Firmware modification is just needed when the flash is changed. The RAM mod works with original firmware.

I also want to update uboot. I bought an original wr703n and a 64M+8M kit from ebay, and I just soldered the 8M flash.

This flash is preprogrammed with openwrt, it comes with a 4MB uboot, and a 8M image.

However, the strange part is that the rootfs partition is stuck right after the kernel, so it does not lie on a sector boundary. I'm in the process of building a correct image from openwrt trunk sources.

I want to use uboot+tftp for that, so I need a 8MB enabled uboot.

I just tried to compile the uboot from tplink gpl package and I can confirm that the output directory is not $HOME/images/ap99 but ../images/ap99 relative to the "build" directory that holds Makefile.ap99.

Can someone tell me if the following is ok:

-start the 8MB openwrt
-use mtd write to update the 128k uboot partition from what I've just compiled
-reboot
-that should work as before

-apply changes tp
*trunk/tools/firmware-utils/src/mktplinkfw.c
*target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-mr3x20.c

-rebuild openwrt for wr703

-update firmware from uboot. Can someone confirm which image is the correct one? factory, sysupgrade, unfortunately I have no idea what these words means. I could check the file size, but a confirmation would be nice.

-in case something goes wrong, I will be able to recover by soldering back the original flash and using the CS trick in uboot to reprogram the bricked flash.

edit: ok, found it here: https://forum.openwrt.org/viewtopic.php?id=34572
a factory image is one built for the bootloader flasher or stock software flasher
a sysupgrade image (previously named trx image) is designed to be flashed from within openwrt itself

So, to flash from uboot, I need the factory image. I believe that a sysupgrade would not set the partitions limit properly.

best regards

(Last edited by openmakersdaily on 4 Apr 2013, 20:02)

You should compile AP121 for TL-WR703N, not AP99.

You don't need to compile OpenWrt for bigger flash chips. You can use factory images for original flash size chips.
And, in 703N U-Boot doesn't occupy 128 KiB! It occupies up to 64 KiB and in next 64 KiB there is MAC address and model number. Please, refer to this flash layout:

If you want, you can use my U-Boot version for this model:
https://forum.openwrt.org/viewtopic.php?id=43237

The only reason you might need larger 8M Openwrt is if you are really tight on flash rom.  The precompiled squashfs uses less rom space than jffs.  Otherwise, you can use 4M one and just install new packages.  I don't know if it has already been discussed.  You don't need 8M uboot either.  You can first flash the 4M image to the 4M uboot and then do an upgrade to an 8M factory image.

hello, thanks pepe for the proposal but no, the goal is educative, I want to learn how to compile uboot from the darn official sources, and I don't need some http server code built in uboot. I know how to use tftp.

I have a 8MB flash, so it has to be initialized with a 8MB uboot, or I won't be able to update the firmware from uboot the very day I'll need to do that.

I followed instructions from here, which is using ap99, and I don't get why my uboot is bigger than 64k.
https://forum.openwrt.org/viewtopic.php?id=32512
are these instructions wrong? The guy seemed to have some success with that.
I used the toolchain from the downloaded tplink package.

what is ap99? what is ap121? I downloaded these sources from tplink website, they are from device TL-MR3420 V1, which is not even a WR-703 nor an ap99.

is this AP121 configuration available in the sources where I downloaded the ap99 code?
I don't want to play around with random uboot images, because messing that means that I'll have to desolder the flash again.

All of this is NOT clear, at least for a beginner The public information I found is not consistent, I had to gather everything around to get something working.

