Attach a serial console and flash updated u-boot: ------------------------------------------- # 1. Update the Uboot tftpboot 82000000 openwrt-ar71xx-ap135-qca-legacy-uboot.bin erase 1:0-4 cp.b 0x82000000 0x9f000000 0x30000 reset --------------------------------------------- # 2. Install new firmware # ... (new u-boot coming up) # then flash OpenWrt tftp 82000000 openwrt-ar71xx-generic-librerouter-v1-squashfs-sysupgrade.bin erase 0x9f050000 +$filesize cp.b 0x82000000 0x9f050000 $filesize setenv bootcmd bootm 0x9f050000;saveenv ------------------------------------------------ # Sample session ---------------- # 1. Update Uboot ----------------- ath> tftpboot 82000000 openwrt-ar71xx-ap135-qca-legacy-uboot.bin Trying eth0 eth0 link down FAIL Trying eth1 dup 1 speed 1000 Using eth1 device TFTP from server 192.168.1.7; our IP address is 192.168.1.1 Filename 'openwrt-ar71xx-ap135-qca-legacy-uboot.bin'. Load address: 0x82000000 Loading: ################################## done Bytes transferred = 171588 (29e44 hex) ath> erase 1:0-4 First 0x0 last 0x4 sector size 0x10000 4 ath> cp.b 0x82000000 0x9f000000 0x30000 Copy to Flash... write addr: 9f000000 done ath> reset ------------------------------------------------ #Restart.... eth1: 00:03:7f:11:2e:d9 eth1 up eth0, eth1 Setting 0x18116290 to 0x50a0214f Hit any key to stop autoboot: 0 ## Booting image at 9f050000 ... Bad Magic Number ath> ------------------------------------------------ # 2. Install firmware --------------------- ath> tftp 82000000 openwrt-ar71xx-generic-librerouter-v1-squashfs-sysupgrade.bin Trying eth0 eth0 link down FAIL Trying eth1 dup 1 speed 1000 Using eth1 device TFTP from server 192.168.1.10; our IP address is 192.168.1.1 Filename 'openwrt-ar71xx-generic-librerouter-v1-squashfs-sysupgrade.bin'. Load address: 0x82000000 Loading: T T ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ######################################### done Bytes transferred = 3866628 (3b0004 hex) ath> erase 0x9f050000 +$filesize Erasing flash... First 0x5 last 0x40 sector size 0x10000 64 Erased 60 sectors ath> cp.b 0x82000000 0x9f050000 $filesize Copy to Flash... write addr: 9f050000 done ath> setenv bootcmd bootm 0x9f050000;saveenv Saving Environment to Flash... Protect off 9F040000 ... 9F04FFFF Un-Protecting sectors 4..4 in bank 1 Un-Protected 1 sectors Erasing Flash...Erasing flash... First 0x4 last 0x4 sector size 0x10000 4 Erased 1 sectors Writing to Flash... write addr: 9f040000 done Protecting sectors 4..4 in bank 1 Protected 1 sectors ath> reset