Hello guys,
I have searched for any similar case, but whithout success.
I have an Huawei AP6010SN. I have successfully installed kernel (generic) and rootsquash image (generic), but i can't set new address in envoirenment.
This is the envoirenment:

bootdelay=2
baudrate=9600
ubootfile=u-boot.bin
kernelfile=vmlinux.lzma.uImage
rootfsfile=CaviumFus-squashfs
configfile=config.jffs2
masterfile=masterfile.bin
artfile=art
erase_env=protect off 0x9e0c0000 +0xffff;erase 0x9e0c0000 +0xffff;protect on 0x9e0c0000 +0xffff;
update_mst=tftp 0x80060000 ${masterfile};protect off all;erase all;cp.b 0x80060000 0x9e000000 ${filesize};protect on all
update_bootA=tftp 0x80060000 ${ubootfile};protect off 9e000000 9e07ffff;erase 9e000000 +${filesize};cp.b 80060000 9e000000 ${filesize};protect on 9e000000 9e07ffff
update_bootB=tftp 0x80060000 ${ubootfile};protect off 9f000000 9f07ffff;erase 9f000000 +${filesize};cp.b 80060000 9f000000 ${filesize};protect on 9f000000 9f07ffff
update_boot=run update_bootA;run update_bootB
update_kA=tftp 0x80060000 ${kernelfile};protect off 9e100000 9e1fffff;erase 9e100000 +${filesize};cp.b 80060000 9e100000 ${filesize};protect on 9e100000 9e1fffff
update_rA=tftp 0x80060000 ${rootfsfile};protect off 9ec00000 9f5fffff;erase 9ec00000 +${filesize};cp.b 80060000 9ec00000 ${filesize};protect on 9ec00000 9f5fffff
update_kB=tftp 0x80060000 ${kernelfile};protect off 9e300000 9e3fffff;erase 9e300000 +${filesize};cp.b 80060000 9e300000 ${filesize};protect on 9e300000 9e3fffff
update_rB=tftp 0x80060000 ${rootfsfile};protect off 9f600000 9fffffff;erase 9f600000 +${filesize};cp.b 80060000 9f600000 ${filesize};protect on 9f600000 9fffffff
update_cfgA=tftp 0x80060000 ${configfile};protect off 9ed00000 9effffff;erase 9ed00000 +${filesize};cp.b 80060000 9ed00000 ${filesize};protect on 9ed00000 9effffff
update_cfgB=tftp 0x80060000 ${configfile};protect off 9fcc0000 9ffbffff;erase 9fcc0000 +${filesize};cp.b 80060000 9fcc0000 ${filesize};protect on 9fcc0000 9ffbffff
update_cfg=run update_cfgA;run update_cfgB
update_art=tftp 0x80060000 ${artfile};protect off 9ffc0000 9fffffff;erase 9ffc0000 9fffffff;cp.b 80060000 9ffc0000 40000;protect on 9ffc0000 9fffffff
bootargsA=console=ttyS0,9600 root=/dev/mtdblock5 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:512k(BiosA),128k(BootupA),128k(BootupB),128k(BootEnv),128k(BoardData),12288k(SysImageA),3072k(configA),512k(BiosB),128k(ResultA),128k(ResultB),12288k(SysImageB),3072k(configB),256k(ArtArgs);
bootargsB=console=ttyS0,9600 root=/dev/mtdblock10 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:512k(BiosA),128k(BootupA),128k(BootupB),128k(BootEnv),128k(BoardData),12288k(SysImageA),3072k(configA),512k(BiosB),128k(ResultA),128k(ResultB),12288k(SysImageB),3072k(configB),256k(ArtArgs);
boot_kernel=setenv bootargs ${bootargsA};bootm ${boot_kA_addr}
boot_kernelB=setenv bootargs ${bootargsB};bootm ${boot_kB_addr}
rambootaddr=80800000
ramboot=setenv bootargs console=ttyS0,9600 mtdparts=ath-nor0:512k(BiosA),128k(BootupA),128k(BootupB),128k(BootEnv),128k(BoardData),12288k(SysImageA),3072k(configA),512k(BiosB),128k(ResultA),128k(ResultB),12288k(SysImageB),3072k(configB),256k(ArtArgs);mytftp ${rambootaddr} ${rambootfile};bootm ${rambootaddr}
boot_kB_addr=0x9f8c5000
ethact=eth0
filesize=9656c8
fileaddr=5500000
boot_kA_addr=0x9e905000
ipaddr=192.168.1.140
serverip=192.168.1.101
rambootfile=AP5X10XN_EMT_V200R002C00B828.bin
ethaddr=20:0b:c7:24:55:00
stdin=serial
stdout=serial
stderr=serial
bootcmd=run boot_kernelB
bootargs=console=ttyS0,9600 root=/dev/mtdblock10 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:512k(BiosA),128k(BootupA),128k(BootupB),128k(BootEnv),128k(BoardData),12288k(SysImageA),3072k(configA),512k(BiosB),128k(ResultA),128k(ResultB),12288k(SysImageB),3072k(configB),256k(ArtArgs);
Environment size: 3545/131068 bytes