I am also not happy that my router's 8MB flash was so strangely done that:

[    0.490000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.500000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    0.500000] 5 tp-link partitions found on MTD device spi0.0
[    0.510000] Creating 5 MTD partitions on "spi0.0":
[    0.510000] 0x000000000000-0x000000020000 : "u-boot"
[    0.520000] 0x000000020000-0x00000011f428 : "kernel"
[    0.520000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.540000] 0x00000011f428-0x0000007f0000 : "rootfs"
[    0.540000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.550000] mtd: partition "rootfs" set to be root filesystem
[    0.560000] mtd: partition "rootfs_data" created automatically, ofs=2B0000, len=540000
[    0.570000] 0x0000002b0000-0x0000007f0000 : "rootfs_data"
[    0.570000] 0x0000007f0000-0x000000800000 : "art"
[    0.580000] 0x000000020000-0x0000007f0000 : "firmware"

so I have to change partition boundaries to something normal, which, I believe, sysupgrade will not be able to do. At least it didn't when I upgraded the original firmware to the one available in download.openwrt.org.

I'm also not ok with official openwrt images for this device, because I don't care about the router feature, all I want is an embedded linux box. I was not able to find native gcc packages for this device, so I also want to build my personnalized openwrt image.
I have big programs on an external usb stick via opkg, with an ext3 partition and swap space.

Any idea?

(Last edited by openmakersdaily on 5 Apr 2013, 07:24)

The 4 MiB U-Boot version won't allow you to do any operation on flash above 4 MiB. But official factory images won't be bigger than 4 MiB - 192 KiB (64 KiB U-Boot, 64 KiB with MAC and model number, 64 KiB with ART) because the original flash chip in 703N is 4 MiB.

You should start with this package: http://www.tp-link.com/resources/gpl/150Router.rar (you can find it here: http://www.tp-link.com/en/support/gpl/?categoryid=547). It contains sources for "3G routers" from TP-Link, including TL-WR703N/TL-MR3020/TL-MR3040/TL-MR11U...

AP121 is the name of board type in U-Boot sources. It's the same hardware like ALFA Hornet-UB (http://wikidevi.com/wiki/ALFA_Network_Hornet-UB). AP99 is another board, with different hardware. I told that compiled U-Boot version for AP121 is up to 64 KiB, I don't know how big could/should be the version for AP99.

Without external programmer and SOP/SOIC adapter don't even try to compile your own version of U-Boot. During my work at U-Boot I was using 703N with desoldered flash chip (I bought SOIC adapter couple of days after this picture):

And what is wrong here?

hi.. just modified tplinkfw.c from backfire source code, so my 1043ND can work with 16MB flash.
and compiled again, but why i cannot see the firmware bin file on /openwrt/backfire/bin/ar71xx folder ? i found this error when executing make:

make[3]: [/home/hendry/openwrt/backfire/bin/ar71xx/OpenWrt-ImageBuilder-ar71xx-for-Linux-i686.tar.bz2] Error 1 (ignored)

Hi pupie,

First let me thank you for the great tutorial

Just one small doubt about the MAC and PIN injection into the "uboot.bin" file;

Do we need to calculate some kind of CRC Check SUM? Or it isn't needed at all?

Thanks in advance,

Best Regards,

fjorger.

anyone met this problem: cpu/mips/start.o: In function `reset':(.text+0x4b4): undefined reference to `_GLOBAL_OFFSET_TABLE_'
when compile tp-link's 150router ap121 uboot for 8M flash?
       Why make cannot find `_GLOBAL_OFFSET_TABLE_' when last step:linking? below is my command:
1. export FLASH_SIZE=8
2. make ap121_config
3. make or make all
      then compiling is OK,but when linking ,error produced .
     
     Any suggestion or solution to solve this problem is appreciated,thanks!

important question. Shall change MAC and pin using hex?
Maybe CRC check sum is a must.

Just edit PIN and MAC with hex editor

There is no need to do CRC check sum.

Hi

Any idea, or solved ?

Does this means that there is no need to modify the partition offsets anymore?

Yes All you need to do, is just to put "uboot" partition at the beginning and "art" partition at the end of FLASH. And of course, firmware image at 0x20000 offset.

Thank you for posting this information.

