TP-Link TL-WR740N

The TP-Link WR740N is an even lower-cost (around 20€/$20 retail in 10/2012) variant of the TP-Link WR741ND differing only in the non-removable antenna.

Since the hardware in WR740N is similar to WR741N, most of the contents in TP-Link WR741ND applies to this router too.

Model Version	First OpenWrt Version Supported	Model Specific Notes
v1 (China)	unsupportable with only 2MB ROM modification possible	SoC: BCM5356, 2MB Flash/8MB RAM
v2 (China)	unsupportable with only 2MB ROM modification possible	SoC: BCM5356, 2MB Flash/8MB RAM
v1.1	Attitude Adjustment 12.09
v2	Attitude Adjustment 12.09	Rounded chassis
v2.1 (BR)	Attitude Adjustment 12.09	Rounded chassis, Soc: Atheros AR7240, 400MHz CPU, 4MB Flash/32MB RAM
v2.4	Attitude Adjustment 12.09	Rounded chassis, 350MHz CPU
v3	Attitude Adjustment 12.09 (see notes below)	Rounded chassis
v4	Attitude Adjustment 12.09	SoC: Atheros AR9330, 400MHz CPU, 4 or 2MB Flash/32MB RAM
v4.20	Attitude Adjustment 12.09	SoC: Atheros AR9331, 400MHz CPU, 4MB Flash/32MB RAM
v4.21	Attitude Adjustment 12.09	SoC: Atheros AR9331, 400MHz CPU, 4MB Flash/32MB RAM (esmt m13s2561616a)
v4.22	Attitude Adjustment 12.09	SoC: Atheros AR9331, 400MHz CPU, 4MB Flash/32MB RAM (zentel a3s56d40ftp)
v4.23	Attitude Adjustment 12.09	SoC: Atheros AR9330 rev 1, 400MHz CPU, 4MB Flash/32MB RAM
v4.24	Attitude Adjustment 12.09	SoC: Atheros AR9330 rev 1, 400MHz CPU, 4MB Flash/32MB RAM
v4.25	Barrier Breaker 14.07	SoC: Atheros AR9331-AL3A, RAM: ESMT M13S2561616A
v4.26	Barrier Breaker 14.07	SoC: Atheros AR9331, 400MHz CPU, 4MB Flash/32MB RAM
v4.27	Barrier Breaker 14.07	SoC: Atheros AR9331-AL3A, 400MHz CPU, ESMT M13S2561616A(RAM), Spansion FL032PIF 32Mbit (4Mb) Flash
v4.28	Barrier Breaker 14.07	SoC: Atheros AR9330 rev 1, 400 MHz CPU, 4MB Flash/32MB RAM
v5.0 (EU)	Chaos Calmer 15.05.1	SoC: Atheros AR9331; the european version has 4 MB flash and 32 MB ram - confirmed by local tp-link support (RO)
v5 (China)	unsupportable with only 2MB ROM modification possible	SoC: Atheros AR9331, 2MB Flash/16MB RAM
v5.1 (UA)	trunk snapshot	SoC: Atheros AR9331-AL3A, 400MHz, RAM: Zentel A3S56D40GTP-50L - 32MB
v6	Latest openwrt release works fine. / it is similar to model 841N V10 but with only 1 antenna = max speed 150Mbits /. Openwrt default firmware comes with txpower up to 18dbm, compared to stock firmware which comes with 15dbm = 3dbm txpower increase in favor to openwrt.	SoC: AR9533-BL3A, Flash - Winbond 25032FVSIG 4MB, RAM - Zentel A3S56D40GTP - 50L 32 MB

Notes:

• Brazilian version v2.1 works like a charm with Chaos Calmer 15.05.1.
• Tested v3 with Attitude Adjustment 12.09, works without apparent problems. My router didn't accepted the .bin file (Error code: 18005), used this method for modifying the bin header and it worked. Download tool.
• Tested v3 with Attitude Adjustment and it works flawlessly once the error mentioned in the above post (Error code: 18005) is bypassed. Alternative method for working around the problem is to use a stock image from another distribution and flash Altitude Adjustment form telnet or ssh. Example can be found here bottom of page. Briefly once you login download the Attitude Adjustment image to /tmp with wget, use “mtd -r write imagefile linux” to write the image and reboot to OpenWrt first login.
• On some v3 Error code 18005 can be bypassed by push of Poland version of Gargoyle firmware first (I tested on this ). It's based on Attitude Adjustment 12.09, and can be upgraded then to any other.
• Sometime around August 2011 (v4), TP-Link began to use 16MB RAM / 2MB flash for the Chinese versions of many of their devices. International versions retain the 32MB RAM / 4MB flash.
• International versions v4.2 and v4.3 work without apparent problems from trunk r29631 onward.
• Russian version v4.21 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
• German version v4.21 successfully running with Barrier Breaker (trunk r40572) in Dumb AP / Access Point Only mode (Barrier Breaker latest trunk)
• Russian version v4.22 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
• Brazilian version v4.23 works like a charm with Chaos Calmer. In order to avoid problems with old TP-Link firmware, it is advisable to rename firmware to a short filename like “openwrt.bin” prior to upload.
• International version v4.23 works without apparent problems from trunk r33312 (Attitude Adjustment 12.09-beta) onward.
• International version v4.24 works without apparent problems with Attitude Adjustment 12.09.
• International version v4.24 works without apparent problems with Barrier Breaker Snapshot.
• Brazilian version v4.25 works without apparent problems with Barrier Breaker.
• International version v4.26 works without apparent problems with Barrier Breaker.
• International version v4.28 works without apparent problems with Chaos Calmer 15.05.1 and Barrier Breaker.
• To enable channel 12 and 13, ensure wifi_countrycode is set correctly
• Internet may not work under DHCP mode. To get WAN DHCP to start working properly, the “-C” option must be erased from /lib/netifd/proto/dhcp.sh, see: https://dev.openwrt.org/ticket/13581 or https://dev.openwrt.org/attachment/ticket/13581/dhcp.sh.patch
• International version v4.28 works without apparent problems using v4 images 18.06.2 factory and 18.06.2 sysupgrade

Your model version can be identified from the label: see this page for details.

→ Install OpenWrt (generic explanation)

Please add the installation procedure here.

Note: Recent versions of the original firmware check against wrong files before flashing and might tell you “Error Code: 18005 Upgrade unsuccessfully because the version of the upgraded file was incorrect. Please check file name.”. Fortunately you can easily trickt it - it seems to check only the file name of the uploaded new image. Simply rename the OpenWrt image file to the names of one of the files provided by TP-Link, e.g. wr740nv1_en_3_12_4_up(100910).bin.

Note: Please reset your router to factory defaults if it has been previously configured/used.

• Power up your router device.
• Connect the local PC to anyof the LAN ports of the Router.
• Browse to http://192.168.0.1 (alternatively you may use the URL - http://tplinklogin.net).
• Choose the menu “System Tools → Firmware Upgrade”.
• Upload the openwrt-ar71xx-generic-tl-wr740n-vXXX-squashfs-factory.bin file to router. vXXX is the version that is known to work with your router (like for HW rev4.23 vXXX is actually v4). Be sure to chose a .......-squashfs-factory.bin file!
• Wait for the router to reboot.
• Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

Flashing using TFTP works with the steps descibed in TP-Link WR741ND TFTP Installation (it needs a working serial console!).

Note that ongoing experiments suggest that TFTP flashing is possible even without soldering a serial port. For more information, see: http://bkil.blogspot.com/2014/12/tftp-secret-of-tl-wr740n-uncovered.html

Please check out the article Flash Layout for explanations.

Note: Below is the kernel log from the unmodified Attitude Adjustment (12.09-beta) generic WR740N v4 image firmware, showing the Flash Layout of the WR740N v4.23

[    0.660000] 5 tp-link partitions found on MTD device spi0.0
[    0.660000] Creating 5 MTD partitions on "spi0.0":
[    0.670000] 0x000000000000-0x000000020000 : "u-boot"
[    0.680000] 0x000000020000-0x000000108468 : "kernel"
[    0.690000] 0x000000108468-0x0000003f0000 : "rootfs"
[    0.720000] mtd: partition "rootfs_data" created automatically, ofs=2D0000, len=120000 
[    0.720000] 0x0000002d0000-0x0000003f0000 : "rootfs_data"
[    0.730000] 0x0000003f0000-0x000000400000 : "art"
[    0.740000] 0x000000020000-0x0000003f0000 : "firmware"

Note: Below is the kernel log from stock firmware showing the Flash Layout of the WR740N v6.00

                                          
mtd0: 00020000 00010000 "u-boot"                                                
mtd1: 00100000 00010000 "kernel"                                                
mtd2: 002c0000 00010000 "rootfs"                                                
mtd3: 00010000 00010000 "config"                                                
mtd4: 00010000 00010000 "art"                                                   

This information is obtained from the serial interface:

Type tpl in order to get into boot shell. This are the env parameters:

Case Back:

Case Front:

Case Back:

Board Front:

Board Back:

Board:

The general information and steps of using serial port, serial port cable, serial console etc, can be found at Serial Console.

Below is the specific information about the different hardware versions of TL-WR740N.

