TP-LINK TL-WR740N v4

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2, 3 ... 50, 51, 52  Next
Author Message
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Sun Dec 11, 2011 17:16    Post subject: TP-LINK TL-WR740N v4 Reply with quote
Last week I have a newly arrived in store TL-WR740Nv4. I cracked one to see what's inside. Quite a different hardware than v1/2/3 I must say.

One who want to buy this might keep in mind that
* serial console is available but yet hard to solder anything. One may think about J1 connecting serial stuff but it is not connected anywhere physically, they made it only for a joke or I don't know why.
* there is no factory firmware on website, if you succeed flashing *WRT on that you have no option to go back (yet)

Tomorrow will ensure some serial log and will paste here.
AR9331-AL1A
Sponsor
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17619
Location: Hesse/Germany

PostPosted: Sun Dec 11, 2011 17:22    Post subject: Reply with quote
also flash and ram chip is id is needed
_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Sun Dec 11, 2011 18:57    Post subject: Reply with quote
Sash wrote:
also flash and ram chip is id is needed


Sure, I am sorry for having forgotten
One is W9425G6JH-5 Winbond
The other is 25Q32BVSIG Winbond

I also forgot to tell you that I tried the v3 firmware 17990 by signing it with v4 header but it resulted in a u-boot loop. Sorry I can't get to serial console this night to check what is the exact output of this.

I am ready for volunteer testing if you can compile something.
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17619
Location: Hesse/Germany

PostPosted: Sun Dec 11, 2011 22:13    Post subject: Reply with quote
u will have to populate the serial port get consóle access else u wont be able to debrick
_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 6:04    Post subject: Reply with quote
Sash wrote:
u will have to populate the serial port get consóle access else u wont be able to debrick


well, sorry, what exactly to do with the serial port? Smile I already connected to it although it is not that simple.

Later today will paste some dmesg log from loading native firmware if it might help.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Dec 12, 2011 6:06    Post subject: Reply with quote
If you already have connected the serial port then I suppose you have a boot log and that one is of interest for Brainslayer.
_________________
Kernel panic: Aiee, killing interrupt handler!
fyi2000
DD-WRT Guru


Joined: 04 Apr 2010
Posts: 642

PostPosted: Mon Dec 12, 2011 6:43    Post subject: Reply with quote
#10492 (Support for TL-WR740N/TL-WR740ND v4) – OpenWrt
_________________
DD-WRT Forum - Atheros Recommended Build
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Dec 12, 2011 7:47    Post subject: Reply with quote
fyi2000 wrote:
#10492 (Support for TL-WR740N/TL-WR740ND v4) – OpenWrt


The only thing missing in the OpenWRT from what I can see is the MAC address from the ART partition:

"wlan0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 -> Fake MAC"

_________________
Kernel panic: Aiee, killing interrupt handler!
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 9:33    Post subject: Reply with quote
Code:
U-Boot 1.1.4 (Aug 31 2011 - 16:47:32)

AP121-2MB (ar9330) U-boot

DRAM:  32 MB
led turning on for 1s...
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting AR9330(Hornet)...
Linux version 2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #130 Tue Aug 30 11:12:26 CST 2011
flash_size passed from bootloader = 4
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29864k/32768k available (1888k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0


Whoops! This kernel is for product wr741 v4.0!

bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
msgmni has been set to 58
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
cmdlinepart partition parsing not available
set partition boot
set partition kernel
set partition rootfs
set partition config
set partition art
set partition �
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7240-nor0
Creating 5 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000003e0000 : "rootfs"
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "art"
->Oops: flash id 0x10215 .
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 116k freed
init started:  BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (512 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory

Now flash open!
 (none) mips #130 Tue Aug 30 11:12:26 CST 2011 (none)
(none) login: Now flash open!
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: Mac address for unit 1:bf1f0006
ATHR_GMAC: 90:5e:e0:2f:7e:34
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   4D83
ATHR_GMAC: Mac address for unit 0:bf1f0000
ATHR_GMAC: 2b:24:90:41:9d:73
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   4403
athr_gmac_ring_alloc Allocated 640 at 0x81e75800
athr_gmac_ring_alloc Allocated 4032 at 0x81d63000
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...mac 0
athr_gmac_ring_alloc Allocated 640 at 0x81e75400
athr_gmac_ring_alloc Allocated 1536 at 0x81f1a000
athr_gmac_mii_setup: MDC check failed
Setting Drop CRC Errors, Pause Frames and Length Error frames
ATHRS26: resetting s26
ATHRS26: s26 reset done
Setting PHY...mac 1
device eth0 entered promiscuous mode
Now flash open!
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss)
Boostrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
 
 DES SSID SET=TP-LINK_414376
ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c09f78a0 arg=81f7eac0
wlan_vap_delete : enter. vaphandle=0x81fa0000
wlan_vap_delete : exit. vaphandle=0x81fa0000
wlan_vap_create : enter. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
 
 DES SSID SET=TP-LINK_414376
 ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
WARNING: Fragmentation with HT mode NOT ALLOWED!!
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
 ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1
br0: port 2(ath0) entering disabled state
 
 DES SSID SET=TP-LINK_414376
br0: port 2(ath0) entering forwarding state
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Dec 12, 2011 10:42    Post subject: Reply with quote
The addresses for the MAC's within the caldata (ART) partition are given in your log.
I still think Brainslayer will need to get a copy of that partition to see some other radio data.

_________________
Kernel panic: Aiee, killing interrupt handler!
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 10:49    Post subject: Reply with quote
sorry, no console access to factory firmware because of unknown factory credentials. I don't know how to dump this data by this moment.
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 11:13    Post subject: Reply with quote
OK so I logged thanks to the friend who recommended root/5up
Now I will cat the partition into .bin /it is 65535 byte binary file/

Is that you are looking for or I can also help otherwise ?
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Dec 12, 2011 11:37    Post subject: Reply with quote
checho wrote:
OK so I logged thanks to the friend who recommended root/5up
Now I will cat the partition into .bin /it is 65535 byte binary file/

Is that you are looking for or I can also help otherwise ?


see if you can copy it into the routers /www directory and then point your browser to it, ie 192.168.1.1/filename.bin
The http server in the tp-link firmware may not allow binary files in which case you can rename it to a .jpg file, they are usually allowed.
If Busybox has a tftp client then you can tftp transfer it over to a running tftp server on your computer.

Pls upload the file here so Brainslayer can get it and pls also take out mtd0 (U-boot) and pm it to me.
I collect boot loaders...

_________________
Kernel panic: Aiee, killing interrupt handler!
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 11:41    Post subject: Reply with quote
Here you are Smile
checho
DD-WRT Guru


Joined: 27 Feb 2007
Posts: 527
Location: Bulgaria

PostPosted: Mon Dec 12, 2011 11:44    Post subject: Reply with quote
Also kernel and rootfs partition images if someone wants them
Goto page 1, 2, 3 ... 50, 51, 52  Next Display posts from previous:    Page 1 of 52
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum