Hello forum, I have a MR7350 on version listed in the wiki, I believe is one of the first ones (will post the version on my second post, I have that info on another computer).
The issue is that trying to upgrade to the most recent SNAPSHOT, the unit error out, did not take the file and rebooted. Looking at the UART log, there is an error “cant get kernel image”.
What is teh safest options to reflash the router?
you should probably check your u-boot env, by running printenv in u-boot, look for the bootcmd variable.
I wish I saw this over the weekend. I compiled snapshot firmware for my MR7350 and it bricked based on snapshot from 6 Sep 2025. So i un-bricked it Saturday reflashing both flashimg and flashimg2 successfully to factory firmware. I did not have this issue with the MR5500 as I was playing and learning. Later this week depending on work load I will see if I can save my printenv output form uboot from my MR7350, they should be the same, correct?
Since it was bricked the MR7350 went right into U-Boot. How do I interrupt the boot procedure so I can issue the commands?
To reply to frollic, this is what is showing using the printenv in u-boot
boot_part=2
boot_part_ready=3
boot_ver=2.3.01
bootargs=console=ttyMSM0,115200n8
bootcmd=i2c dev 0 && i2c probe && i2c mw 0x62 0x00 0x00 1 && i2c mw 0x62 0x01 0x05 1 && i2c mw 0x62 0x08 0x00 1 && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi
bootdelay=1
bootpart1=setenv bootargs $partbootargs && nand read $loadaddr $prikern $kernsize && bootm $loadaddr
bootpart2=setenv bootargs $partbootargs2 && nand read $loadaddr $altkern $kernsize && bootm $loadaddr
ethact=eth0
Really do not want to loose this router, I have it sitting on the bench now, but I am being extremelly careful about which route I should take to get it back working.
I think the safest way should be to do what Peppermint is sugesting. To flash the stock firmware on both partitions, and once I get the unit (stable and booting up properly) then try flashing the SNAPSHOT firmware He used for his unit.
I am technical and understand some concepts, but do not know all the commands to get flashing from Uboot, and the file to /tmp, if that is the route to take.
Thanks to both of you
I believe, pressing ESC key right before booting stops the secuence and from there one can type the commands needed.
Just for fun, try
i2c dev 0 && i2c probe && i2c mw 0x62 0x00 0x00 1 && i2c mw 0x62 0x01 0x05 1 && i2c mw 0x62 0x08 0x00 1
bootipq
I have a known good snapshot for the MR7350 in case you have issues with current ones.
If is not too much to ask, can you share it, or send me a link where to get it from.
Thanks
Question - just so I learn, what does that do?
Boot something, hopefully ,)
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (0-0)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq6018_edma_alloc_rings: successfull
ipq6018_edma_setup_ring_resources: successfull
ipq6018_edma_configure_rings: successfull
ipq6018_edma_hw_init: successfull
eth0
IPQ6018# i2c dev 0 && i2c probe && i2c mw 0x62 0x00 0x00 1 && i2c mw 0x62 0x01 0x05 1 && i2c mw 0x62 0x08 0x00 1
Setting bus to 0
Valid chip addresses: 62
IPQ6018# bootipq
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 74 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 590, bad PEBs: 2, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1534575391
ubi0: available PEBs: 0, total reserved PEBs: 590, PEBs reserved for bad PEB handling: 32
Read 0 bytes from volume kernel to 44000000
Volume kernel not found!
ubi0: detaching mtd1
ubi0: mtd1 is detached
I ommited the MAC address since this is a public forum. Thanks
NAND read: device 0 offset 0x1480000, size 0x800000
8388608 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
tar.gz OK? both factory and sysupgrade. Factory I know you have or can get, this is only openwrt snapshot. This has Luci already from the customized images option.
Appreciate, the fast response. got both files. Still need to read about how to flash from UBOOT.
I do not think, TFTP will work, unless there is a script or something of that sort, that I am missing.
But, ultimatelly - I think - going to stock first and then trying the file you provided - what do you guys think?
BIG THING. get tftp working. I run linux mint and use tfpd-hpa. get that set up first
If you are using Windows, I can not help as I do not own a Windows machine
my first debrick, worked on the MR7350 except I set static Ip to 192.168.99.1. - which I just did Saturday on the MR7350 since the snapshot did not take
basically setenv is safe since it resets on reboot. this also allows you to set the server and client ip so everything is set up. If you Get ‘T’ - something is wrong with your TFPT server. I had that saturday and had to reinstall ftpd-hpa, which was messed up after linux mint upgrade from 22.1 to 22.2. then manually re set up and it worked.
