On a bricked DIR-615 E3, removed the FLASH chip from board (MX25L3206) and reloaded it with with U-Boot AP99 v1.3.0
Connected FLASH back to board and it boots and I via putty serial I have terminal access, prompts AR7241>
Below are the boot messages, did "help" for available commands, and did "printenv" and changed "bootdelay" to 10

My question is, how to proceed from here ??

1) Should I send in via tftp an  original factory image or try open-wrt or dd-wrt ?

2) Can I load firmware imag into flash  thru the serial console?

3) U-Boot looking for an image at  address 9f020000,maybe  copy some image there with my programmer ?

Thanks for any reply!

U-Boot 1.3.0 (Nov  6 2011 - 17:03:51)@TTHR

AP99 (ar7240 - Python) U-boot
ar7240_ddr_initial_config(138): python ddr init
CPU_FREQ=410##DDR_FREQ=410##AHB_FREQ=205
DRAM:  32 MB
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7014
eth0: 40:16:9f:ab:e0:82
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 40:16:9f:ab:e0:82
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Error: Bad gzipped data
GUNZIP ERROR - must RESET board to recover

Resetting...

AR7241# printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),6720k(rootfs),1280k(Kernel),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=2
baudrate=115200
ethaddr=0x40:0x16:0x9F:0xAB:0xE0:0x82
ipaddr=192.168.1.32
serverip=192.168.1.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 332/65532 bytes

AR7241# help
?       - alias for 'help'
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp    - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
AR7241# version

U-Boot 1.3.0 (Nov  6 2011 - 17:03:51)@TTHR
AR7241# base
Base Address: 0x00000000
AR7241# coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr
AR7241# flinfo

Bank # 1:
Flash MF_ID:[0xc2]Dev_ID:[0x20]Size_ID:[0x16]
Flash Size:[8MByte]
Flash has [128] Sectors

1) it's probably a better idea to flash an openwrt image (some original firmware might come packaged with a bootloader).
2) sure. see this part of the wr1043nd wiki: http://wiki.openwrt.org/toh/tp-link/tl- … 232.method
3) would be possible, but now that you already have a valid uboot, you can use it to program the flash. commands are basically the same as for the wr1043nd, but I'm sure you need to adjust the adresses a bit (use 0x9f.... instead of 0xbf....). give that mtest command a try and test the memory where you want to transfer the image to, first.

thanks for the info

tried the following:

made my pc's  lan a fixed address of 192.168.1.100

started tftpd32 ......tftp client.....host:192.168.1.32  port: left empty
local file name: xxx.bin,  GET

on the router:

ar7240> tftpboot 0x80000000 xxx.bin

receiving message on router:

Using eth1 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.32
Filename '1.bin'.
Load address: 0x80000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
eth0 link down
Using eth1 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.32
Filename '1.bin'.
Load address: 0x80000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
eth0 link down
Using eth1 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.32
Filename '1.bin'.
Load address: 0x80000000

I have tried to plug in ethernet cable into WAN and all the LAN port.....no change
PC shows status for the network cable is plugged in
Router does not reply to ping on neither 192.168.1.32 or 192.168.100
Router Lan/Wan lights are lighting  up when a cable is plugged in

Any suggestion/ advise  how to get tftp file transfer to work ?

(Last edited by jenom on 25 Jul 2013, 01:04)

Turn off your firewall,
on some cases you need to rename the binary file to "code.bin"

Hope this will help you.

Run tftpd32 after powering up the router. You should have a "Tftp Server" tab inside the application and above "Current Directory" and "Server interface" drop down menus. Choose directory which contains your image file and 192.168.1.100 as an interface.

It should look like this (I'm using static 192.168.1.2 IP on my network card):

thanks for all the replies and now file transfer went through
So this is what I did:

ar7240> tftpboot 0x80000000 FACTORY-TO-OPENWRT/DDWRT.bin

Bytes transferred = 3932160 (3c0000 hex)

ar7240> erase 0x9f020000 +0x3c0000

ar7240> cp.b 0x80000000 0x9f020000 0x3c0000

all went ok, no error messages , done

ar7240> bootm 0x9f020000

Router reboots, boot message on putty's serial terminal:

Booting Image at 9f020000
Uncompressing Kernel Image .....Error, Bad Gzipped Data
GUnzip error.......must reset board to recover

I have tried to load 3 different files: dlink 615 original, dd-wrt factory to ddwrt, openwrt-ar71xxx

Alway same error result !