I have a board that is modelled after MR3220V1.  The board has 8M flash installled.  I received the board with a working version of OpenWRT installed onto it (attitude_adjustment).  All works OK.

I have now compiled a custom version of OpenWRT (barrier_breaker branch, latest).

I changed these 2 files:
/target/linux/ar71xx/image/Makefile
/tools/firmware-utils/src/mktplinkfw.c

Both to reflect an 8M image.  The image compiles fine, and builds a 8M factory.bin, and a 3.6M sysupgrade.

I have tried to install both the factory and sysupgrade from the default firmware I received, and both cause the WiFi to no longer work.

This is the log from working firmware:
[   13.820000] ath: EEPROM regdomain: 0x65
[   13.820000] ath: EEPROM indicates we should expect a direct regpair map
[   13.820000] ath: Country alpha2 being used: 00
[   13.820000] ath: Regpair used: 0x65

This is the log from non-working firmware:
[   14.570000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   14.580000] ath: phy0: Bad EEPROM checksum 0x0 or revision 0x000f
[   14.580000] ath: phy0: Unable to initialize hardware; initialization status: -22
[   14.590000] ath9k 0000:00:00.0: Failed to initialize device
[   14.600000] ath9k: probe of 0000:00:00.0 failed with error -22

From what I read, it would seem there is an issue with the ART partition, however I have compared a backup from the working firmware, to what exists after a sysupgrade, and the are the same, as I would expect.

Any suggestions on what is causing this.

More logs:

From working firmware:
[    0.770000] 0x000000000000-0x000000020000 : "u-boot"
[    0.780000] 0x000000020000-0x00000010f400 : "kernel"
[    0.780000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] 0x00000010f400-0x0000007f0000 : "rootfs"
[    0.800000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.820000] mtd: partition "rootfs" set to be root filesystem
[    0.820000] mtd: partition "rootfs_data" created automatically, ofs=450000, len=3A0000
[    0.830000] 0x000000450000-0x0000007f0000 : "rootfs_data"
[    0.840000] 0x0000007f0000-0x000000800000 : "art"
[    0.840000] 0x000000020000-0x0000007f0000 : "firmware"

From non-working:
[    0.780000] 0x000000000000-0x000000020000 : "u-boot"
[    0.790000] 0x000000020000-0x000000133e00 : "kernel"
[    0.790000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.810000] 0x000000133e00-0x0000007f0000 : "rootfs"
[    0.810000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.830000] mtd: device 2 (rootfs) set to be root filesystem
[    0.830000] 1 squashfs-split partitions found on MTD device rootfs
[    0.840000] 0x000000390000-0x0000007f0000 : "rootfs_data"
[    0.850000] 0x0000007f0000-0x000000800000 : "art"
[    0.850000] 0x000000020000-0x0000007f0000 : "firmware"

Thanks for the help.

In what location should I check the MAC address?  In the firmware image or in a config in OpenWRT?

I assumed since an image was already present, upgrading with a sysupgrade would not break anything, but it seems to have.

There is no MAC set in either of the configs.

Here is the config from the working firmware (AA):

config wifi-device  radio0
    option type     mac80211
    option channel  11
    option hwmode    11ng
    option path    'pci0000:00/0000:00:00.0'
    option htmode    HT20
    list ht_capab    SHORT-GI-40
    list ht_capab    TX-STBC
    list ht_capab    RX-STBC1
    list ht_capab    DSSS_CCK-40
    # REMOVE THIS LINE TO ENABLE WIFI:
    #option disabled 1

config wifi-iface
    option device   radio0
    option network  lan
    option mode     ap
    option ssid     Cell_Wireless
    option encryption none

Here is the config from the non-working firmware (BB)

config wifi-device 'radio0'
    option type 'mac80211'
    option channel '11'
    option hwmode '11ng'
    option path 'pci0000:00/0000:00:00.0'
    list ht_capab 'SHORT-GI-40'
    list ht_capab 'TX-STBC'
    list ht_capab 'RX-STBC1'
    list ht_capab 'DSSS_CCK-40'
    option txpower '16'
    option distance '400'
    option htmode 'HT20'
    option country 'US'

config wifi-iface
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid 'Wireless
    option encryption 'psk2+ccmp'
    option key 'Wireless'

I will try to flash the ART parition back from the working version.  I have no problem re-flashing the working firmware, this always results in WiFi working again, so this implies to me that the ART partition is OK in general....

Could is be something with BB causing this issue?  Unlikely though.

I only see the MAC in Luci from the working firmware:   90:4C:E5:49:C9:8B.

The non-working firmware does not show it.

Here is kernel log from working firmware:

[    0.000000] Linux version 3.3.8 (david@ubunt) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Wed Jul 23 21:35:29 CST 2014
[    0.000000] MyLoader: sysp=82408001, boardp=21453249, parts=a06c2a17
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR7241 rev 1
[    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:5.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 802f6a60, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16256 pages, LIFO batch:3
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=TL-MR3220 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61464k/65536k available (2222k kernel code, 4072k reserved, 430k data, 212k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.090000] gpiochip_add: registered GPIOs 0 to 17 on device: ath79
[    0.100000] MIPS: machine is CELL_ROUTER-V2
[    0.530000] registering PCI controller with io_map_base unset
[    0.550000] bio: create slab <bio-0> at 0
[    0.550000] usbcore: registered new interface driver usbfs
[    0.560000] usbcore: registered new interface driver hub
[    0.560000] usbcore: registered new device driver usb
[    0.570000] PCI host bridge to bus 0000:00
[    0.570000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.580000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.580000] pci 0000:00:00.0: [168c:002a] type 0 class 0x000280
[    0.580000] pci 0000:00:00.0: reg 10: [mem 0x10000000-0x1000ffff 64bit]
[    0.580000] pci 0000:00:00.0: supports D1
[    0.580000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.580000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.590000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.590000] Switching to clocksource MIPS
[    0.600000] NET: Registered protocol family 2
[    0.600000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.610000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.620000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.620000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.630000] TCP reno registered
[    0.630000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.640000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.650000] NET: Registered protocol family 1
[    0.650000] PCI: CLS 0 bytes, default 32
[    0.670000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.670000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.690000] msgmni has been set to 120
[    0.690000] io scheduler noop registered
[    0.690000] io scheduler deadline registered (default)
[    0.700000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.730000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.730000] console [ttyS0] enabled, bootconsole disabled
[    0.750000] m25p80 spi0.0: found s25sl064a, expected m25p80
[    0.750000] m25p80 spi0.0: s25sl064a (8192 Kbytes)
[    0.760000] 5 tp-link partitions found on MTD device spi0.0
[    0.760000] Creating 5 MTD partitions on "spi0.0":
[    0.770000] 0x000000000000-0x000000020000 : "u-boot"
[    0.780000] 0x000000020000-0x00000010f400 : "kernel"
[    0.780000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] 0x00000010f400-0x0000007f0000 : "rootfs"
[    0.800000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.820000] mtd: partition "rootfs" set to be root filesystem
[    0.820000] mtd: partition "rootfs_data" created automatically, ofs=450000, len=3A0000
[    0.830000] 0x000000450000-0x0000007f0000 : "rootfs_data"
[    0.840000] 0x0000007f0000-0x000000800000 : "art"
[    0.840000] 0x000000020000-0x0000007f0000 : "firmware"
[    0.870000] ag71xx_mdio: probed
[    0.870000] eth0: Atheros AG71xx at 0xba000000, irq 5
[    1.430000] eth0: Found an AR7240/AR9330 built-in switch
[    2.460000] eth1: Atheros AG71xx at 0xb9000000, irq 4
[    3.010000] ag71xx ag71xx.0: eth1: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[    3.020000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    3.030000] TCP cubic registered
[    3.030000] NET: Registered protocol family 17
[    3.040000] 8021q: 802.1Q VLAN Support v1.8
[    3.050000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    3.060000] Freeing unused kernel memory: 212k freed
[    6.380000] Registered led device: tp-link:green:system
[    6.380000] Registered led device: tp-link:green:qss
[    6.380000] Registered led device: tp-link:green:3g
[    7.350000] eth0: link up (1000Mbps/Full duplex)
[    9.690000] JFFS2 notice: (425) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 13 of xref (0 dead, 0 orphan) found.
[    9.810000] eth0: link down
[   12.150000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   12.160000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   12.340000] cfg80211: Calling CRDA to update world regulatory domain
[   12.340000] cfg80211: World regulatory domain updated:
[   12.350000] cfg80211:  DFS Master region: unset
[   12.350000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   12.360000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.370000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.380000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   12.390000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   12.390000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   12.400000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   12.750000] SCSI subsystem initialized
