SUPPORT FOR TP-LINK TL-WR940N Ver 5.0

Hello Friends. Here is the bootlog for V5.0, As you can see it is nearly identical to V4.0 which is supported.

Any pointers as to how to port this would be greatly appreciated.

Serial Log Below complete with procinfo mtd etc.

U-Boot 1.1.4 (Nov 21 2016 - 19:41:18)

ap151 - Dragonfly 1.0

DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 141k for U-Boot at: 81fdc000
Reserving 192k for malloc() at: 81fac000
Reserving 44 Bytes for Board Info at: 81fabfd4
Reserving 36 Bytes for Global Data at: 81fabfb0
Reserving 128k for boot params() at: 81f8bfb0
Stack Pointer at: 81f8bf98
Now running in RAM - U-Boot at: 81fdc000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x16
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
is_auto_upload_firmware=0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801cea10) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Booting QCA956x
Linux version 2.6.31 (tomcat@buildserver) (gcc version 4.3.3 (GCC) ) #154 Mon Nov 21 19:47:46 CST 2016
Ram size passed from bootloader =32M
flash_size passed from bootloader = 4
CPU revision is: 00019750 (MIPS 74Kc)
ath_sys_frequency: cpu 750 ddr 400 ahb 250
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:2 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 26864k/32768k available (1870k kernel code, 5904k reserved, 446k data, 120k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
r4k_clockevent_init: Ignoring int_usable failure
Calibrating delay loop... 374.78 BogoMIPS (lpj=749568)
Mount-cache hash table entries: 512

****************ALLOC***********************
 Packet mem: 802754a0 (0x300000 bytes)
********************************************

NET: Registered protocol family 16
ath_pcibios_init: bus 0
***** Warning PCIe 0 H/W not found !!!
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 52
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
5 cmdlinepart partitions found on MTD device ath-nor0
Creating 5 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000003e0000 : "rootfs"
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "art"
->Oops: flash id 0xc84016 .
Ooops, why the devices couldn't been initialed?
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 120k freed
init started:  BusyBox v1.01 (2016.11.21-11:53+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (512 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/af_key.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/xfrm_user.ko': No such file or directory

 (none) mips #154 Mon Nov 21 19:47:46 CST 2016 (none)
(none) login: qca956x_GMAC: Length per segment 1536
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
GPIO LED SETTINGS ....done
Currently in interrupt mode unit1
qca956x_set_gmac_caps  CHECK DMA STATUS
mac:1 Registering S27....
qca956x_GMAC: RX TASKLET - Pkts per Intr:32
qca956x_GMAC: Max segments per packet :   1
qca956x_GMAC: Max tx descriptor count :   128
qca956x_GMAC: Max rx descriptor count :   128
qca956x_GMAC: Mac capability flags    :   2401
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in interrupt mode unit0
qca956x_set_gmac_caps  CHECK DMA STATUS
mac:0 Registering S27....
qca956x_GMAC: RX TASKLET - Pkts per Intr:32
qca956x_GMAC: Max segments per packet :   1
qca956x_GMAC: Max tx descriptor count :   128
qca956x_GMAC: Max rx descriptor count :   128
qca956x_GMAC: Mac capability flags    :   2401
athr_gmac_ring_alloc Allocated 2048 at 0x81e92800
sram_desc_cnt 1536,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e92000
sram_desc_cnt 3072,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
ATHRS27: resetting s27
ATHRS27: s27 reset done
++++ athrs27_igmp_setup once---
++ PVID: 0x0000000b, bitmap: 0x0000001f
++ PVID: 0x00000003, bitmap: 0x0000001f
++ PVID: 0x00000005, bitmap: 0x0000001f
++ PVID: 0x00000007, bitmap: 0x0000001f
++ PVID: 0x00000009, bitmap: 0x0000001f
vtable vid: 0x00000002, bitmap 0x00000003
vtable vid: 0x00000004, bitmap 0x00000005
vtable vid: 0x00000006, bitmap 0x00000007
vtable vid: 0x00000008, bitmap 0x00000009
vtable vid: 0x0000000a, bitmap 0x0000000b
vtable vid: 0x0000000c, bitmap 0x0000000d
vtable vid: 0x0000000e, bitmap 0x0000000f
vtable vid: 0x00000010, bitmap 0x00000011
vtable vid: 0x00000012, bitmap 0x00000013
vtable vid: 0x00000014, bitmap 0x00000015
vtable vid: 0x00000016, bitmap 0x00000017
vtable vid: 0x00000018, bitmap 0x00000019
vtable vid: 0x0000001a, bitmap 0x0000001b
vtable vid: 0x0000001c, bitmap 0x0000001d
vtable vid: 0x0000001e, bitmap 0x0000001f
vtable vid: 0x00000020, bitmap 0x00000021
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
athr_gmac_ring_alloc Allocated 2048 at 0x81ebf800
sram_desc_cnt 4608,mac Unit 0,Tx r->ring_desc 0xbd000c00
athr_gmac_ring_alloc Allocated 2048 at 0x81ebf000
sram_desc_cnt 6144,mac Unit 0,Rx r->ring_desc 0xbd001200
956x_GMAC: eth0 in MII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth0 entered promiscuous mode
athr_gmac_ring_free Freeing at 0x81ebf800
athr_gmac_ring_free Freeing at 0x81ebf000
athr_gmac_ring_alloc Allocated 2048 at 0x81ebf000
sram_desc_cnt 6144,mac Unit 0,Tx r->ring_desc 0xbd000c00
athr_gmac_ring_alloc Allocated 2048 at 0x81ebf800
sram_desc_cnt 6144,mac Unit 0,Rx r->ring_desc 0xbd001200
956x_GMAC: eth0 in MII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
athr_gmac_ring_free Freeing at 0x81e92800
athr_gmac_ring_free Freeing at 0x81e92000
athr_gmac_ring_alloc Allocated 2048 at 0x81e92000
sram_desc_cnt 6144,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e92800
sram_desc_cnt 6144,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
adf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2.162.3 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
Enterprise mode: 0x03bda000
Restoring Cal data from Flash
------read crc is:0x00000000, calculate crc is:0xe68cc4b4.
caldata crc check error.
ath_get_caps[6171] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6146] tx chainmask mismatch actual 7 sc_chainmak 0
ATH_RESERVED_TXBUF = 1000
wifi0: Atheros 956X: mem=0xb8100000, irq=2
VAP device ath0 created
Setting Max Stations:33

