OpenWrt for Tenda O3 2.4GHz Outdoor CPE

I have successfully installed OpenWrt 22.03.2 in Tenda o3
CPU: Qualcom QCA9533
RAM: 32MB
Flash: 8MB GD25Q64
Installation Procedure
how i did it.

  1. Desolder Flash Chip
  2. Copy the complete contents of the flash chip using CH341A Programmer into file
  3. Erase the chip
  4. Download bootloader from here Breed Uboot
  5. Install downloaded uboot via programmer into the flash
  6. Instead of soldering & desoldering i attached dip8 adapter with tiny wires & i soldered flash ic on SOP8 to DIP8 PCB for flexibility. (you can avoid this & resolder the flash ic after installing uboot)
  7. i extracted the art partition data from the origflash.bin file using dd command in another openwrt.
    dd if=origflash.bin of=art.bin bs=1K skip=8128
    Since orig flash size is 8 mb & art data is stored in the last 64Kilobytes of the flash so 8 x 1024 = 8192 - 64 =8128
  8. after attaching the flash ic to the board breed console opened via serial & also via web at 192.168.1.1
  9. update art.bin data first & then firmware, otherwise firmware wont boot without wireless drivers & you will end up in boot loop.
  10. Firmware Download Link openwrt-22.03.2-ath79-generic-tplink_tl-wr810n-v2-squashfs-sysupgrade.bin
  11. TP-Link TL-WR810N-V2 Hardware is identical to Tenda o3 So its working out of the box.
  12. I hope im not missing something. please report if you encounter any issues i will help.

here is the OEM Bootlog

U-Boot 1.1.4 (Mar  2 2018 - 10:27:33)

ap147 - Honey Bee 2.0

DRAM:  32 MB
Now running in RAM - U-Boot at: 81fdc000

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id dev_size era_size chipName
@ 0000000h 0c84017h 0800000h 0010000h GD25Q64
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt
@ 0010000h 0000080h 0001000h 0000800h 0000100h 0008000h
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init2
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth0: e8:65:d4:0c:c4:a8
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 config done
eth0
Setting 0x181162c0 to 0x4b97a100
Hit ctrl+c to stop autoboot:  0
http start at:192.168.1.1
Trying eth0
enet1 port3 up
dup 1 speed 1000
ath>

U-Boot 1.1.4 (Mar  2 2018 - 10:27:33)