[   13.840000] ath: EEPROM regdomain: 0x65
[   13.840000] ath: EEPROM indicates we should expect a direct regpair map
[   13.840000] ath: Country alpha2 being used: 00
[   13.840000] ath: Regpair used: 0x65
[   13.860000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   13.860000] Registered led device: ath9k-phy0
[   13.860000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xb0000000, irq=40
[   13.880000] button_hotplug: Unknown symbol input_register_handle (err 0)
[   13.890000] button_hotplug: Unknown symbol input_open_device (err 0)
[   13.900000] button_hotplug: Unknown symbol input_close_device (err 0)
[   13.900000] button_hotplug: Unknown symbol input_unregister_handler (err 0)
[   13.910000] button_hotplug: Unknown symbol input_register_handler (err 0)
[   13.920000] button_hotplug: Unknown symbol input_unregister_handle (err 0)
[   14.050000] PPP generic driver version 2.4.2
[   14.160000] tun: Universal TUN/TAP device driver, 1.6
[   14.160000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   14.280000] PPP MPPE Compression module registered
[   14.300000] L2TP core driver, V2.0
[   14.310000] L2TP netlink interface
[   14.440000] GRE over IPv4 demultiplexor driver
[   14.460000] GRE over IPv4 tunneling driver
[   14.620000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.790000] NET: Registered protocol family 24
[   14.910000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   14.920000] Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
[   14.930000] ehci-platform ehci-platform: Generic Platform EHCI Controller
[   14.930000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[   14.970000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[   14.990000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[   14.990000] hub 1-0:1.0: USB hub found
[   15.000000] hub 1-0:1.0: 1 port detected
[   15.110000] nf_conntrack version 0.5.0 (963 buckets, 3852 max)
[   15.500000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[   15.600000] PPPoL2TP kernel driver, V2.0
[   15.620000] PPTP driver version 0.8.5
[   16.140000] xt_time: kernel timezone is -0000
[   16.450000] uhci_hcd: USB Universal Host Controller Interface driver
[   16.600000] usbcore: registered new interface driver cdc_acm
[   16.610000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[   16.650000] usbcore: registered new interface driver usbserial
[   16.660000] USB Serial support registered for generic
[   16.670000] usbcore: registered new interface driver usbserial_generic
[   16.670000] usbserial: USB Serial Driver core
[   16.700000] Initializing USB Mass Storage driver...
[   16.710000] usbcore: registered new interface driver usb-storage
[   16.710000] USB Mass Storage support registered.
[   16.740000] usbcore: registered new interface driver ums-alauda
[   16.760000] usbcore: registered new interface driver ums-cypress
[   16.780000] usbcore: registered new interface driver ums-datafab
[   16.800000] usbcore: registered new interface driver ums-freecom
[   16.820000] usbcore: registered new interface driver ums-isd200
[   16.850000] usbcore: registered new interface driver ums-jumpshot
[   16.870000] usbcore: registered new interface driver ums-karma
[   16.890000] usbcore: registered new interface driver ums-sddr09
[   16.910000] usbcore: registered new interface driver ums-sddr55
[   16.930000] usbcore: registered new interface driver ums-usbat
[   17.060000] usbcore: registered new interface driver cdc_ether
[   17.270000] USB Serial support registered for GSM modem (1-port)
[   17.270000] option 1-1:1.0: GSM modem (1-port) converter detected
[   17.280000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
[   17.290000] option 1-1:1.1: GSM modem (1-port) converter detected
[   17.290000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
[   17.300000] option 1-1:1.2: GSM modem (1-port) converter detected
[   17.310000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB2
[   17.310000] option 1-1:1.3: GSM modem (1-port) converter detected
[   17.320000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB3
[   17.330000] usbcore: registered new interface driver option
[   17.330000] option: v0.7.2:USB Driver for GSM modems
[   17.450000] USB Serial support registered for Qualcomm USB modem
[   17.460000] usbcore: registered new interface driver qcserial
[   17.560000] USB Serial support registered for Sierra USB modem
[   17.560000] usbcore: registered new interface driver sierra
[   17.570000] sierra: v.1.7.16:USB Driver for Sierra Wireless USB modems
[   25.090000] device eth0 entered promiscuous mode
[   25.730000] eth0: link up (1000Mbps/Full duplex)
[   25.730000] br-lan: port 1(eth0) entered forwarding state
[   25.740000] br-lan: port 1(eth0) entered forwarding state
[   27.740000] br-lan: port 1(eth0) entered forwarding state
[   30.660000] device wlan0 entered promiscuous mode
[   30.810000] br-lan: port 2(wlan0) entered forwarding state
[   30.810000] br-lan: port 2(wlan0) entered forwarding state
[   32.810000] br-lan: port 2(wlan0) entered forwarding state