I have on my tftp server openwrt-ar71xx-generic-uImage-lzma.bin as kernel (renamed vmlinux.lzma.uImage) and openwrt-ar71xx-generic-root.squashfs as root (renamed CaviumFus-squashfs).
I have flashed this image with that command:

run update_kB
run update_rB

Now, if I do

run boot_kernelB

system reply to me only

Bad Magic Number

If I change address of kernel boot with

setenv boot_kB_addr 0x9e300000
saveenv

I can see that:

ar7240> run boot_kernelB
   Uncompressingzzy Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.10.49 (krash@obu.trsh.local) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #1 Thu Oct 23 1:43:56 CEST 2014
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Clocks: CPU:480.000MHz, DDR:400.000MHz, AHB:240.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07f00000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07efffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07efffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32258
[    0.000000] Kernel command line:  console=ttyS0,9600 root=/dev/mtdblock10 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:512k(BiosA),128k(Bo
otupA),128k(BootupB),128k(BootEnv),128k(BoardData),12288k(SysImageA),3072k(configA),512k(BiosB),128k(ResultA),128k(ResultB),12288k(SysImageB),3072k(co
nfigB),256k(ArtArgs); mem=127M rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback Err

       ************************************************************
       **********************    *********    *********************
       ********************       *******       *******************
       ******************         *******         *****************
       ***********    ***          *****          ***    **********
       *********       ***         *****         ***      *********
       ********          **         ***         **         ********
       ********           **        ***        **          ********
       *********           **       ***       **          *********
       ***********          **      ***      **         ***********
       *****      ***         **    ***    **        ***      *****
       *****          ***      **  *****  **     ***          *****
       ******             ***   **********   ***             ******
       *********                 ********                 *********
       ************************************************************
       **********             **************             **********
       *************  ******************************  *************
       ************************************************************

                        Welcome To HUAWEI AP World                   


UBoot V200R002 version-042 (Jun 21 2013 - 06:03:00)

DRAM:  128 MB
Press c or C to Begin DDR Bus Test in 1 Seconds:  0 
Flash: 32 MB
PCIE:  PCIe Clock 40MHz
*** Warning *** : PCIe WLAN Module not found !!!
Board Type:      1
PHY Address:     4
Ethernet Mac: 20-0B-C7-24-55-00

Image: Current Bootup is B 
Image: Current Bootup is B 
Current master bootup parameter area is B
Boot Kernel A Address: 0x9e905000
Boot Kernel B Address: 0x9f8c5000
Press j or J to stop Bus-Test in 1 seconds:   0
Bus test starting...

Board Type Mismatch, No PCIE Device!
Local bus  test OK.
DDR   bus  test OK.
RGMII bus  test OK.
Bus test ending...

Save Bus Test Result Successful

Press f or F  to stop Auto-Boot in 2 seconds:  0 
Bad Magic Number
Password for uboot cmd line :

I think that I must hack uboot (update_bootB), but I'm not sure. Any suggestions?
This is some pics of board:
http://s2.postimg.org/s5nyi7sud/2014_10_24_07_53_54.jpg
http://s2.postimg.org/4fyitiuh1/2014_10_24_07_54_51.jpg
http://s2.postimg.org/tn9etrxl1/2014_10_24_07_55_53.jpg

Best regards, Mario.