ap147 - Honey Bee 2.0

DRAM:  32 MB
Now running in RAM - U-Boot at: 81fdc000

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id dev_size era_size chipName
@ 0000000h 0c84017h 0800000h 0010000h GD25Q64
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt
@ 0010000h 0000080h 0001000h 0000800h 0000100h 0008000h
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init2
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth0: e8:65:d4:0c:c4:a8
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 config done
eth0
Setting 0x181162c0 to 0x4b97a100
Hit ctrl+c to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Linux-3.3.8
   Created:      2019-02-23   8:57:18 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    1027186 Bytes = 1003.1 kB
   Load Address: 80060000
   Entry Point:  80060000
   Contents:
   Image 0:  1027178 Bytes = 1003.1 kB
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Linux version 3.3.8 (root@linux-bkb8) (gcc version 4.9.3 (Buildroot 2015.08) ) #1 Sat Feb 23 16:55:01 CST 2019
boot cmdline:  board=AP147 console=ttyS0,115200 mtdparts=spi0.0:192k(boot)ro,64k(env),64k(bsp),7616k(KernelFS),6144k@0x1c0000(RootFS),64k(CFM),64k(CFM_BACKUP),64k(CFG),64k(art),8192k@0x0(ALL) root=31:04 mem=32M
boot arg:6, 0xa1f8bfb0, 0xa1f8c480
Ethaddr=0xe8:0x65:0xd4:0x0c:0xc4:0xa8
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
SoC: Qualcomm Atheros QCA9531 rev 2
Clocks: CPU:650.000MHz, DDR:390.576MHz, AHB:216.666MHz, Ref:25.000MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line:  board=AP147 console=ttyS0,115200 mtdparts=spi0.0:192k(boot)ro,64k(env),64k(bsp),7616k(KernelFS),6144k@0x1c0000(RootFS),64k(CFM),64k(CFM_BACKUP),64k(CFG),64k(art),8192k@0x0(ALL) root=31:04 mem=32M ethaddr=0xe8:0x65:0xd4:0x0c:0xc4:0xa8 rootfstype=squashfs noinitrd init=/sbin/init
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29092k/32768k available (2154k kernel code, 3676k reserved, 557k data, 168k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:83
Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Performance counters: mips/24K PMU enabled, 2 32-bit counters available to each CPU, irq 13
NET: Registered protocol family 16
gpiochip_add: registered GPIOs 0 to 17 on device: ath79
MIPS: machine is Qualcomm Atheros AP147 reference board
AP147 Reference Board Id is 17
ar724x-pci ar724x-pci.0: PCIe link is down
registering PCI controller with io_map_base unset
ar71xx: invalid MDIO id 1
bio: create slab <bio-0> at 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
pci_bus 0000:00: root bus resource [io  0x0000]
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 56
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
m25p80 spi0.0: found gd25q64, expected m25p80
m25p80 spi0.0: gd25q64 (8192 Kbytes), erasesize:0x00010000
Kernel code size:0xfacb2
10 cmdlinepart partitions found on MTD device spi0.0
Creating 10 MTD partitions on "spi0.0":
0x000000000000-0x000000030000 : "boot"
0x000000030000-0x000000040000 : "env"
0x000000040000-0x000000050000 : "bsp"
0x000000050000-0x0000007c0000 : "KernelFS"
0x00000014acb2-0x0000007c0000 : "RootFS"
mtd: partition "RootFS" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x0000007c0000-0x0000007d0000 : "CFM"
0x0000007d0000-0x0000007e0000 : "CFM_BACKUP"
0x0000007e0000-0x0000007f0000 : "CFG"
0x0000007f0000-0x000000800000 : "art"
0x000000000000-0x000000800000 : "ALL"
m25p80 spi0.1: found pm25lv512, expected m25p80
m25p80 spi0.1: pm25lv512 (64 Kbytes), erasesize:0x00001000
ag71xx_mdio: probed
match drv:0x4d0000-Atheros AR8216/AR8236/AR8316 and dev:0x4dd042-ag71xx-mdio.1:00
match drv:0x4d0000-Atheros AR8216/AR8236/AR8316 and dev:0x4dd042-ag71xx-mdio.1:01
match drv:0x4d0000-Atheros AR8216/AR8236/AR8316 and dev:0x4dd042-ag71xx-mdio.1:02
match drv:0x4d0000-Atheros AR8216/AR8236/AR8316 and dev:0x4dd042-ag71xx-mdio.1:03
match drv:0x4d0000-Atheros AR8216/AR8236/AR8316 and dev:0x4dd042-ag71xx-mdio.1:04
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xba000000, irq 5
eth0: Found an AR934X built-in switch
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (454 buckets, 1816 max)
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
### of_selftest(): No testcase data in device tree; not running tests
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 168k freed
mkdir: can't create directory '/var/run': File exists
[BM CORE     ][init_online_ip  ,1355]  INFO: online ip data hash table created, size = 199
[BM CORE     ][init_online_ip_procfs,719 ]  INFO: online_ip proc file created
km_ctf_init 283: ctf_register_hook failed, maybe fastnat not insmod
km_init 434: ##km base init success##
[BM CORE     ][bm_init         ,887 ]  INFO: bm_init success
[BM CORE     ][bm_u2k_info_init,1149]  INFO: bm_u2k_info_init success
[MAC FILTER  ][mf_init         ,619 ]  INFO: bm_mac_filter init success
ssdk_plat_init start
chip_version:0x0
chip_version:0x2
Register QCA PHY driver
match drv:0x4d0000-QCA AR8216 AR8236 AR8316 AR8327 AR8337 and dev:0x4dd042-ag71xx-mdio.1:00
match drv:0x4d0000-QCA AR8216 AR8236 AR8316 AR8327 AR8337 and dev:0x4dd042-ag71xx-mdio.1:01
match drv:0x4d0000-QCA AR8216 AR8236 AR8316 AR8327 AR8337 and dev:0x4dd042-ag71xx-mdio.1:02
match drv:0x4d0000-QCA AR8216 AR8236 AR8316 AR8327 AR8337 and dev:0x4dd042-ag71xx-mdio.1:03
match drv:0x4d0000-QCA AR8216 AR8236 AR8316 AR8327 AR8337 and dev:0x4dd042-ag71xx-mdio.1:04
[SSDK] chip (id:0x2 - nm:SHIVA)
PHY ID is 0x4dd042
qca probe f2 phy driver succeeded!
qca-ssdk module init succeeded!
AR71XX_RESET_REG_WDOG_CTRL: 0x0
 377+0 records in
377+0 records out
12064 bytes (11.8KB) copied, 0.030313 seconds, 388.7KB/s
auto startup
Give root password for system maintenance
(or type Control-D for normal startup):argv[0] = cfmd
cfmd
argv[0] = logserver
argv[0] = netctrl
netctrl
logserver
current mode is common
rf_test:20210602102636847
argv[0] = wserver
wserver
wserver debug flags(0x1): error