Here is Kernel log from non-working firmware.  Thank you for your help!

[    0.000000] Linux version 3.10.49 (mark@mark-VirtualBox) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r371) ) #51 Sun Aug 24 16:30:01 TAHT 2014
[    0.000000] MyLoader: sysp=82408001, boardp=21452248, parts=a06c2a17
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR7241 rev 1
[    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:5.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 8033e9b0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=TL-MR3220 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61080k/65536k available (2384k kernel code, 4456k reserved, 644k data, 232k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.080000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is TP-LINK TL-MR3220
[    0.500000] registering PCI controller with io_map_base unset
[    0.550000] bio: create slab <bio-0> at 0
[    0.550000] usbcore: registered new interface driver usbfs
[    0.560000] usbcore: registered new interface driver hub
[    0.560000] usbcore: registered new device driver usb
[    0.570000] PCI host bridge to bus 0000:00
[    0.570000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.580000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.580000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.590000] pci 0000:00:00.0: [168c:002a] type 00 class 0x028000
[    0.590000] pci 0000:00:00.0: fixup device configuration
[    0.590000] pci 0000:00:00.0: reg 10: [mem 0x10000000-0x1000ffff 64bit]
[    0.590000] pci 0000:00:00.0: supports D1
[    0.590000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.590000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.590000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.600000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.600000] Switching to clocksource MIPS
[    0.610000] NET: Registered protocol family 2
[    0.610000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.620000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.630000] TCP: Hash tables configured (established 512 bind 512)
[    0.630000] TCP: reno registered
[    0.640000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.640000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.650000] NET: Registered protocol family 1
[    0.650000] PCI: CLS 0 bytes, default 32
[    0.670000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.680000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.690000] msgmni has been set to 119
[    0.690000] io scheduler noop registered
[    0.700000] io scheduler deadline registered (default)
[    0.700000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.730000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.740000] console [ttyS0] enabled, bootconsole disabled
[    0.750000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.760000] m25p80 spi0.0: found s25sl064a, expected m25p80
[    0.770000] m25p80 spi0.0: s25sl064a (8192 Kbytes)
[    0.770000] 5 tp-link partitions found on MTD device spi0.0
[    0.780000] Creating 5 MTD partitions on "spi0.0":
[    0.780000] 0x000000000000-0x000000020000 : "u-boot"
[    0.790000] 0x000000020000-0x000000133e00 : "kernel"
[    0.790000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.810000] 0x000000133e00-0x0000007f0000 : "rootfs"
[    0.810000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.830000] mtd: device 2 (rootfs) set to be root filesystem
[    0.830000] 1 squashfs-split partitions found on MTD device rootfs
[    0.840000] 0x0000003a0000-0x0000007f0000 : "rootfs_data"
[    0.850000] 0x0000007f0000-0x000000800000 : "art"
[    0.850000] 0x000000020000-0x0000007f0000 : "firmware"
[    0.880000] libphy: ag71xx_mdio: probed
[    1.430000] ag71xx-mdio.1: Found an AR7240/AR9330 built-in switch
[    2.470000] eth0: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    3.020000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[    3.030000] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    3.040000] usbcore: registered new interface driver cdc_ether
[    3.050000] usbcore: registered new interface driver rndis_host
[    3.050000] usbcore: registered new interface driver sierra_net
[    3.060000] usbcore: registered new interface driver cdc_ncm
[    3.060000] usbcore: registered new interface driver qmi_wwan
[    3.070000] usbcore: registered new interface driver cdc_wdm
[    3.080000] TCP: cubic registered
[    3.080000] NET: Registered protocol family 17
[    3.090000] 8021q: 802.1Q VLAN Support v1.8
[    3.100000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    3.110000] Freeing unused kernel memory: 232K (80356000 - 80390000)
