The TP-Link WR740N is an even lower-cost (around 20€/$20 retail in 10/2012) variant of the TP-Link WR741ND differing only in the non-removable antenna.
Since the hardware in WR740N is similar to WR741N, most of the contents in TP-Link WR741ND applies to this router too.
This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram. DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version (18.06 or later) onto it! See 4/32 warning for details.
1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.
2) OpenWrt support for this device will end after 2019.
19.07 will be the last official build for 4/32 devices. After 19.07, no further OpenWrt images will be built for 4/32 devices. See OpenWrt on 4/32 devices what you can do now.
Latest openwrt release works fine. / it is similar to model 841N V10 but with only 1 antenna = max speed 150Mbits /. Openwrt default firmware comes with txpower up to 18dbm, compared to stock firmware which comes with 15dbm = 3dbm txpower increase in favor to openwrt.
Tested v3 with Attitude Adjustment and it works flawlessly once the error mentioned in the above post (Error code: 18005) is bypassed. Alternative method for working around the problem is to use a stock image from another distribution and flash Altitude Adjustment form telnet or ssh. Example can be found here bottom of page. Briefly once you login download the Attitude Adjustment image to /tmp with wget, use “mtd -r write imagefile linux” to write the image and reboot to OpenWrt first login.
On some v3 Error code 18005 can be bypassed by push of Poland version of Gargoyle firmware first (I tested on this ). It's based on Attitude Adjustment 12.09, and can be upgraded then to any other.
Sometime around August 2011 (v4), TP-Link began to use 16MB RAM / 2MB flash for the Chinese versions of many of their devices. International versions retain the 32MB RAM / 4MB flash.
International versions v4.2 and v4.3 work without apparent problems from trunk r29631 onward.
Brazilian version v4.23 works like a charm with Chaos Calmer. In order to avoid problems with old TP-Link firmware, it is advisable to rename firmware to a short filename like “openwrt.bin” prior to upload.
Note: Recent versions of the original firmware check against wrong files before flashing and might tell you “Error Code: 18005 Upgrade unsuccessfully because the version of the upgraded file was incorrect. Please check file name.”. Fortunately you can easily trickt it - it seems to check only the file name of the uploaded new image. Simply rename the OpenWrt image file to the names of one of the files provided by TP-Link, e.g. wr740nv1_en_3_12_4_up(100910).bin.
Installation - using OEM updater
Note: Please reset your router to factory defaults if it has been previously configured/used.
Power up your router device.
Connect the local PC to anyof the LAN ports of the Router.
Browse to http://192.168.0.1 (alternatively you may use the URL - http://tplinklogin.net).
Choose the menu “System Tools → Firmware Upgrade”.
Upload the openwrt-ar71xx-generic-tl-wr740n-vXXX-squashfs-factory.bin file to router. vXXX is the version that is known to work with your router (like for HW rev4.23 vXXX is actually v4). Be sure to chose a …….-squashfs-factory.bin file!
Wait for the router to reboot.
Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.
Installation - using the TFTP method (always working)
[ 0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Sep 3 17:51:18 UTC 2012
[ 0.000000] MyLoader: sysp=4cc15e57, boardp=635a7dca, parts=0c7b9213
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Atheros AR9330 rev 1
[ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00002000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] Early memory PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00002000
[ 0.000000] On node 0 totalpages: 8192
[ 0.000000] free_area_init_node: node 0, pgdat 802ec430, node_mem_map 81000000
[ 0.000000] Normal zone: 64 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 8128 pages, LIFO batch:0
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc:  0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=TL-WR741ND-v4 console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 29136k/32768k available (2198k kernel code, 3632k reserved, 412k data, 208k init, 0k highmem)
[ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 512
[ 0.090000] NET: Registered protocol family 16
[ 0.090000] gpiochip_add: registered GPIOs 0 to 29 on device: ath79
[ 0.100000] MIPS: machine is TP-LINK TL-WR741ND v4
[ 0.510000] bio: create slab <bio-0> at 0
[ 0.520000] Switching to clocksource MIPS
[ 0.520000] NET: Registered protocol family 2
[ 0.530000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.530000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.530000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.540000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.550000] TCP reno registered
[ 0.550000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.560000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.560000] NET: Registered protocol family 1
[ 0.570000] PCI: CLS 0 bytes, default 32
[ 0.590000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.590000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.600000] msgmni has been set to 56
[ 0.600000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[ 0.610000] io scheduler noop registered
[ 0.610000] io scheduler deadline registered (default)
[ 0.620000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.630000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
[ 0.640000] console [ttyATH0] enabled, bootconsole disabled
[ 0.650000] m25p80 spi0.0: found en25q32b, expected m25p80
[ 0.650000] m25p80 spi0.0: en25q32b (4096 Kbytes)
[ 0.660000] 5 tp-link partitions found on MTD device spi0.0
[ 0.660000] Creating 5 MTD partitions on "spi0.0":
[ 0.670000] 0x000000000000-0x000000020000 : "u-boot"
[ 0.680000] 0x000000020000-0x000000108468 : "kernel"