mem_manager: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
insmod: can't read '/lib/modules/hst_tx99.ko': No such file or directory
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
CC++ attach devid 0x3d
Enterprise mode: 0x03fc0000
Restoring Cal data from FS
qdf_fs_read[59], Open File /tmp/wifi0.caldata SUCCESS!!file system magic:-2054924042super blocksize:4096inode 387file size:12064qdf_fs_read[79]: caldata data size mismatch, fsize=12064, cal_size=1088
ART Version : -48.0.0
SW Image Version : -48.0.0.0.0
Board Revision :
ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125
Green-AP : Green-AP : Attached

Starting random number generator thread
ath_get_caps[6329] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[6304] tx chainmask mismatch actual 1 sc_chainmak 0
[slottime] auto, set to 20.
TENDA WLAN: init proc
ath_attach_dfs[12729] dfsdomain 0
dfs_attach: event log enabled by default
ath_attach: Set global_ic[1]..gloabl_ic ptr:805282e0
====tun_node_list_init init(0)====
ath_tx_paprd_init sc 80e48000 PAPRD disabled in HAL
wifi0: Atheros ???: mem_start: =0xb8100000, mem_end: =0xb8120000, irq=47
ath_da_pci:  (Atheros/multi-bss)
             total         used         free       shared      buffers
Mem:         29260        15584        13676            0          572
-/+ buffers:              15012        14248
Swap:            0            0            0
netctrl_init_interfaces 1042**********************:E8:65:D4:0C:C4:A8
device vlan1 entered promiscuous mode
device eth0 entered promiscuous mode
eth0: link up (1000Mbps/Full duplex)
br0: topology change detected, propagating
br0: port 1(vlan1) entered forwarding state
br0: port 1(vlan1) entered forwarding state
device vlan1 left promiscuous mode
device eth0 left promiscuous mode
br0: port 1(vlan1) entered disabled state
device eth0 entered promiscuous mode
br0: topology change detected, propagating
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
Sun May  1 00:00:00 UTC 2011
get_eth_name(P_LAN_1) = eth0, get_eth_name(L_LAN_1) = vlan1,get_eth_name(WAN_1) = vlan2
argv[0] = httpd
argv[0] = arprecive
argv[0] = sta_report
arprecive
httpd
sta_report
eth0: link down
br0: port 1(eth0) entered disabled state
goahead: 4: main----56

GoAhead default debug level : 4
/var/goahead_debug nost exist, record default debug leve 4
GoAhead default debug level : 4
goahead: 4: initPlatform----430

goahead: 4: websOpen----229

ioctl(SIOCFIGINDEX): Could not get interface index.
Init receive socket error!Reaped pid = 495
route: SIOCDELRT: No such process
route: SIOCADDRT: Invalid argument
route: SIOCADDRT: No such device
/bin/sh: can't create /proc/br_igmpsnoop: nonexistent directory
wifi_add_vlan_br 501:workmode:wisp
[wifi_band_interface:674]msg {"type":"config","subtype":"band","ifname":"wlan0"}
config changed,CRC:old[5d6010a1],new[655961ba]
Erasing 64 Kbyte @ 0 -- 100 % complete.
eth0: link up (1000Mbps/Full duplex)
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
argv[0] = sta_report
sta_report
wifi_probe(570): ath0 not exist!
wifi_probe(570): ath1 not exist!
wifi_probe(570): ath8 not exist!
wifi_probe(570): wifi0 not exist!