[    5.910000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.910000] ehci-platform: EHCI generic platform driver
[    5.920000] ehci-platform ehci-platform: EHCI Host Controller
[    5.930000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    5.940000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[    5.960000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[    5.960000] hub 1-0:1.0: USB hub found
[    5.970000] hub 1-0:1.0: 1 port detected
[    5.970000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    5.980000] uhci_hcd: USB Universal Host Controller Interface driver
[    6.380000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    6.830000] qmi_wwan 1-1:1.1: cdc-wdm0: USB WDM device
[    6.850000] qmi_wwan 1-1:1.1 wwan0: register 'qmi_wwan' at usb-ehci-platform-1, WWAN/QMI device, d2:7c:5d:4c:2a:a8
[   11.190000] jffs2: notice: (343) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 20 of xref (0 dead, 2 orphan) found.
[   13.830000] NET: Registered protocol family 10
[   13.870000] nf_conntrack version 0.5.0 (958 buckets, 3832 max)
[   13.890000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.940000] u32 classifier
[   13.940000]     input device check on
[   13.950000]     Actions configured
[   13.960000] Mirror/redirect action on
[   13.980000] usbcore: registered new interface driver cdc_acm
[   13.980000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[   14.000000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   14.000000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   14.020000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.090000] usbcore: registered new interface driver usbserial
[   14.090000] usbcore: registered new interface driver usbserial_generic
[   14.120000] usbserial: USB Serial support registered for generic
[   14.190000] xt_time: kernel timezone is -0000
[   14.270000] cfg80211: Calling CRDA to update world regulatory domain
[   14.290000] cfg80211: World regulatory domain updated:
[   14.290000] cfg80211:  DFS Master region: unset
[   14.290000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   14.300000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.310000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.320000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   14.330000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[   14.340000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   14.350000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   14.350000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   14.360000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   14.410000] PPP generic driver version 2.4.2
[   14.410000] NET: Registered protocol family 24
[   14.420000] usbcore: registered new interface driver sierra
[   14.430000] usbserial: USB Serial support registered for Sierra USB modem
[   14.470000] usbcore: registered new interface driver option
[   14.480000] usbserial: USB Serial support registered for GSM modem (1-port)
[   14.490000] option 1-1:1.0: GSM modem (1-port) converter detected
[   14.500000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
[   14.500000] option 1-1:1.2: GSM modem (1-port) converter detected
[   14.510000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
[   14.520000] option 1-1:1.3: GSM modem (1-port) converter detected
[   14.540000] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB2
[   14.560000] usbcore: registered new interface driver qcserial
[   14.560000] usbserial: USB Serial support registered for Qualcomm USB modem
[   14.600000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   14.610000] ath: phy0: Bad EEPROM checksum 0x0 or revision 0x000f
[   14.610000] ath: phy0: Unable to initialize hardware; initialization status: -22
[   14.620000] ath9k 0000:00:00.0: Failed to initialize device
[   14.630000] ath9k: probe of 0000:00:00.0 failed with error -22
[   23.030000] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   23.050000] device eth1 entered promiscuous mode
[   23.050000] br-lan: port 1(eth1) entered forwarding state
[   23.060000] br-lan: port 1(eth1) entered forwarding state
[   24.130000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   24.140000] br-lan: port 1(eth1) entered disabled state
[   25.820000] eth1: link up (100Mbps/Full duplex)
[   25.820000] br-lan: port 1(eth1) entered forwarding state
[   25.830000] br-lan: port 1(eth1) entered forwarding state
[   25.830000] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   27.830000] br-lan: port 1(eth1) entered forwarding state

