [<c0016010>] (unwind_backtrace) from [<c0012220>] (show_stack+0x10/0x14)
[    2.591811] [<c0012220>] (show_stack) from [<c020f63c>] (dump_stack+0x7c/0x9c)
[    2.599050] [<c020f63c>] (dump_stack) from [<c0014f0c>] (handle_IPI+0xcc/0x184)
[    2.606376] [<c0014f0c>] (handle_IPI) from [<c0009450>] (gic_handle_irq+0x78/0x94)
[    2.613963] [<c0009450>] (gic_handle_irq) from [<c0012c8c>] (__irq_svc+0x6c/0x90)
[    2.621462] Exception stack(0xdf475f90 to 0xdf475fd8)
[    2.626524] 5f80:                                     00000001 00000000 00000000 c001b160
[    2.634721] 5fa0: 00000000 df474000 c061efe4 00000002 c0619138 00000000 df475fe8 00000001
[    2.642917] 5fc0: df46c040 df475fe0 c000f808 c000f80c 60000013 ffffffff
[    2.649547] [<c0012c8c>] (__irq_svc) from [<c000f80c>] (arch_cpu_idle+0x2c/0x38)
[    2.656965] [<c000f80c>] (arch_cpu_idle) from [<c005b00c>] (cpu_startup_entry+0xf0/0x19c)
[    2.665164] [<c005b00c>] (cpu_startup_entry) from [<000095ac>] (0x95ac)
[    2.672194] Rebooting in 1 seconds..

and altnandboot

[    1.295232] UBI error: no valid UBI magic found inside mtd7
[    1.295232] mvsw61xx 10.mvsw61xx: Found MV88E6176 at f1072004.mdio-mi:10
[    1.295235] mvsw61xx 10.mvsw61xx: Using direct addressing
[    1.308452] armada38x-rtc f10a3800.rtc: setting system clock to 1970-01-01 00:15:43 UTC (943)
[    1.392907] Waiting 1 sec before mounting root device...
[    1.392981] ata2: SATA link down (SStatus 0 SControl 300)
[    2.481598] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.489098] Please append a correct "root=" boot option; here are the available partitions:
[    2.497483] 1f00            2048 mtdblock0 [    2.501499]  (driver?)
[    2.503871] 1f01             256 mtdblock1 [    2.507887]  (driver?)
[    2.510251] 1f02             256 mtdblock2 [    2.514271]  (driver?)
[    2.516636] 1f03            1024 mtdblock3 [    2.520651]  (driver?)
[    2.523018] 1f04           40960 mtdblock4 [    2.527033]  (driver?)
[    2.529397] 1f05           34816 mtdblock5 [    2.533416]  (driver?)
[    2.535781] 1f06           40960 mtdblock6 [    2.539796]  (driver?)
[    2.542164] 1f07           34816 mtdblock7 [    2.546179]  (driver?)
[    2.548542] 1f08           38912 mtdblock8 [    2.552561]  (driver?)
[    2.554925] 1f09            6656 mtdblock9 [    2.558940]  (driver?)
[    2.561304] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.569587] CPU1: stopping
[    2.572302] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.20 #0
[    2.578234] Hardware name: Marvell Armada 380/385 (Device Tree)
[    2.584182] [<c0016010>] (unwind_backtrace) from [<c0012220>] (show_stack+0x10/0x14)
[    2.591947] [<c0012220>] (show_stack) from [<c020f63c>] (dump_stack+0x7c/0x9c)
[    2.599187] [<c020f63c>] (dump_stack) from [<c0014f0c>] (handle_IPI+0xcc/0x184)
[    2.606513] [<c0014f0c>] (handle_IPI) from [<c0009450>] (gic_handle_irq+0x78/0x94)
[    2.614101] [<c0009450>] (gic_handle_irq) from [<c0012c8c>] (__irq_svc+0x6c/0x90)
[    2.621599] Exception stack(0xdf475f90 to 0xdf475fd8)
[    2.626661] 5f80:                                     00000001 00000000 00000000 c001b160
[    2.634858] 5fa0: 00000000 df474000 c061efe4 00000002 c0619138 00000000 df475fe8 00000001
[    2.643055] 5fc0: df46c040 df475fe0 c000f808 c000f80c 60000013 ffffffff
[    2.649686] [<c0012c8c>] (__irq_svc) from [<c000f80c>] (arch_cpu_idle+0x2c/0x38)
[    2.657104] [<c000f80c>] (arch_cpu_idle) from [<c005b00c>] (cpu_startup_entry+0xf0/0x19c)
[    2.665302] [<c005b00c>] (cpu_startup_entry) from [<000095ac>] (0x95ac)
[    2.672332] Rebooting in 1 seconds..
BootROM - 1.73