I use picocom (linux mint and LMDE)
picocom -b 115200 /dev/ttyUSB0
LINUX setup
tftpd-hpa server running
create a directory to store files for the firmware
example /home/user/Downloads/tftp
chmod -R 777 /home/user/Downloads/tftp
edit tftpd-hpa
sudo nano /etc/default/tftpd-hpa
TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/home/user/Downloads/tftp"
TFTP_ADDRESS="0.0.0.0:69"
TFTP_OPTIONS="--secure --create"
Set static IP, I used network manager and edited my wired connection to lexridge's post
setenv image FW_MR5500_1.1.2.209598_prod.img
setenv ipaddr 192.168.99.1
setenv serverip 192.168.99.15
run flashimg
run flashimg2
obviously change your firmware name, I flashed Factory for MR7350 and it works the exact same
NEVER USE SAVEENV, only setenv which is temp is UBoot
You guys gave me some homework, Nice! Let me get setup for that. Funny thing is - had on my to do - setup a box on Linux Mint, for some other things personal and work.
Thanks for taking the time and sharing the knowledge !!!
I am not suggesting any specific OS, I did this also on Fedora, and LMDE (Linux Mint Debian Edition - it’s Debian but with Cinnamon desktop and other minor tweaks). I only wanted to make clear this was Linux instructions I learned to debrick on with the MR5500 - and worked exactly the same for the Linksys MR7350. I know there are plenty of Windows instructions out there also, and I am sure people on here know. Once in Uboot you already know the commands are the same. I definitely have had better success with picocom over minicom. The pic above is my MR7350 board when it was flashing back to factory.
If you copy what I have above, and for anyone reading this:
Set the static IP on your PC to 192.168.99.15. This is the computer which you are running tftp service. the 192.168.99.1 would be the routers temporary ip address. Setting your own addresses takes out the guess work, some like it, some do not - I happen to like it as I was hand-held how to do this on DDWRT boards.
After you have a successful flash - no not forget to reset your static IP on your computer to DHCP/Automatic. the setenv will not stay and router will return to defaults so you do not have to worry about it.
So far I got everything setup. Having issues with the command setenv
setenv image FW_MR7350_1.1.7.209317_prod.img
setenv ipaddr 192.168.99.1
setenv serverip 192.168.99.15
run flashimg
Because UBOOT does not understands that, at some point it looked like it was loading, but I realized I was on the wrong NIC card - Switched everything back, now my working is proper on the right PC.
This is where the router is getting lock on boot:
Loading kernel from FIT Image at 44000000 ...
Using 'config@1' configurationTrying 'kernel-1' kernel subimageDescription: ARM64 OpenWrt Linux-6.12.44Type: Kernel ImageCompression: gzip compressedData Start: 0x440000e8Data Size: 5599514 Bytes = 5.3 MiBArchitecture: AArch64OS: LinuxLoad Address: 0x41000000Entry Point: 0x41000000Hash algo: crc32Hash value: a1a9b29aHash algo: sha1Hash value: 8313a9938ca85176a27839d2c0537843b8d25e5fVerifying Hash Integrity ... crc32+ sha1+ OK
Loading fdt from FIT Image at 44000000 ...
Using 'config@1' configurationTrying 'fdt-1' fdt subimageDescription: ARM64 OpenWrt linksys_mr7350 device tree blobType: Flat Device TreeCompression: uncompressedData Start: 0x44557344Data Size: 37201 Bytes = 36.3 KiBArchitecture: AArch64Hash algo: crc32Hash value: a115b969Hash algo: sha1Hash value: d81ba72cc06b077cdd7bb4a5ace833f92a589de4Verifying Hash Integrity ... crc32+ sha1+ OKBooting using the fdt blob at 0x44557344Uncompressing Kernel Image ... OKLoading Device Tree to 484f3000, end 484ff150 ... OKCould not find PCI in device treeUsing machid 0x8030200 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014][ 0.000000] Linux version 6.12.44 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r30963-79d3db7447) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Fri Sep 5 16:19:24 2025[ 0.000000] Machine model: Linksys MR7350[ 0.000000] OF: reserved mem: 0x0000000000060000..0x0000000000065fff (24 KiB) nomap non-reusable memory@60000[ 0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 KiB) nomap non-reusable memory@40000000[ 0.000000] OF: reserved mem: 0x000000004a100000..0x000000004a4fffff (4096 KiB) nomap non-reusable bootloader@4a100000[ 0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 KiB) nomap non-reusable memory@4a600000[ 0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable memory@4aa00000[ 0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004fffffff (87040 KiB) nomap non-reusable memory@4ab00000[ 0.000000] Zone ranges:[ 0.000000] DMA [mem 0x0000000040000000-0x000000005fffffff][ 0.000000] DMA32 empty[ 0.000000] Normal empty[ 0.000000] Movable zone start for each node[ 0.000000] Early memory node ranges[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000040ffffff][ 0.000000] node 0: [mem 0x0000000041000000-0x000000004a0fffff][ 0.000000] node 0: [mem 0x000000004a100000-0x000000004a4fffff][ 0.000000] node 0: [mem 0x000000004a500000-0x000000004a5fffff][ 0.000000] node 0: [mem 0x000000004a600000-0x000000004fffffff][ 0.000000] node 0: [mem 0x0000000050000000-0x000000005fffffff][ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff][ 0.000000] psci: probing for conduit method from DT.[ 0.000000] psci: PSCIv1.0 detected in firmware.[ 0.000000] psci: Using standard PSCI v0.2 function IDs[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.[ 0.000000] psci: SMC Calling Convention v1.0[ 0.000000] percpu: Embedded 20 pages/cpu s43288 r8192 d30440 u81920[ 0.000000] Detected VIPT I-cache on CPU0[ 0.000000] CPU features: detected: Spectre-v4[ 0.000000] alternatives: applying boot alternatives[ 0.000000] Kernel command line: init=/sbin/init rootfstype=squashfs ubi.mtd=alt_rootfs root=mtd:squashfs rootwait root=/dev/ubiblock0_0[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 131072[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB[ 0.000000] software IO TLB: area num 4.[ 0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 1MB[ 0.000000] software IO TLB: mapped [mem 0x000000005f4c0000-0x000000005f5c0000] (1MB)[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1[ 0.000000] rcu: Hierarchical RCU implementation.[ 0.000000] Tracing variant of Tasks RCU enabled.[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.[ 0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0[ 0.000000] Root IRQ handler: gic_handle_irq[ 0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479][ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns[ 0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns[ 0.000088] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)[ 0.000101] pid_max: default: 32768 minimum: 301[ 0.005046] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)[ 0.005059] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)[ 0.009859] rcu: Hierarchical SRCU implementation.[ 0.009867] rcu: Max phase no-delay instances is 1000.[ 0.010200] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level[ 0.010608] smp: Bringing up secondary CPUs ...[ 0.011269] Detected VIPT I-cache on CPU1[ 0.011376] CPU1: Booted secondary processor 0x0000000001 [0x51af8014][ 0.012125] Detected VIPT I-cache on CPU2[ 0.012199] CPU2: Booted secondary processor 0x0000000002 [0x51af8014][ 0.012961] Detected VIPT I-cache on CPU3[ 0.013031] CPU3: Booted secondary processor 0x0000000003 [0x51af8014][ 0.013116] smp: Brought up 1 node, 4 CPUs[ 0.013125] SMP: Total of 4 processors activated.[ 0.013129] CPU: All CPU(s) started at EL1[ 0.013133] CPU features: detected: 32-bit EL0 Support[ 0.013138] CPU features: detected: CRC32 instructions[ 0.013188] alternatives: applying system-wide alternatives[ 0.013384] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching[ 0.013636] Memory: 383236K/524288K available (8896K kernel code, 900K rwdata, 2844K rodata, 960K init, 304K bss, 138092K reserved, 0K cma-reserved)[ 0.021220] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns[ 0.021243] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)[ 0.021351] 29248 pages in range for non-PLT usage[ 0.021355] 520768 pages in range for PLT usage[ 0.023449] pinctrl core: initialized pinctrl subsystem[ 0.027811] NET: Registered PF_NETLINK/PF_ROUTE protocol family[ 0.028413] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations[ 0.028450] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations[ 0.028483] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations[ 0.028832] thermal_sys: Registered thermal governor 'step_wise'[ 0.028893] cpuidle: using governor menu[ 0.029116] ASID allocator initialised with 65536 entries[ 0.036021] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000[ 0.076225] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4[ 0.098900] SCSI subsystem initialized[ 0.099101] usbcore: registered new interface driver usbfs[ 0.099140] usbcore: registered new interface driver hub[ 0.099189] usbcore: registered new device driver usb[ 0.099494] qcom_scm: convention: smc arm 64[ 0.101042] s2: Bringing 