This translation is older than the original page and might be outdated. See what has changed.

TP-Link TL-WR740N

TP-Link WR740N jest praktycznie identyczny jak TP-Link WR741ND, jedyna różnica polega na tym iż ten WR741ND posiada odkręcaną antenę. Ponieważ hardware WR740N odpowiada WR741N, większość opisu TP-Link WR741ND pokrywa się z WR740N.

Model wersja Obsługiwana wersja OpenWrt Model Specific Notes
v1 (Chiny)  Nie obsługiwane bez modyfikacji hardware Nie obsługiwane BCM5356 SOC 2MB Flash/8MB RAM
v2 (Chiny)  Nie obsługiwane bez modyfikacji hardwareNie obsługiwane BCM5356 SOC 2MB Flash/8MB RAM
v1.1 Ostrzeżenie o stabilności 10.3.1RC6(r27841) trunk (r24811) 8455 Gargoyle 1.5.1
v2 Ostrzeżenie o stabilności WiP Rounded chassis
v2.4 Ostrzeżenie o stabilności trunk (r28314) Rounded chassis, 350mhz cpu
v3 Attitude Adjustment 12.09 (see notes below) Rounded chassis
v4  Ostrzeżenie o stabilności trunk (r29631), see this ticket AR9330 400Mhz CPU 4 or 2MB Flash/32MB RAM
v4.20 Attitude Adjustment 12.09-beta (trunk r33312), Barrier Breaker (trunk r40572), Chaos Calmer (15.05) SoC: Atheros AR9331 , 400Mhz CPU, 4MB Flash/32MB RAM
v4.21 Attitude Adjustment 12.09-beta (trunk r33312), Barrier Breaker (trunk r40572) SoC: Atheros AR9331 , 400Mhz CPU, 4MB Flash/32MB RAM (esmt m13s2561616a)
v4.22 Attitude Adjustment 12.09-beta (trunk r33312) SoC: Atheros AR9331 , 400Mhz CPU, 4MB Flash/32MB RAM (zentel a3s56d40ftp)
v4.23 Attitude Adjustment 12.09-beta (trunk r33312) SoC: Atheros AR9330 rev 1, 400Mhz CPU, 4MB Flash/32MB RAM
v4.24 Attitude Adjustment 12.09 SoC: Atheros AR9330 rev 1, 400Mhz CPU, 4MB Flash/32MB RAM
v4.25 Barrier Breaker 14.07 SoC: Atheros AR9331-AL3A, RAM: ESMT M13S2561616A
v4.26 pre? Attitude Adjustment 12.09
Barrier Breaker działa poprawnie
SoC: Atheros AR9331 , 400Mhz CPU, 4MB Flash/32MB RAM
v4.27 BARRIER BREAKER (Bleeding Edge, r39860) AR9331-AL3A (400Mhz CPU ), ESMT M13S2561616A(RAM), Spansion FL032PIF 32Mbit (4Mb) Flash
v4.28 BARRIER BREAKER rc3 prawdopodobnie podobnie jak 4.27... dmesg pokazuje że posiada GIGABITowy switch (eth0)
v5.0 (EU) Chaos Calmer 15.05.1 wersja europejska ma 4 MB flash i 32 MB ram - potwierdzone przez support tp-link'a (RO)
v5 (Chiny)  Nie obsługiwane likely unsupportable. WiP AR9331 SOC 2MB Flash/16MB RAM
v5.1 (UA) ? ?

Notes:

  • Tested v3 with Attitude Adjustment 12.09, works without apparent problems. My router didn't accepted the .bin file (Error code: 18005), used this method for modifying the bin header and it worked. Download tool.
  • Tested v3 with Altitude Adjustment and it works flawlessly once the error mentioned in the above post (Error code: 18005) is bypassed. Alternative method for working around the problem is to use a stock image from another distribution and flash Altitude Adjustment form telnet or ssh. Example can be found here bottom of page. Brifly once you login download the Attitude Adjustment image to /tmp with wget, use “mtd -r write imagefile linux” to write the image and reboot to OpenWrt fisrt login.
  • Sometime around August 2011 (v4), TP-Link began to use 16MB RAM / 2MB flash for the Chinese versions of many of their devices. International versions retain the 32MB RAM / 4MB flash.
  • International versions v4.2 and v4.3 work without apparent problems from trunk r29631 onward.
  • Russian version v4.21 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
  • German version v4.21 successfully running with Barrier Breaker (trunk r40572) in Dumb AP / Access Point Only mode (Barrier Breaker latest trunk)
  • Russian version v4.22 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
  • Brazilian version v4.23 works like a charm with Chaos Calmer. In order to avoid problems with old TP-Link firmware, it is advisable to rename firmware to a short filename like “openwrt.bin” prior to upload.
  • International version v4.23 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
  • International version v4.24 works without apparent problems with Attitude Adjustment 12.09.
  • International version v4.24 works without apparent problems with Barrier Breaker Snapshot.
  • Brazilian version v4.25 works without apparent problems with Barrier Breaker.
  • International version v4.26 works without apparent problems with Barrier Breaker.

Your model version can be identified from the label: see this page for details.

CPU Ram Flash Sieć USB Port szeregowy JTag
Broadcom BCM5356@333MHz 8MiB 2MiB 4 x 1 ? Mod ?
Atheros AR7240@400MHz 32MiB 4MiB 4 x 1 mod Tak Nie
Atheros AR9330 rev 1@400MHz 32MiB 4MiB 4 x 1 mod Tak ?
Atheros AR9331 rev 1@400MHz 32MiB 4MiB 4 x 1 no Tak ?

General installation instructions can be found here:

v5 EU
- 15.05 built by risk Factory Sysupgrade
- support at #openwrt
- Cherry-picked the images makefile patch from trunk on top of 15.05 tag tree, using 15.05 config.diff from the downloads server.
- opkg needs release keys:

  wget -qO- http://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/packages/base/base-files_157-r46767_ar71xx.ipk | tar -xzO  ./data.tar.gz | tar -C / -xz ./etc/opkg/keys/

Note: Please reset your router to factory defaults if it has been previously configured/used.

  • Power up your router device.
  • Connect the local PC to anyof the LAN ports of the Router.
  • Browse to http://192.168.0.1 (alternatively you may use the URL - http://tplinklogin.net).
  • Choose the menu “System Tools → Firmware Upgrade”.
  • Upload the openwrt-ar71xx-generic-tl-wr740n-vXXX-squashfs-factory.bin file to router. vXXX is the version that is known to work with your router (like for HW rev4.23 vXXX is actually v4). Be sure to chose a .......-squashfs-factory.bin file!
  • Wait for the router to reboot.
  • Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

Flashing using TFTP works with the steps descibed in TP-Link WR741ND TFTP Installation (it needs a working serial console!).

Note that ongoing experiments suggest that TFTP flashing is possible even without soldering a serial port. For more information, see: http://bkil.blogspot.com/2014/12/tftp-secret-of-tl-wr740n-uncovered.html

Please check out the article Flash Layout for explanations.

Note: Below is the kernel log from the unmodified Attitude Adjustment (12.09-beta) generic WR740N v4 image firmware, showing the Flash Layout of the WR740N v4.23

[    0.660000] 5 tp-link partitions found on MTD device spi0.0
[    0.660000] Creating 5 MTD partitions on "spi0.0":
[    0.670000] 0x000000000000-0x000000020000 : "u-boot"
[    0.680000] 0x000000020000-0x000000108468 : "kernel"
[    0.690000] 0x000000108468-0x0000003f0000 : "rootfs"
[    0.720000] mtd: partition "rootfs_data" created automatically, ofs=2D0000, len=120000 
[    0.720000] 0x0000002d0000-0x0000003f0000 : "rootfs_data"
[    0.730000] 0x0000003f0000-0x000000400000 : "art"
[    0.740000] 0x000000020000-0x0000003f0000 : "firmware"

Images from trunk

  • The trunk WR740n hardware v1 image works unmodified and it can be flashed through the stock TP-Link web interface (another file exists for version 3). The v1 file was also successfully tested on hardware version 2.5.