=========hardware check wifi0 ========

ioctl(SIOCFIGINDEX): Could not get interface index.
Init receive socket error!Reaped pid = 528
mib_nvram_cfm_commit 1091: write mibvalue success
write config to flash......ok
wifi_probe(570): ath8 not exist!
wlan_vap_create : enter. devhandle=0x80e50380, opmode=IEEE80211_M_STA, flags=0x1
wlan_vap_create : exit. devhandle=0x80e50380, vap=0x80850000, opmode=IEEE80211_M_STA, flags=0x1.
VAP device ath8 created osifp: (80e01b80) os_if: (80850000)
ath8
wifi_probe(570): ath0 not exist!
wlan_vap_create : enter. devhandle=0x80e50380, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80e50380, vap=0x80818000, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created osifp: (80814380) os_if: (80818000)
ath0
ath_net80211_dfs_clist_update: called, cmd=1, nollist=  (null), nentries=0
ath_attach_dfs[12729] dfsdomain 0
dfs_attach: event log enabled by default
goahead: 0: Can't get host address for host linux-a8c40cd465e8: errno 124, use Local:127.0.0.1


Yes:

      ****** WeLoveLinux ******

 Welcome to ...
/home/work/workspace/EAOSV2.0/prod/httpd/ap_web/cgi_outdoor/main.c check network ip start
init web server success
-----Start listen http://192.168.9.1:80----
argv[0] = sta_report
sta_report
Successfully initialized wpa_supplicant
ath_net80211_dfs_clist_update: called, cmd=1, nollist=  (null), nentries=0
ath_attach_dfs[12729] dfsdomain 0
dfs_attach: event log enabled by default
siwfreq
Set freq vap 1 stop send + 80818000
Set freq vap 1 stop send -80818000
Set wait done --80818000
iwpriv_common(480):(ath0) unknow cmd `td_spec_width`
'iwpriv ath0 td_spec_width 0' failed
Vendor IE is NUll , please add using wlanconfig command
 Vendor IE Succe[distance] try to set distance to 3000.
ssfully Removed [distance] calculate out slottime(18) acktimeout(66) ctstimeout(66).


----------------------------------------
Removing following vendor IEs matching OUI type anVendor IE is NUll , please add using wlanconfig command
d subtype
Vendor IE info Ioctl [DEBUG] vap-1(ath0):set SIOC80211NWID, 27 characters
CMD id     : 33
 DES SSID SET=SS

ID                              : dd
OUI                             : c85360
Subtype                         : all subtypes
----------------------------------------
iwpriv_common(480):(ath0) unknow cmd `td_tdma`
'iwpriv ath0 td_tdma 8388618' failed
 Vendor IE Successfully Removed

----------------------------------------
Removing following vendor IEs matching OUI type and subtype
Vendor IE info Ioctl CMD id     : 33
ID                              : dd
OUI                             : c85358
Subtype                         : all subtypes
----------------------------------------
wifi_probe(575):ath0 is exist. name: IEEE 802.11b
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
 DEVICE IS DOWN ifname=ath0
 DEVICE IS DOWN ifname=ath0
Warning: node not in table 0x80930000
OK
Setting Max Stations:48
Vendor IE is NUll , please add using wlanconfig command
 Vendor IE Successfully Removed