have you tried a standard official image of both AA and BB?

I just want to be clear before I try this, as I can't afford to brick the router right now:

1) Install working firmware, confirm WiFi is working.
2) Build a BB firmware.
3) Transfer the BB firmware (sysupgrade) to the router.
4) Run:  mtd -r write sysupgrade.bin firmware

I will try this once I get an OK here and report the results back.

I have not tried the standard builds for AA or BB as the router is not a true MR3220, but based on it.  I was/am concerned that trying the standard firmware will brick something, but if that is not possible, let me know and I can try. The MR3220 builds are for 4meg router, the router I am using is 8meg, so I assumed I should not try the standard firmwares or it might take me a step backwards in getting by 8meg build to work correctly.

(Last edited by JohnV on 26 Aug 2014, 21:13)

I assumed you had serial access!
If that's the case, you can try official images without problem imho.

I used mtd to flash "firmware", still no luck.

Is there a chance the working firmware I have has been reconfigured in some way as to make it incompatible with standard OpenWRT builds?

I am waiting for the pin information from the manufacturer, so at the moment, I do not have serial access,.

I will wait for that so at least I can get into the router again if the firmware causes issues. 

Reading this thread though, it is unclear if all will be OK if I go from a 4meg image (assuming that works ok) to an 8meg image I am building.  Also, what will happen if I go from the working 8meg image, back to a 4meg image.

The issue is I cannot manually create images for each router, as we will be putting our firmware on 100's of these units, so I need some relatively easy way to get our firmware installed correctly.

I now have serial access, and here is the U-boot and printenv info.

Is it "normal" the ART partition would say 1792k in here?  This is the log when I have the working AA firmware installed....

U-Boot 1.1.8 (Jul 31 2011 - 10:00:00)

AP99 (ar7241) U-boot <phantasm131@gmail.com>
DRAM:
sri
ar7240_ddr_initial_config(133): virian ddr1 init
#### TAP VALUE 1 = 0xf, 2 = 0x10 [0x0: 0x1f]
64 MB
id read 0x100000ff
sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7014
eth0: 00:03:7f:09:0b:ad
eth0 up
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0
Atheros> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),5120k(rootfs),896k(uImage),64k(NVRAM),1792k(ART)
bootcmd=bootm 0x9f020000
bootdelay=3
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.10
serverip=192.168.1.18
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 359/65532 bytes