Customized OpenWRT firmware for WR740N

Hardware versions v2.4 and v3 ONLY

Managed to squeeze IPv6 packages (radvd, dhcp6 server and client) along with Luci web interface with english and romanian support into the 4 MB firmware ONLY for TP-LINK WR740N version 2.4 and 3. Along with the above packages config files also the kernel was stripped down for the exact WR740N hardware via buildroot “make kernel_menuconfig”. Tested on romanian biggest ISP provider (RCS-RDS) for the IPv6 fiberlink services. http://www.ip6.ro/firmware (page is in romanian only so far..)

Hardware version v4.23 and v4.24 ONLY

These were prepared using Attitude Adjustment 12.09-beta ImageBuilder (r33312). Since HW version v4.23 or v4.24 doesn't have any stock USB, any USB stuff was removed from the firmware. Added functionalities include:

  • QOS (incl. LuCI support)
  • OpenVPN (incl. LuCI support)
  • Tinyproxy (incl. LuCI support)
  • UPNP (incl. LuCI support)

The command line used for the preparation was (all are the default packages, only these are changed: -kmod-ledtrig-usbdev -kmod-usb-core -kmod-usb-ohci -kmod-usb2 luci-app-qos luci-app-openvpn luci-app-tinyproxy luci-app-upnp):

make image PROFILE=TLWR740 PACKAGES="base-files busybox dnsmasq dropbear firewall hotplug2 iptables iw jshn kernel kmod-ath kmod-ath9k kmod-ath9k-common kmod-cfg80211 kmod-crypto-aes kmod-crypto-arc4 kmod-crypto-core kmod-gpio-button-hotplug kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-ipt-nathelper kmod-leds-gpio kmod-ledtrig-default-on kmod-ledtrig-netdev kmod-ledtrig-timer -kmod-ledtrig-usbdev kmod-lib-crc-ccitt kmod-mac80211 kmod-nls-base kmod-ppp kmod-pppoe kmod-pppox -kmod-usb-core -kmod-usb-ohci -kmod-usb2 kmod-wdt-ath79 libblobmsg-json libc libgcc libip4tc libiwinfo libiwinfo-lua libjson liblua libnl-tiny libubox libubus libubus-lua libuci libuci-lua libxtables lua luci luci-app-firewall luci-i18n-english luci-lib-core luci-lib-ipkg luci-lib-lmo luci-lib-nixio luci-lib-sys luci-lib-web luci-mod-admin-core luci-mod-admin-full luci-proto-core luci-proto-ppp luci-sgi-cgi luci-theme-base luci-theme-openwrt mtd netifd opkg ppp ppp-mod-pppoe swconfig uboot-envtools ubus ubusd uci uhttpd wireless-tools wpad-mini luci-app-qos luci-app-openvpn luci-app-tinyproxy luci-app-upnp"

Notes:

  • The proposed altered openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin firmware have not been tested, so you'd better first use the default Attitude Adjustment (12.09-beta) generic WR740N v4 image (r33312) to flash your brand new router and then use the proposed altered openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-sysupgrade.bin that has been tested and working on my two WR740N v4.23 routers.
  • The proposed altered openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-sysupgrade.bin that has been tested and working with no problems on my two WR740N v4.23 routers.
  • The space used by the modified firmware is as follows:
root@OpenWrt:~# df
Filesystem           1K-blocks      Used Available Use% Mounted on
rootfs                     320       240        80  75% /
/dev/root                 2816      2816         0 100% /rom
tmpfs                    14672        80     14592   1% /tmp
tmpfs                      512         0       512   0% /dev
/dev/mtdblock3             320       240        80  75% /overlay
overlayfs:/overlay         320       240        80  75% /

You can download the proposed 12.09-beta firmware from here.