----------------------------------------
Removing following vendor IEs matcVendor IE is NUll , please add using wlanconfig command
hing OUI type and subtype
Vendo[DEBUG] vap-0(ath8):set SIOC80211NWID, 23 characters
r IE info Ioctl
 DES SSID SET=Canal View Net Provider
CMD id     : 33
ID                              : dd
OUI                             : c85360
Subtype                         : all subtypes
----------------------------------------
iwpriv_common(480):(ath8) unknow cmd `td_tdma`
'iwpriv ath8 td_tdma 8388618' failed
 Vendor IE Successfully Removed

----------------------------------------
Removing following vendor IEs matching OUI type and subtype
Vendor IE info Ioctl CMD id     : 33
ID                              : dd
OUI                             : c85358
Subtype                         : all subtypes
----------------------------------------
wifi_probe(575):ath8 is exist. name: IEEE 802.11b
ieee80211_ucfg_getparam : parameter 0x284 not supported
[distance] try to set distance to 3000.
[distance] calculate out slottime(18) acktimeout(66) ctstimeout(66).
OK
[slottime] try to set 9, but use fixed 18.
/bin/sh: wserver_notify.sh: not found
wifi_interface_start 550:workmode:wisp
ssdk_sh portvlan ingress set 0 disable

ssdk_sh portvlan member update 0 62

ssdk_sh portvlan ingress set 1 disable

ssdk_sh portvlan member update 1 61

ssdk_sh portvlan ingress set 2 disable

ssdk_sh portvlan member update 2 59

ssdk_sh portvlan ingress set 3 disable

ssdk_sh portvlan member update 3 55

ssdk_sh portvlan ingress set 4 disable

ssdk_sh portvlan member update 4 47

ssdk_sh portvlan ingress set 5 disable

ssdk_sh portvlan member update 5 31

switch only mode, add vlan2
wifi_interface_start 591:os_ifname:ath0
device ath0 entered promiscuous mode
br0: port 2(ath0) entered forwarding state
br0: port 2(ath0) entered forwarding state
wisp->dhcp:ifname:ath8 mtu:1500
[wifi_service_radius_start:867]msg {"type":"service","subtype":"radius","handle":"start","ifnames":[]}
wlan_server_decode_radius(677): ERROR: decode config ifname failed!
wlan_service_radius(727): ERROR: decode radius data failed!
wlan_handle_msg(282): ERROR: handle msg id 17 failed!
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `dmz_forward_pre'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `dmz_forward_post'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `port_forward_pre'

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.4.4: Couldn't find target `port_forward_post'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `web_wanadmin'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `web_wanadmin'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
killall: 3322ip: no process killed
killall: 88ip: no process killed
killall: gnway: no process killed
killall: inadyn: no process killed
rm: can't remove '/etc/ddns_*': No such file or directory
[24G] radio is disable!
iptables: No chain/target/match by that name.
iptables v1.4.4: Couldn't find target `MINIUPNPD'

Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
dhcps_load_cfg,249
dhcps_load_cfg,252
mac filter enable = 0
[MAC FILTER  ][mf_apply        ,238 ]  INFO: g_mac_filter_enable = disable
[MAC FILTER  ][mf_mode         ,246 ]  INFO: g_mf_mode = black
argv[0] = sntp
argv[1] = -z
argv[2] = 28800
argv[3] = -t
argv[4] = 1800
argv[5] = -s
argv[6] = /var/network_check_result.cfg
sntp
auto_ping_en = 0,auto_ping_time = 600
string=0;0
string[0]=0
string[1]=0
argv[0] = apmng_svr
apmng_svr
[netctrl_notice_extend_status:1381]msg {"type":"notice","subtype":"extend_status","process_name":"netctrl"}
vendor_register_extend_event(294): DEBUG:  wserver_pid=397
--set ic->td_wserver_pid=397
Info->ap_discovery_state.c: Create_APCheckAck_Package(88)--netbridge = 0

Phy[4] up
#####xxxxxxxxxx#port_id:4##############
lan_dhcpc_status_change_process_handle 529:status:3
[24G] radio is disable!
[24G] radio is disable!
[24G] radio is disable!
[24G] radio is disable!

Normal startupGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!
[24G] radio is disable!


^CGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!

Normal startupGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!





^CGive root password for system maintenance
(or type Control-D for normal startup):
[24G] radio is disable!
Login incorrect
Give root password for system maintenance
(or type Control-D for normal startup):
Normal startupGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!

Normal startupGive root password for system maintenance
(or type Control-D for normal startup):
Normal startupGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!

Normal startupGive root password for system maintenance
(or type Control-D for normal startup):[24G] radio is disable!

& here is the OpenWRT bootlog using Breed Uboot

Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)

DRAM: 32MB
Platform: Qualcomm Atheros QCA953X rev 2
Board: Letv LBA-047-CH
Clocks: CPU: 550MHz, DDR: 400MHz, AHB: 200MHz, Ref: 25MHz
Flash: GigaDevice GD25Q64 (8MB) on ath79-spi
ag71xx-eth: MAC address is invalid, using default settings.
ag71xx-eth: Using MAC address 00:13:74:00:00:01
Waiting for auto-negotiation complete ... OK
eth0: Atheros AR8228/AR8229 rev 1

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 0

Trying to boot firmware from 0x9f020000 ...
TP-LINK firmware image header detected.
    Image Name:   08100002
    Data Size:    2243828 Bytes
    Load Address: 80060000
    Entry Point:  80060000
Uncompressing data (LZMA) ... done.
Flushing cache ... done.

Starting kernel at 0x80060000...

[    0.000000] Linux version 5.10.146 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link TL-WR810N v2
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 8120
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.000000] Writing ErrCtl register=0003970a
[    0.000000] Readback ErrCtl register=0003970a
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 23728K/32768K available (5850K kernel code, 611K rwdata, 744K rodata, 1232K init, 209K bss, 9040K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 550.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6950037990 ns
[    0.000011] sched_clock: 32 bits at 275MHz, resolution 3ns, wraps every 7809031678ns
[    0.008981] Calibrating delay loop... 366.18 BogoMIPS (lpj=1830912)
[    0.076039] pid_max: default: 32768 minimum: 301
[    0.081486] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.089805] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.101365] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.113318] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.124557] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.132426] pinctrl core: initialized pinctrl subsystem
[    0.144226] NET: Registered protocol family 16
[    0.150339] thermal_sys: Registered thermal governor 'step_wise'
[    0.218268] clocksource: Switched to clocksource MIPS
[    0.232438] NET: Registered protocol family 2
[    0.237704] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.247015] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.256680] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.265419] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.273451] TCP: Hash tables configured (established 1024 bind 1024)
[    0.280869] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.288374] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.296701] NET: Registered protocol family 1
[    0.301752] PCI: CLS 0 bytes, default 32
[    0.314855] workingset: timestamp_bits=14 max_order=13 bucket_order=0
[    0.327942] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.334640] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.348394] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.361056] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.368828] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.379017] printk: console [ttyS0] disabled
[    0.383975] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.393859] printk: console [ttyS0] enabled
[    0.393859] printk: console [ttyS0] enabled
[    0.402931] printk: bootconsole [early0] disabled
[    0.402931] printk: bootconsole [early0] disabled
[    0.435872] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.440916] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.447537] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.454442] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.462423] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.469357] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.476480] Creating 3 MTD partitions on "spi0.0":
[    0.481498] 0x000000000000-0x000000020000 : "u-boot"
[    0.494405] 0x000000020000-0x0000007f0000 : "firmware"
[    0.501512] 2 tplink-fw partitions found on MTD device firmware
[    0.507654] Creating 2 MTD partitions on "firmware":
[    0.512885] 0x000000000000-0x000000223ef4 : "kernel"
[    0.518015] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.530232] 0x000000223ef4-0x0000007d0000 : "rootfs"
[    0.535383] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.546248] mtd: device 3 (rootfs) set to be root filesystem
[    0.553481] 1 squashfs-split partitions found on MTD device rootfs
[    0.559968] 0x0000005a0000-0x0000007d0000 : "rootfs_data"
[    0.566871] 0x0000007f0000-0x000000800000 : "art"
[    0.635474] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.979373] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    0.987728] ag71xx 1a000000.eth: invalid MAC address, using random address
[    1.682881] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[    1.740892] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.751023] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii
[    1.757894] i2c /dev entries driver
[    1.763781] NET: Registered protocol family 10
[    1.779696] Segment Routing with IPv6
[    1.783629] NET: Registered protocol family 17
[    1.788423] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.801836] 8021q: 802.1Q VLAN Support v1.8
[    1.807673] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.150412] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    2.161079] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.180227] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    2.195866] Freeing unused kernel memory: 1232K
[    2.200591] This architecture does not have kernel memory protection.
[    2.207257] Run /sbin/init as init process
[    3.033211] init: Console is alive
[    3.037411] init: - watchdog -
[    4.302672] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.357616] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.376393] init: - preinit -
[    6.179574] random: jshn: uninitialized urandom read (4 bytes read)
[    6.667693] random: jshn: uninitialized urandom read (4 bytes read)
[    6.726644] random: jshn: uninitialized urandom read (4 bytes read)
[    7.009032] eth0: link up (1000Mbps/Full duplex)
[    7.024248] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.525853] jffs2: notice: (476) jffs2_build_xattr_subsystem: complete building xattr subsystem, 6 of xdatum (0 unchecked, 1 orphan) and 7 of xref (1 dead, 0 orphan) found.
[   11.544251] mount_root: switching to jffs2 overlay
[   11.555693] overlayfs: upper fs does not support tmpfile.
[   11.570040] urandom-seed: Seeding with /etc/urandom.seed
[   11.867952] eth0: link down
[   11.888933] procd: - early -
[   11.892455] procd: - watchdog -
[   12.669268] procd: - watchdog -
[   12.711755] procd: - ubus -
[   12.934703] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.945282] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.960235] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.977992] procd: - init -
Please press Enter to activate this console.
[   14.375410] random: jshn: uninitialized urandom read (4 bytes read)
[   14.438564] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.468534] random: ubus: uninitialized urandom read (4 bytes read)
[   14.586685] kmodloader: loading kernel modules from /etc/modules.d/*
[   15.310979] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[   15.318911] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[   15.331716] urngd: v1.0.2 started.
[   15.826468] PPP generic driver version 2.4.2
[   15.839670] NET: Registered protocol family 24
[   15.983642] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   16.188944] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.353799] random: crng init done
[   16.357344] random: 25 urandom warning(s) missed due to ratelimiting
[   42.933202] eth0: link up (1000Mbps/Full duplex)
[   42.940277] br-lan: port 1(eth0) entered blocking state
[   42.945701] br-lan: port 1(eth0) entered disabled state
[   42.951628] device eth0 entered promiscuous mode
[   42.993533] br-lan: port 1(eth0) entered blocking state
[   42.999033] br-lan: port 1(eth0) entered forwarding state