I would like to add, that the U-boot came from a different router , (TPL-W..) which uses same Atheros hardware and has same memory. Unfortunately, I can not get a DIR-615 vE.3 U-boot

Any suggestion:
1) what file  I should  exactly load ?

2) how can I verify  that it is actually in the memory  and good ?

3) ???????

Thanks!

well... then use wr841v5 image (or v7?? ) !! obviously there are differences in uboot...

note: this seems strange to me..

mtdparts=ar7240-nor0:128k(u-boot),6720k(rootfs),1280k(Kernel),64k(ART)

(Last edited by nebbia88 on 26 Jul 2013, 05:23)

also strange that U-boot show 8 mb flash

Bank # 1:
Flash MF_ID:[0xc2]Dev_ID:[0x20]Size_ID:[0x16]
Flash Size:[8MByte]
Flash has [128] Sectors

and I have only 4 mb  (Mx25L3206)

I wish, I can find a more correct U-boot for my router, made for an AR7xx   like AP81, AP91 or AP93

Try a different RAM address, like:
ar7240> tftpboot 0x81000000 ...

You can also check the FLASH content with md command in U-Boot.

Maybe this topic will help you: https://forum.openwrt.org/viewtopic.php?id=30180

what uboot image have you flashed specifically?

Found a U-boot from TP-Link WR841ND  made for AR7240, with a correct 4 mb flash, 32 mb ram
After flashing, used TPL to stop, and flashed firmware as before:

ar7240> tftpboot 0x80000000 FACTORY-TO-DDWRT.bin

Bytes transferred = 3932160 (3c0000 hex)

ar7240> erase 0x9f020000 +0x3c0000

ar7240> cp.b 0x80000000 0x9f020000 0x3c0000

ar7240> bootm 0x9f020000

Router now rebooted, and started doing something different:

U-Boot 1.1.4 (Sep  3 2010 - 12:28:13)

AP91 (ar7240) U-boot
DRAM: 
sri
#### TAP VALUE 1 = a, 2 = b
32 MB
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

BOARD IS NOT CALIBRATED!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7014
eth0: 00:03:7f:09:0b:ad
eth0 up
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel...
done!
Starting kernel...