0uV into 725000-725000uV[ 0.102306] l2: Bringing 0uV into 1800000-1800000uV[ 0.102450] qcom_rpm_smd_regulator remoteproc:glink-edge:rpm-requests:regulators: Supply for l2 (l2) resolved to itself[ 0.102588] clocksource: Switched to clocksource arch_sys_counter[ 0.106412] NET: Registered PF_INET protocol family[ 0.106547] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)[ 0.108878] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)[ 0.108898] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)[ 0.108913] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)[ 0.108961] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)[ 0.109107] TCP: Hash tables configured (established 4096 bind 4096)[ 0.109560] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)[ 0.109720] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)[ 0.109746] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)[ 0.110072] NET: Registered PF_UNIX/PF_LOCAL protocol family[ 0.110106] PCI: CLS 0 bytes, default 64[ 0.111767] workingset: timestamp_bits=46 max_order=17 bucket_order=0[ 0.112491] squashfs: version 4.0 (2009/01/31) Phillip Lougher[ 0.112497] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.[ 0.115248] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)[ 0.118909] qcom-qmp-usb-phy 78000.ssphy: supply vdda-phy not found, using dummy regulator[ 0.119101] qcom-qmp-usb-phy 78000.ssphy: supply vdda-pll not found, using dummy regulator[ 0.120662] qcom-qusb2-phy 79000.qusb: supply vdda-pll not found, using dummy regulator[ 0.120773] qcom-qusb2-phy 79000.qusb: supply vdda-phy-dpdm not found, using dummy regulator[ 0.120960] qcom-qusb2-phy 79000.qusb: Registered Qcom-QUSB2 phy[ 0.128623] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled[ 0.132373] msm_serial 78b0000.serial: msm_serial: detected port #1[ 0.132457] msm_serial 78b0000.serial: uartclk = 24000000[ 0.132888] 78b0000.serial: ttyMSM1 at MMIO 0x78b0000 (irq = 22, base_baud = 1500000) is a MSM[ 0.133331] msm_serial 78b1000.serial: msm_serial: detected port #0[ 0.133397] msm_serial 78b1000.serial: uartclk = 1843200[ 0.133736] 78b1000.serial: ttyMSM0 at MMIO 0x78b1000 (irq = 23, base_baud = 115200) is a MSM[ 0.133807] msm_serial: console setup on port #0[ 0.133853] printk: legacy console [ttyMSM0] enabled[ 0.956284] msm_serial: driver initialized[ 0.966163] loop: module loaded[ 0.967536] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa[ 0.968127] nand: Macronix NAND 256MiB 1,8V 8-bit[ 0.974758] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64[ 0.979348] Block protection check failed[ 1.007907] i2c_dev: i2c /dev entries driver[ 1.014571] sdhci: Secure Digital Host Controller Interface driver[ 1.014618] sdhci: Copyright(c) Pierre Ossman[ 1.019653] sdhci-pltfm: SDHCI platform and OF driver helper[ 1.028464] remoteproc remoteproc0: releasing cd00000.remoteproc[ 1.032623] NET: Registered PF_INET6 protocol family[ 1.037194] Segment Routing with IPv6[ 1.040791] In-situ OAM (IOAM) with IPv6[ 1.044395] NET: Registered PF_PACKET protocol family[ 1.048325] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.[ 1.053437] 8021q: 802.1Q VLAN Support v1.8[ 1.098636] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4[ 1.098978] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0[ 1.104792] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 2[ 1.111363] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0[ 1.119034] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable[ 1.126550] cpr3_mem_acc_init: apc: not using memory accelerator regulator[ 1.135675] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused SVS: open-loop= 675000 uV[ 1.142624] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused NOM: open-loop= 787500 uV[ 1.152606] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused TURBO: open-loop= 850000 uV[ 1.162408] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused STURBO: open-loop= 912500 uV[ 1.172252] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused SVS: quot[ 7]= 610, quot_offset[ 7]= 0[ 1.182036] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused NOM: quot[ 7]= 806, quot_offset[ 7]= 195[ 1.192886] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused TURBO: quot[ 7]= 907, quot_offset[ 7]= 100[ 1.203824] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused STURBO: quot[ 7]= 994, quot_offset[ 7]= 85[ 1.215091] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop[ 1.218867] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa[ 1.232455] nand: Macronix NAND 256MiB 