[ 0.680000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.690000] 0x000000108468-0x0000003f0000 : "rootfs"
[ 0.700000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.710000] mtd: partition "rootfs" set to be root filesystem
[ 0.720000] mtd: partition "rootfs_data" created automatically, ofs=3A0000, len=50000
[ 0.720000] 0x0000003a0000-0x0000003f0000 : "rootfs_data"
[ 0.730000] 0x0000003f0000-0x000000400000 : "art"
[ 0.740000] 0x000000020000-0x0000003f0000 : "firmware"
[ 0.760000] ag71xx_mdio: probed
[ 0.770000] eth0: Atheros AG71xx at 0xba000000, irq 5
[ 1.320000] eth0: Found an AR7240/AR9330 built-in switch
[ 2.350000] eth1: Atheros AG71xx at 0xb9000000, irq 4
[ 2.900000] ag71xx ag71xx.0: eth1: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[ 2.910000] TCP cubic registered
[ 2.910000] NET: Registered protocol family 17
[ 2.920000] 8021q: 802.1Q VLAN Support v1.8
[ 2.930000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 2.930000] Freeing unused kernel memory: 208k freed
[ 6.160000] Registered led device: tp-link:green:lan1
[ 6.160000] Registered led device: tp-link:green:lan2
[ 6.160000] Registered led device: tp-link:green:lan3
[ 6.160000] Registered led device: tp-link:green:lan4
[ 6.160000] Registered led device: tp-link:green:qss
[ 6.160000] Registered led device: tp-link:green:system
[ 6.160000] Registered led device: tp-link:green:wan
[ 6.160000] Registered led device: tp-link:green:wlan
[ 7.230000] eth0: link up (1000Mbps/Full duplex)
[ 9.470000] JFFS2 notice: (445) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 32 of xref (0 dead, 23 orphan) found.
[ 9.580000] eth0: link down
[ 11.570000] Compat-wireless backport release: compat-wireless-2012-07-13
[ 11.580000] Backport based on wireless-testing.git master-2012-07-16
[ 11.590000] compat.git: wireless-testing.git
[ 11.620000] cfg80211: Calling CRDA to update world regulatory domain
[ 11.620000] cfg80211: World regulatory domain updated:
[ 11.630000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 11.640000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 11.650000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 11.650000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 11.660000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 11.670000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.600000] ath: EEPROM regdomain: 0x0
[ 12.600000] ath: EEPROM indicates default country code should be used
[ 12.600000] ath: doing EEPROM country->regdmn map search
[ 12.600000] ath: country maps to regdmn code: 0x3a
[ 12.600000] ath: Country alpha2 being used: US
[ 12.600000] ath: Regpair used: 0x3a
[ 12.600000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[ 12.600000] Registered led device: ath9k-phy0
[ 12.600000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
[ 12.610000] cfg80211: Calling CRDA for country: US
[ 12.610000] cfg80211: Regulatory domain changed to country: US
[ 12.620000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 12.630000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[ 12.630000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
[ 12.640000] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.650000] cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.660000] cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.660000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
[ 12.910000] PPP generic driver version 2.4.2
[ 12.940000] tun: Universal TUN/TAP device driver, 1.6
[ 12.950000] tun: (C) 1999-2004 Max Krasnyansky <firstname.lastname@example.org>
[ 13.010000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 13.150000] NET: Registered protocol family 24
[ 13.170000] nf_conntrack version 0.5.0 (458 buckets, 1832 max)
[ 13.510000] xt_time: kernel timezone is -0000
[ 18.040000] device eth0 entered promiscuous mode
[ 18.700000] eth0: link up (1000Mbps/Full duplex)
[ 18.700000] br-lan: port 1(eth0) entered forwarding state
[ 22.410000] device wlan0 entered promiscuous mode
[ 22.780000] br-lan: port 2(wlan0) entered forwarding state
The general information and steps of using serial port, serial port cable, serial console etc, can be found at Serial Console.
Below is the specific information about the different hardware versions of TL-WR740N.
UART on v1.10
The serial headers are not completely connected (a voltage divider and capacitor are left out, so the headers are dead), but a serial connection can still be established by soldering directly to two of the empty pads. The result is a bit unstable (router output is often partially lost) and can probably be improved electrically.
UART on v3.0
Type “tpl” in U-Boot to get a shell!
UART on v4.23
The v4.23 uses the standard TP-Link pinout, however the TX pin is not connected to the CPU. In order to make the TX line working, the two points on the bottom side of the PCB must be connected with a small wire. The pin at the SOC is labeled TP18, the one at the serial connector is labeled TP28. The RX line is 5V intolerant! So the connection needs a 3.3V RS232 level shifter. Pins on the connector on the photo are TX-RX-GND-3V3(VCC) (from left to right).
Double check that the output of printenv lists the IP addresses you just set. Now we can load the firmware over TFTP with “tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin”:
At the original time of writing, no method was known to recover most models from a bad firmware without soldering the serial cable. However, ongoing experiments suggest that TFTP flashing is possible even without soldering a serial port. The list of models and versions which have a factory U-Boot compiled with tftp enabled is to be determined. It's best to try it yourself because there's nothing to lose, but please do share your results at the respective wiki page. For more information, see: http://bkil.blogspot.com/2014/12/tftp-secret-of-tl-wr740n-uncovered.html
Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.
This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).
toh/tp-link/tl-wr740n.txt · Last modified: 2019/04/07 18:17 by tmomas