[    0.000000] flash_size passed from bootloader = 1731
[    0.000000] bootconsole [early0] enabled
AR7240
PT, I-cache aliases, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Linux version 3.5.7 (root@dd-wrt) (gcc version 4.7.3 20121205 (prerelease) (Linaro GCC 4.7-2012.12) ) #6148 Mon Mar 25 08:58:25 CET 2013
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd init=/sbin/init
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] __ex_table already sorted, skipping sort
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 29472k/32768k available (2120k kernel code, 3296k reserved, 411k data, 164k init, 0k highmem)
[    0.000000] NR_IRQS:80
[    0.000000] Calibrating delay loop... 232.24 BogoMIPS (lpj=1161216)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.380000] registering PCI controller with io_map_base unset
[    0.400000] bio: create slab <bio-0> at 0
[    0.400000] PCI host bridge to bus 0000:00
[    0.410000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.410000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.420000] pci 0000:00:00.0: invalid calibration data
[    0.420000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.430000] PCI: mapping irq 72 to pin1@0000:00:00.0
[    0.430000] Switching to clocksource MIPS
[    0.440000] NET: Registered protocol family 2
[    0.440000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.450000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.460000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.460000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.470000] TCP: reno registered
[    0.470000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.480000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.490000] NET: Registered protocol family 1
[    0.490000] gpio_proc: module loaded and /proc/gpio/ created
[    0.500000] fixup WR741 Switch LED's
[    0.500000] wl0gpio_proc: module loaded and /proc/wl0gpio/ created
[    0.510000] squashfs: version 3.0 (2006/03/15) Phillip Lougher
[    0.510000] msgmni has been set to 57
[    0.520000] io scheduler noop registered (default)
[    0.520000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.550000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.560000] console [ttyS0] enabled, bootconsole disabled
[    0.560000] console [ttyS0] enabled, bootconsole disabled
[    0.570000] guessed flashsize = 4M
[    0.580000] scanning for root partition
[    0.580000] tplink uboot detected
[    0.580000] guessed bootloader size = 20000
[    0.590000]
[    0.590000] found squashfs at 110000
[    0.600000] Creating 8 MTD partitions on "ar7240-nor0":
[    0.600000] 0x000000000000-0x000000020000 : "RedBoot"
[    0.610000] 0x000000020000-0x0000003e0000 : "linux"
[    0.610000] 0x000000110000-0x0000003e0000 : "rootfs"
[    0.620000] mtd: partition "rootfs" set to be root filesystem
[    0.630000] 0x0000003e0000-0x000000400000 : "ddwrt"
[    0.630000] 0x0000003e0000-0x0000003f0000 : "nvram"
[    0.640000] 0x0000003f0000-0x000000400000 : "board_config"
[    0.650000] 0x000000000000-0x000000400000 : "fullflash"
[    0.660000] 0x000000000000-0x000000020000 : "fullboot"
[    1.060000] PPP generic driver version 2.4.2
[    1.070000] PPP BSD Compression module registered
[    1.070000] PPP Deflate Compression module registered
[    1.080000] PPP MPPE Compression module registered
[    1.080000] NET: Registered protocol family 24
[    1.110000] u32 classifier
[    1.110000]     Performance counters on
[    1.110000]     input device check on
[    1.120000]     Actions configured
[    1.120000] Netfilter messages via NETLINK v0.30.
[    1.120000] nf_conntrack version 0.5.0 (460 buckets, 1840 max)
[    1.130000] nf_conntrack_rtsp v0.6.21 loading
[    1.140000] nf_nat_rtsp v0.6.21 loading
[    1.140000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.150000] IPP2P v0.8.2 loading
[    1.150000] TCP: westwood registered
[    1.150000] TCP: hybla registered
[    1.160000] TCP: vegas registered
[    1.160000] NET: Registered protocol family 17
[    1.160000] Bridge firewalling registered
[    1.170000] 8021q: 802.1Q VLAN Support v1.8
[    1.170000] searching for nvram
[    1.180000] nvram size = 0
[    1.210000] Broken NVRAM found, recovering it (Magic FFFFFFFF)
[    1.220000] Atheros AR71xx hardware watchdog driver version 0.1.0
[    1.220000] ar71xx-wdt: timeout=15 secs (max=24) ref freq=175000000
[    1.230000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.240000] Freeing unused kernel memory: 164k freed
start service
starting Architecture code for wr741
starting hotplug
Jan  1 00:00:03 udevtrigger[238]: parse_config_file: can't open '/etc/udev/udev.conf' as config file: No such file or directory
done
load ATH Ethernet Driver
[    4.540000] ag71xx_mdio: probed
[    4.540000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    5.130000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd041, driver=Generic PHY]
[    5.140000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    5.710000] eth1: Found an AR7240/AR9330 built-in switch
configure eth0 to f8:d1:11:21:1a:d6
configure eth1 to F8:D1:11:21:1A:D7
/bin/sh: can't create /sys/class/leds/generic_13/port_mask: nonexistent directory
/bin/sh: can't create /sys/class/leds/generic_14/port_mask: nonexistent directory
/bin/sh: can't create /sys/class/leds/generic_15/port_mask: nonexistent directory
/bin/sh: can't create /sys/class/leds/generic_16/port_mask: nonexistent directory
load ATH 802.11 a/b/g Driver
load ATH9K 802.11n Driver
[    9.150000] Compat-drivers backport release: compat-drivers-2013-01-21-1
[    9.150000] Backport based on wireless-testing.git master-2013-02-22
[    9.160000] compat.git: wireless-testing.git
[    9.370000] cfg80211: Calling CRDA to update world regulatory domain
[    9.370000] cfg80211: World regulatory domain updated:
[    9.380000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[    9.390000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[    9.390000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[    9.400000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[    9.410000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[    9.420000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   10.180000] eth0: link up (100Mbps/Full duplex)
[   12.420000] eth0: link down
[   12.490000] device eth0 entered promiscuous mode
[   14.600000] device eth1 entered promiscuous mode
[   15.280000] eth0: link up (100Mbps/Full duplex)
[   15.600000] br0: port 1(eth0) entered forwarding state
[   15.600000] br0: port 1(eth0) entered forwarding state
br0: No such process
SIOCGIFFLAGS: No such device
erase[0]erase[65536]
Sending SIGTERM to all processes[   17.490000] ar71xx-wdt: device closed unexpectedly, watchdog timer will not stop!

[   17.600000] br0: port 1(eth0) entered forwarding state
[   19.000000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
Sending SIGKILL to all processes
[   25.530000] Restarting system.

Tried to load using  a same procedure firmware written for TP-Link TL-WR841ND (that is where U-boot came from),
however I got exactly the same result !

Can someone explain from above what went wrong here ?