You can download the proposed 12.09 Final firmware from here. Since the luci-app-openvpn package is broken in 12.09 Final + wireless-tools is not used anymore this is the command line used for the preparation of the altered 12.09 Final firmware image:

make image PROFILE=TLWR740 PACKAGES="base-files busybox dnsmasq dropbear firewall hotplug2 iptables iw jshn kernel kmod-ath kmod-ath9k kmod-ath9k-common kmod-cfg80211 kmod-crypto-aes kmod-crypto-arc4 kmod-crypto-core kmod-gpio-button-hotplug kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-ipt-nathelper kmod-leds-gpio kmod-ledtrig-default-on kmod-ledtrig-netdev kmod-ledtrig-timer -kmod-ledtrig-usbdev kmod-lib-crc-ccitt kmod-mac80211 kmod-nls-base kmod-ppp kmod-pppoe kmod-pppox -kmod-usb-core -kmod-usb-ohci -kmod-usb2 kmod-wdt-ath79 libblobmsg-json libc libgcc libip4tc libiwinfo libiwinfo-lua libjson liblua libnl-tiny libubox libubus libubus-lua libuci libuci-lua libxtables lua luci luci-app-firewall luci-i18n-english luci-lib-core luci-lib-ipkg luci-lib-nixio luci-lib-sys luci-lib-web luci-mod-admin-core luci-mod-admin-full luci-proto-core luci-proto-ppp luci-sgi-cgi luci-theme-base luci-theme-openwrt mtd netifd opkg ppp ppp-mod-pppoe swconfig uboot-envtools ubus ubusd uci uhttpd wpad-mini luci-app-qos luci-app-tinyproxy luci-app-upnp openvpn"
  • Everything said for v4.23 is applicable for v4.24 too (tested by user christoforos, did not cracked open the case though).

This information is obtained from the serial interface:

U-Boot 1.1.4 (Mar 8 2010 - 10:29:42) AP91 (ar7240) U-boot DRAM: sri #### TAP VALUE 1 = 9, 2 = a 32 MB id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address : cfg1 0xf cfg2 0x7014 eth0: 00:03:7f:09:0b:ad eth0 up No valid address in Flash. Using fixed address : cfg1 0xf cfg2 0x7214 eth1: 00:03:7f:09:0b:ad ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ...


Type tpl in order to get into boot shell. This are the env parameters:

ar7240> printenv bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART) bootcmd=bootm 0x9f020000 bootdelay=1 baudrate=115200 ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee ipaddr=192.168.1.123 serverip=192.168.1.100 stdin=serial stdout=serial stderr=serial ethact=eth0 Environment size: 359/65532 bytes


[ 0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Sep 3 17:51:18 UTC 2012 [ 0.000000] MyLoader: sysp=4cc15e57, boardp=635a7dca, parts=0c7b9213 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00019374 (MIPS 24Kc) [ 0.000000] SoC: Atheros AR9330 rev 1 [ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00002000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00002000 [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 802ec430, node_mem_map 81000000 [ 0.000000] Normal zone: 64 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8128 pages, LIFO batch:0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: board=TL-WR741ND-v4 console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 29136k/32768k available (2198k kernel code, 3632k reserved, 412k data, 208k init, 0k highmem) [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:51 [ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104) [ 0.080000] pid_max: default: 32768 minimum: 301 [ 0.080000] Mount-cache hash table entries: 512 [ 0.090000] NET: Registered protocol family 16 [ 0.090000] gpiochip_add: registered GPIOs 0 to 29 on device: ath79 [ 0.100000] MIPS: machine is TP-LINK TL-WR741ND v4 [ 0.510000] bio: create slab <bio-0> at 0 [ 0.520000] Switching to clocksource MIPS [ 0.520000] NET: Registered protocol family 2 [ 0.530000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.530000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 0.530000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.540000] TCP: Hash tables configured (established 1024 bind 1024) [ 0.550000] TCP reno registered [ 0.550000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.560000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.560000] NET: Registered protocol family 1 [ 0.570000] PCI: CLS 0 bytes, default 32 [ 0.590000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.590000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.600000] msgmni has been set to 56 [ 0.600000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) [ 0.610000] io scheduler noop registered [ 0.610000] io scheduler deadline registered (default) [ 0.620000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.630000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART [ 0.640000] console [ttyATH0] enabled, bootconsole disabled [ 0.650000] m25p80 spi0.0: found en25q32b, expected m25p80 [ 0.650000] m25p80 spi0.0: en25q32b (4096 Kbytes) [ 0.660000] 5 tp-link partitions found on MTD device spi0.0 [ 0.660000] Creating 5 MTD partitions on "spi0.0": [ 0.670000] 0x000000000000-0x000000020000 : "u-boot" [ 0.680000] 0x000000020000-0x000000108468 : "kernel" [ 0.680000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.690000] 0x000000108468-0x0000003f0000 : "rootfs" [ 0.700000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.710000] mtd: partition "rootfs" set to be root filesystem [ 0.720000] mtd: partition "rootfs_data" created automatically, ofs=3A0000, len=50000 [ 0.720000] 0x0000003a0000-0x0000003f0000 : "rootfs_data" [ 0.730000] 0x0000003f0000-0x000000400000 : "art" [ 0.740000] 0x000000020000-0x0000003f0000 : "firmware" [ 0.760000] ag71xx_mdio: probed [ 0.770000] eth0: Atheros AG71xx at 0xba000000, irq 5 [ 1.320000] eth0: Found an AR7240/AR9330 built-in switch [ 2.350000] eth1: Atheros AG71xx at 0xb9000000, irq 4 [ 2.900000] ag71xx ag71xx.0: eth1: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY] [ 2.910000] TCP cubic registered [ 2.910000] NET: Registered protocol family 17 [ 2.920000] 8021q: 802.1Q VLAN Support v1.8 [ 2.930000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 2.930000] Freeing unused kernel memory: 208k freed [ 6.160000] Registered led device: tp-link:green:lan1 [ 6.160000] Registered led device: tp-link:green:lan2 [ 6.160000] Registered led device: tp-link:green:lan3 [ 6.160000] Registered led device: tp-link:green:lan4 [ 6.160000] Registered led device: tp-link:green:qss [ 6.160000] Registered led device: tp-link:green:system [ 6.160000] Registered led device: tp-link:green:wan [ 6.160000] Registered led device: tp-link:green:wlan [ 7.230000] eth0: link up (1000Mbps/Full duplex) [ 9.470000] JFFS2 notice: (445) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 32 of xref (0 dead, 23 orphan) found. [ 9.580000] eth0: link down [ 11.570000] Compat-wireless backport release: compat-wireless-2012-07-13 [ 11.580000] Backport based on wireless-testing.git master-2012-07-16 [ 11.590000] compat.git: wireless-testing.git [ 11.620000] cfg80211: Calling CRDA to update world regulatory domain [ 11.620000] cfg80211: World regulatory domain updated: [ 11.630000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 11.640000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 11.650000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 11.650000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 11.660000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 11.670000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 12.600000] ath: EEPROM regdomain: 0x0 [ 12.600000] ath: EEPROM indicates default country code should be used [ 12.600000] ath: doing EEPROM country->regdmn map search [ 12.600000] ath: country maps to regdmn code: 0x3a [ 12.600000] ath: Country alpha2 being used: US [ 12.600000] ath: Regpair used: 0x3a [ 12.600000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 12.600000] Registered led device: ath9k-phy0 [ 12.600000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2 [ 12.610000] cfg80211: Calling CRDA for country: US [ 12.610000] cfg80211: Regulatory domain changed to country: US [ 12.620000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 12.630000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm) [ 12.630000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm) [ 12.640000] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 12.650000] cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 12.660000] cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 12.660000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm) [ 12.910000] PPP generic driver version 2.4.2 [ 12.940000] tun: Universal TUN/TAP device driver, 1.6 [ 12.950000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 13.010000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 13.150000] NET: Registered protocol family 24 [ 13.170000] nf_conntrack version 0.5.0 (458 buckets, 1832 max) [ 13.510000] xt_time: kernel timezone is -0000 [ 18.040000] device eth0 entered promiscuous mode [ 18.700000] eth0: link up (1000Mbps/Full duplex) [ 18.700000] br-lan: port 1(eth0) entered forwarding state [ 22.410000] device wlan0 entered promiscuous mode [ 22.780000] br-lan: port 2(wlan0) entered forwarding state


WR740N v2.4

Case Back:
TL-WR740N v2.4 case back

WR740N v4.23

Case Front:
TL-WR740N v4.23 case front view. v4.24 is identical

Case Back:
TL-WR740N v4.23 case back view when opening TL-WR740N v4.23 case back view v4.24 is identical

Board Front:
TL-WR740N v4.23 board front view

Board Back:
TL-WR740N v4.23 board back view

The general information and steps of using serial port, serial port cable, serial console etc, can be found at Serial Console.