The serial headers are not completely connected (a voltage divider and capacitor are left out, so the headers are dead), but a serial connection can still be established by soldering directly to two of the empty pads. The result is a bit unstable (router output is often partially lost) and can probably be improved electrically.

Baudrate: 115200n8

Type “tpl” in U-Boot to get a shell!

Use Baud rate: 115200 N8

Garbled characters during early Uboot phase is attributed incorrect Parity settings. Baud rate: 115200 7E1 See this Owrt thread for more information

The v4.23 uses the standard TP-Link pinout, however the TX pin is not connected to the CPU. In order to make the TX line working, the two points on the bottom side of the PCB must be connected with a small wire. The pin at the SOC is labeled TP18, the one at the serial connector is labeled TP28. The RX line is 5V intolerant! So the connection needs a 3.3V RS232 level shifter. Pins on the connector on the photo are TX-RX-GND-3V3(VCC) (from left to right).

1. Download http://downloads.openwrt.org/attitude_adjustment/12.09-beta/ar71xx/generic/openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin to your TFTP server.
2. Hook your routers WAN ethernet port up to your network
3. Hook up the serial console as explained in the section “serial console” and do the “tpl” trick to get console access
4. Now we need to set router and server IP addresses (here named ROUTERIP and SERVERIP, substitute these with the real IP addresses). Type in the console:

    setenv ipaddr ROUTERIP
    setenv serverip SERVERIP
    printenv

5. Double check that the output of printenv lists the IP addresses you just set. Now we can load the firmware over TFTP with “tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin”:

   tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr740n-v4-squashfs-factory.bin
   erase 0x9f020000 +0x3c0000
   cp.b 0x81000000 0x9f020000 0x3c0000
   bootm 9f020000

Working chips:

• Hynix HY5DU121622DTP-D43 (From Mustang DDR SO-DIMM 512 MB)
• Hynix HY5DU121622CTP-D43 (From Hynix DDR SO-DIMM PC2700S-25330 512MB DDR 333MHz CL 2.5
• Hynix HY5DU121622AT-J (From DDR 256MB PC400 (BUD968RA))
• Infineon HYB25D512160BE (From Infineon DDR SO-DIMM 512 MB)
• Elpida EDD5116ADTA-6B-E (From Elpida DDR SO-DIMM 512 MB)
• Elpida EDD5116AFTA-5B-E (From Elpida DDR SO-DIMM 512 MB)
• Nanya NT5DS32M16BS-5Tdatasheet

follow pictures soon...

Tested on v4.21 board. Selected flash was W25Q64CVSSIG. Backup ART partition, flash BREED uboot (using IC Programmer‎), solder, boot into uboot, flash ART, flash OpenWrt.

• TL-WR740N v4.27 SD card mod

https://forum.archive.openwrt.org/viewtopic.php?id=37368

General debricking advices are described here.

At the original time of writing, no method was known to recover most models from a bad firmware without soldering the serial cable. However, ongoing experiments suggest that TFTP flashing is possible even without soldering a serial port. The list of models and versions which have a factory U-Boot compiled with tftp enabled is to be determined. It's best to try it yourself because there's nothing to lose, but please do share your results at the respective wiki page. For more information, see: http://bkil.blogspot.com/2014/12/tftp-secret-of-tl-wr740n-uncovered.html

For debricking with a working serial cable using TFTP follow the steps descibed in TP-Link WR741ND TFTP Installation.

For the (box branded) WR740N v2.4 and v4.23 the below works for recovery from nasty stuff like dropbear lockout, mtd overlay size problems or other software misuses :

• Unplug the router's power cord.
• Connect any router LAN port directly to your PC.
• Configure your PC with a static IP address: 192.168.1.2
• Plug the power on to the router.
• Wait until the “SYS” LED starts flashing repeatedly.
• Press the “QSS” button (on the front/back of the router) → the “SYS” LED will now start flashing at a faster rate.
• Login to the router by using telnet to connect to the IP address 192.168.1.1 → there will be an immediate unauthenticated login to a root shell.

• mount_root - will mount the normal root filesystem.
• firstboot - all settings will be reset.
• /rom/sbin/reboot - will reboot even without a mounted filesystem.

Read about bootloader in general and about Das U-Boot in particular.

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

• Official repository on GitHub: U-Boot 1.1.4 modification for routers
• Discussion about this project on OpenWrt forum
• An article (in Polish) about one of the first version of this project on www.tech-blog.pl

LUCI Web Interface has bug with port ID in switch section (Checked on v4.20), LAN Port number on router=Port number in LUCI switch 1=2, 2=1, 3=2, 4=1

• A TL-WR740N v4.23 step by step tutorial for novice OpenWrt users