Take out art partition of your bricked DIR-615 E3 (removed FLASH chip) and upload it to router.

why are you using factory to ddwrt??? Seems the wrong firmware to me xD

jenom -

    Will you please explain to me how you managed to flash u-boot directly to the serial chip. I have been trying to do this for days now. I am using a bus_pirate and I am able to remove the chip from my router and write to it no problem but I am confused about the file format to write to the flash chip.

thanks for everybody for their replies
BIG THANKS for PEPE2K from Poland to sending me the link......now I have new target addresses:

0x81000000 0xbf040000

the U-Boot I am using is from a TP-Link TL WR841ND, it is an AR77xx router, same memory size of 4 Mb/ 32 MB ,

when firmware loaded, I can not stop at boot-prompt with "TPL", got only 1 sec
needed to reflash chip with U-Boot again and then I can stop it
I will do "md" and will post result

For MOTOXX138

I am using SPIPGM program, with home made build, only 5x 150 Ohm resistor, 1 capacitor, parallel cable, and a 8 pin IC socket
Google SPIPGM, you will find easily the program and schematics, etc....

Do you have a DIR-615 v E3 or E4 router 's U-BOOT file ?
If you do, can you PM , and I will send you my email address to get it

For SATURN-B
I have already erased (wiped empty) my flash chip about 10 times, there is no ART there

My apologies if I am wrong, but I think you misunderstood my question. I am not having any problem reading/writing/erasing the chip.  I am using flashrom with my buspirate to achieve this.  I am confused as to what file you are flashing to the chip. If I understand correctly I can't just take U-boot.bin, pad it to 4mb and write it to the chip and have the router recognize the code properly? FYI the router I am trying to do this with is a WNR2000v4 which also has an ap81 reference board with a 4mb flash and 32mb ram.

Yes, you can. Put the U-Boot.bin file at 0x0 offset on the chip and it should boot.

Awesome, thank you very much pepe2k. I have been trying to figure this out for almost 5 days now. lol

If I understand correctly I can't just take U-boot.bin, pad it to 4mb and write it to the chip and have the router recognize the code properly?

For motoxx 138

yes, you can write you-boot as it is, done it about a dozen times
just erase your flash completely and send it there

followin pepe2k 's link, read ldpinney posts
sent him a PM, hoping he still around and willing to share U-boot he used
he emailed back and attached his U-boot file
after loading it, it created totally different partitions:

U-Boot 1.1.4 (Dec 29 2009 - 22:03:13)

AP99 (ar7240 - Python) U-boot
DRAM: 
sri
#### TAP VALUE 1 = 0x8, 2 = 0x8 [0x10101111: 0x20220202]
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 244k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
*** Warning - bad CRC, using default environment

BOARD IS NOT CALIBRATED!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7014
eth0: 00:03:7f:09:0b:ad
eth0 up
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  1  0

this U-Boot has more commands, including "bdinfo", "iminfo" "progmac" "saveenv"

base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp    - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
erase   - erase FLASH memory
ethreg    - S26 PHY Reg rd/wr  utility
exit    - exit script
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
itest    - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs    - boot image via network using NFS protocol
nm      - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version
autoscr - run script from memory

here is "bdinfo"

ar7240> bdinfo
boot_params = 0x81F6FFB0
memstart    = 0x80000000
memsize     = 0x02000000
flashstart  = 0xBF000000
flashsize   = 0x00400000
flashoffset = 0x0002F040
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     = 192.168.1.10
baudrate    = 115200 bps

I think that ethernet address will be a trouble !

here  is "printenv"

ar7240>   printenv

bootargs=console=ttyS0,115200 root=31:03 rootfstype=squashfs,jffs2 init=/sbin/init mtdparts=ar7240-nor0:192k(u-boot),64k(nvram),960k(linux),2560k(rootfs),64k(MAC),192k(LP),64k(ART)
bootcmd=bootm 0xbf040000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.10
serverip=192.168.1.27
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

The ethernet address does not look valid, isnt it ?
So I made my PC's static IP same as server address (192.168.1.27)
When I tried to transfer FW image as before, it did not go through!
LDPINNEY had a same problem and ended up using a serial transfer mode.
I am not familiar neither with LOADB (kermit)  or LOADY (v-modem)  method:
-- how to set up my pc ?,
--what program do I need ?