Below is the specific information about the different hardware versions of TL-WR740N.

UART on v1.10

The serial headers are not completely connected (a voltage divider and capacitor are left out, so the headers are dead), but a serial connection can still be established by soldering directly to two of the empty pads. The result is a bit unstable (router output is often partially lost) and can probably be improved electrically.

TL-WR740N pins layout TL-WR740N pins layout and cable

UART on v3.0

Baudrate: 115200n8

Type “tpl” in U-Boot to get a shell!

TL-WR740N v3.0 pins layout

UART on v4.23

The v4.23 uses the standard TP-Link pinout, however the TX pin is not connected to the CPU. In order to make the TX line working, the two points on the bottom side of the PCB must be connected with a small wire. The pin at the SOC is labeled TP18, the one at the serial connector is labeled TP28. The RX line is 5V intolerant! So the connection needs a 3.3V RS232 level shifter. Pins on the connector on the photo are TX-RX-GND-3V3(VCC) (from left to right).

  1. Hook your routers WAN ethernet port up to your network
  2. Hook up the serial console as explained in the section “serial console” and do the “tpl” trick to get console access
  3. Now we need to set router and server IP addresses (here named ROUTERIP and SERVERIP, substitute these with the real IP addresses). Type in the console:
     setenv ipaddr ROUTERIP
     setenv serverip SERVERIP
     printenv
  4. Double check that the output of printenv lists the IP addresses you just set. Now we can load the firmware over TFTP with “tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin”:
    tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin
    erase 0x9f020000 +0x3c0000
    cp.b 0x81000000 0x9f020000 0x3c0000
    bootm 9f020000

TL-WR740N v4.23 pins layout TL-WR740N v4.23 serial cable soldered TL-WR740N v4.23 serial cable

Working chips:

  • Hynix HY5DU121622DTP-D43 (From Mustang DDR SO-DIMM 512 MB)
  • Hynix HY5DU121622CTP-D43 (From Hynix DDR SO-DIMM PC2700S-25330 512MB DDR 333MHz CL 2.5
  • Hynix HY5DU121622AT-J (From DDR 256MB PC400 (BUD968RA))
  • Infineon HYB25D512160BE (From Infineon DDR SO-DIMM 512 MB)
  • Elpida EDD5116ADTA-6B-E (From Elpida DDR SO-DIMM 512 MB)
  • Elpida EDD5116AFTA-5B-E (From Elpida DDR SO-DIMM 512 MB)

follow pictures soon...

General debricking advices are described here.

At the original time of writing, no method was known to recover most models from a bad firmware without soldering the serial cable. However, ongoing experiments suggest that TFTP flashing is possible even without soldering a serial port. The list of models and versions which have a factory U-Boot compiled with tftp enabled is to be determined. It's best to try it yourself because there's nothing to lose, but please do share your results at the respective wiki page. For more information, see: http://bkil.blogspot.com/2014/12/tftp-secret-of-tl-wr740n-uncovered.html

For debricking with a working serial cable using TFTP follow the steps descibed in TP-Link WR741ND TFTP Installation.

For the (box branded) WR740N v2.4 and v4.23 the below works for recovery from nasty stuff like dropbear lockout, mtd overlay size problems or other software misuses :

  • Unplug the router's power cord.
  • Connect any router LAN port directly to your PC.
  • Configure your PC with a static IP address: 192.168.1.2
  • Plug the power on to the router.
  • Wait until the “SYS” LED starts flashing repeatedly.
  • Press the “QSS” button (on the front/back of the router) → the “SYS” LED will now start flashing at a faster rate.
  • Login to the router by using telnet to connect to the IP address 192.168.1.1 → there will be an immediate unauthenticated login to a root shell.
  • mount_root - will mount the normal root filesystem.
  • firstboot - all settings will be reset.
  • /rom/sbin/reboot - will reboot even without a mounted filesystem.

Read about bootloader in general and about Das U-Boot in particular.

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

LUCI Web Interface has bug with port ID in switch section (Checked on v4.20), LAN Port number on router=Port number in LUCI switch 1=2, 2=1, 3=2, 4=1

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2018/03/31 23:23
  • by bobafetthotmail