[   43.948578] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready


BusyBox v1.35.0 (2022-10-14 22:44:41 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.2, r19803-9a599fee93
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.5M      3.5M         0 100% /rom
tmpfs                    12.2M     60.0K     12.1M   0% /tmp
/dev/mtdblock4            2.2M    232.0K      2.0M  10% /overlay
overlayfs:/overlay        2.2M    232.0K      2.0M  10% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 007d0000 00010000 "firmware"
mtd2: 00223ef4 00010000 "kernel"
mtd3: 005ac10c 00010000 "rootfs"
mtd4: 00230000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "art"
root@OpenWrt:/#

Step 9, update art.bin data first. How to update it? Or can you provide an updated art.bin file?

cat art.bin > /dev/mtd5 ?

Upload art.bin using breed web console. or if you have success in booting openwrt without art then use the following method to upload art.bin

First you need to unlock partitions for writing

opkg update
opkg install kmod-mtd-rw
insmod mtd-rw.ko i_want_a_brick=1

then get your partition info

cat /proc/mtd

then write with this command Assuming mtd5 is art

mtd write art.bin /dev/mtd5

or

dd if=art.bin of=/dev/mtd5
1 Like

uploaded it for you
TendaO3 art.bin

With the help of your post, I successfully used OPENWRT for a period of time. Now I want to flash back the official firmware of tengda o3 and found that the flash firmware backed up before is lost. Do you have the official firmware?