I would like to figure out, how to fix that aa:bb:cc:dd:ee ethernet address somehow, since I have all the info written on the case: s/n  mac id, wps pin,
I can see two  maybe useful commands:  PROGMAC   and ETHREG

Anybody can advise  how to use them ?

again, you can use this method to use with kermit: http://wiki.openwrt.org/toh/tp-link/tl- … 232.method
I made mostly good experience using minicom, which supports a bunch of serial transfer protocols.

currently I am fighting with a suddenly misbehaving TTl-RS232 converter, (Max2323 Ebay $2.50)

the "received" messages on the screen are fine, however my typing from keyboard shows as "garbled" characters

it was working fine before, using same settings as before, trying with different terminal programs (putty, foxterm,q-term), all shows the same

--I am going to shorten 3 wires between router's board to TTL-RS232 converter from 20" (50 cm) to 10" (25 cm)
--change power supply to TTL-RS232 board (3.3VDC ----5.0 VDC)
--add some filter capacitor to +/- terminal on the TTL-RS232 board
--change capacitors on board

As for a serial transfer, since I have only one serial port to work with , so the same port will be used for terminal communication (console) and file transfer (kermit, ymodem, xmodem).

So I would start first: loadb/loady on router and close putty and then  transfer with minicom/tere term/c-kermit  ???

(Last edited by jenom on 28 Jul 2013, 16:28)

What is this supposed to mean? 5 VDC gives me a bad feeling.

I don't know how different terminal programs behave when sharing the serial port with other programs. I always used minicom, which is a terminal program, which offers serial upload with a lot of protocols.
But if in doubt, then yes: you issue loadb/loady, which makes the router listen for incoming data. And if your terminal program doesn't support file upload, then you need to quit it and run a program that does the file upload. But this way you might miss messages of the router after upload is complete.

you are right, max3232 uses exactly 3.3 vdc
I have a max232a in another project, using 5 vdc
capacitors on this max3232 board supposed to be 100 nF, very likely they are good
the max232a board had larger capacitors on it (1 uF, etc...), and they maybe be more troublesome (electrolytes)

I am in a search for a nice terminal program , where I can do telnet and file transfer in a same program,
so far collected hyperterminal, Qmodem, Erics telnet

Meanwhile used putty to start loadb 0x81000000 , exit putty, started tera term ..File...Transfer....Kermit...Send

Watched file transfer for about 15-20 min, then did:
--- erase 0xbf040000+0x390018
----cp.b 0x81000000 0xbf040000 0x390018
----bootm 0xbf040000

BAD MAGIC NUMBER !!!!

Checked with md at 81000000 and bf040000......same content

ar7240> md 0xbf040000
bf040000: 04111111 22222200 01110011 22222222    ....""".....""""
bf040010: 00011111 22222222 11111101 22222222    ....""""....""""
bf040020: 11111111 22222222 11110111 22202220    ....""""...." "
bf040030: 11111110 22022202 11100101 22222222    ....".".....""""
bf040040: 30111111 20222222 11011101 02222222    0... """....."""
bf040050: 11110111 22220200 11111111 22202022    ....""......"  "
bf040060: 11111111 20222222 10111111 22222022    .... """...."" "
bf040070: 11111111 22222022 11100111 22022222    ...."" "....".""
bf040080: 10111111 22222220 11101101 22222222    ....""" ....""""
bf040090: 11111111 22220220 11111110 22222222    ...."". ....""""
bf0400a0: 11111111 02222222 18111111 02020222    ....."""......."
bf0400b0: 11101111 02220222 11011010 22222222    ....."."....""""
bf0400c0: 11111011 22022222 11101011 22222002    ....".""...."" .
bf0400d0: 11111011 02220222 11101111 22202022    ....."."...."  "
bf0400e0: 13111001 22222022 11111111 22402220    ...."" "...."@"
bf0400f0: 01101011 22222202 11011110 02220222    ...."""......"."
ar7240>

Interestingly, when I tried to select and copy  the above in "putty", the ar7240> prompt changed to hush>
I could not do anything there, frozen, so Had to restart and use Q serial terminal
Did a quick research about "hush>", it is one of  busybox prompt....so does it mean busybox is running ???

Busybox started  by U-Boot?  Linux is running ?    Could it be used for to do something ?

Checked the first 4 bytes the image I have loaded:  27 05 19 56   (openwrt-ar71xx-generic-dir-615-squashfs-factory.bin)
Checked original D-Link firmware, same 27 05 19 56
Checked ddwrt firmware 48 44 52 30

1) something went wrong with my upload ?
2) did I uploaded it to the wrong address ?
3) something wrong with MAGIC NUMBERS ?

(Last edited by jenom on 28 Jul 2013, 22:58)

you could crc32 the memory range that you uploaded your image to, as well as in the flash and compare it to the crc32 of the image file. this should prove, if the upload went correctly. another way of testing would be to use mw to fill the memory range with a certain byte-pattern (at best one, which is different to the last byte of your image file), first, and then check some sample ranges with md and compare it to the image file.