1,8V 8-bit[ 1.238895] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64[ 1.243533] Block protection check failed[ 1.251235] 20 qcomsmem partitions found on MTD device qcom_nand.0[ 1.255047] Creating 20 MTD partitions on "qcom_nand.0":[ 1.261101] 0x000000000000-0x000000180000 : "0:sbl1"[ 1.268253] 0x000000180000-0x000000280000 : "0:mibib"[ 1.272734] 0x000000280000-0x000000600000 : "0:qsee"[ 1.279429] 0x000000600000-0x000000680000 : "0:devcfg"[ 1.282277] 0x000000680000-0x000000700000 : "0:rpm"[ 1.287254] 0x000000700000-0x000000780000 : "0:cdt"[ 1.292002] 0x000000780000-0x000000800000 : "0:appsblenv"[ 1.296865] 0x000000800000-0x000000980000 : "0:appsbl"[ 1.303205] 0x000000980000-0x000000a00000 : "0:art"[ 1.307495] 0x000000a00000-0x000001300000 : "0:wififw"[ 1.318557] 0x000001300000-0x000001380000 : "0:ethphyfw"[ 1.319424] 0x000001380000-0x000001400000 : "u_env"[ 1.323800] 0x000001400000-0x000001440000 : "s_env"[ 1.328166] 0x000001440000-0x000001480000 : "devinfo"[ 1.363013] 0x000001480000-0x000001c80000 : "kernel"[ 1.369589] 0x000001c80000-0x000006680000 : "rootfs"[ 1.425852] mtd: setting mtd15 (rootfs) as root device[ 1.426149] mtdsplit: no squashfs found in "rootfs"[ 1.429930] 0x000006680000-0x000006e80000 : "alt_kernel"[ 1.441141] 0x000006e80000-0x00000b880000 : "alt_rootfs"[ 1.497272] 0x00000b880000-0x00000ba80000 : "sysdiag"[ 1.499296] 0x00000ba80000-0x00000fe80000 : "syscfg"[ 1.561797] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 864000 KHz[ 1.564561] remoteproc remoteproc0: cd00000.remoteproc is available[ 1.571834] ubi0: attaching mtd17[ 1.902381] ubi0: scanning is finished[ 1.963077] ubi0: attached mtd17 (name "alt_rootfs", size 74 MiB)[ 1.963119] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes[ 1.968159] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048[ 1.974950] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096[ 1.981789] ubi0: good PEBs: 591, bad PEBs: 1, corrupted PEBs: 0[ 1.988566] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128[ 1.994827] ubi0: max/mean erase counter: 5/3, WL threshold: 4096, image sequence number: 1751977158[ 2.001845] ubi0: available PEBs: 0, total reserved PEBs: 591, PEBs reserved for bad PEB handling: 39[ 2.011163] ubi0: background thread "ubi_bgt0d" started, PID 6�[ 2.027018] Waiting for root device /dev/ubiblock0_0...[ 32.472594] usb_vbus: disabling
I understand the process, ofgetting TFTP to send the file to the board. The issue that I see is that the service is stopping after about 25 seconds.
Using this brower in Linux to post my code looks like crap. But I am getting close, the board is still booting it just has a bad flash. I will give it another try in the AM.
my MR7350 print env is below… should be the same for all Linksys MR7350 units
default file name to use with tftpd is mr7350.img
default ip address is 192.168.1.1 in uboot.
You could bypass all the setenv items with re-naming the file to upload as mr7350.img and setting a static ip address 192.168.1.x. other than that could be the tfpt server. I had issues with one laptop, and not the other laptop with tftp. it is finicky at times - which I am not knowledgeable as to why.
while your in there, you can try flashimg2… I have had uboot write to one partition and not the other.
IPQ6018# printenv
altkern=6680000
auto_recovery=yes
baudrate=115200
boot_part=2
boot_part_ready=3
boot_ver=2.3.01
bootargs=console=ttyMSM0,115200n8
bootcmd=i2c dev 0 && i2c probe && i2c mw 0x62 0x00 0x00 1 && i2c mw 0x62 0x01 0x05 1 && i2c mw 0x62 0x08 0x00 1 && if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi
bootdelay=1
bootpart1=setenv bootargs $partbootargs && nand read $loadaddr $prikern $kernsize && bootm $loadaddr
bootpart2=setenv bootargs $partbootargs2 && nand read $loadaddr $altkern $kernsize && bootm $loadaddr
ethact=eth0
ethaddr=xx:yy:zz:aa:bb:cc
fdt_high=0x48500000
fdtcontroladdr=4a477890
flash_type=2
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=mr7350.img
imgsize=5200000
ipaddr=192.168.1.1
kernsize=800000
loadaddr=44000000
machid=8030200
mtddevname=fs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x4e00000@0x1880000(fs),
netmask=255.255.255.0
partbootargs=init=/sbin/init rootfstype=squashfs ubi.mtd=rootfs root=mtd:squashfs rootwait
partbootargs2=init=/sbin/init rootfstype=squashfs ubi.mtd=alt_rootfs root=mtd:squashfs rootwait
prikern=1480000
serverip=192.168.1.254
soc_version_major=1
soc_version_minor=0
stderr=serial@78B1000
stdin=serial@78B1000
stdout=serial@78B1000
Environment size: 1505/262140 bytes
IPQ6018#