 DES SSID SET=TP-LINK_2314
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
athr_gmac_ring_free Freeing at 0x81e92000
athr_gmac_ring_free Freeing at 0x81e92800
br0: port 1(eth0) entering disabled state
athr_gmac_ring_alloc Allocated 2048 at 0x81e92800
sram_desc_cnt 6144,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e92000
sram_desc_cnt 6144,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
ý  ieee80211_ioctl_siwmode: imr.ifm_active=918144, new mode=3, valid=1
br0: port 2(ath0) entering disabled state

 DES SSID SET=TP-LINK_2314
br0: port 2(ath0) entering forwarding state
IPv6 over IPv4 tunneling driver
blockWps_proc_write 952: write value = 0

# cat /proc/meminfo
MemTotal:          26984 kB
MemFree:            8460 kB
Buffers:            2060 kB
Cached:             7268 kB
SwapCached:            0 kB
Active:             4320 kB
Inactive:           7352 kB
Active(anon):       2344 kB
Inactive(anon):        0 kB
Active(file):       1976 kB
Inactive(file):     7352 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2368 kB
Mapped:             2140 kB
Slab:               3824 kB
SReclaimable:        356 kB
SUnreclaim:         3468 kB
PageTables:          196 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       13492 kB
Committed_AS:       4776 kB
VmallocTotal:    1048404 kB
VmallocUsed:          60 kB
VmallocChunk:    1040048 kB

# cat /proc/cpuinfo
system type    : QCA956x
processor  : 0
cpu model  : MIPS 74Kc V5.0
BogoMIPS  : 374.78
wait instruction : yes
microsecond timers : yes
tlb_entries    : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0818, 0x0358, 0x01c8]
ASEs implemented : mips16 dsp
shadow register sets    : 1
core   : 0
VCED exceptions  : not available
VCEI exceptions  : not available

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00100000 00010000 "kernel"
mtd2: 002c0000 00010000 "rootfs"
mtd3: 00010000 00010000 "config"
mtd4: 00010000 00010000 "art"

# cat /proc/partitions
major minor  #blocks  name

  31        0        128 mtdblock0
  31        1       1024 mtdblock1
  31        2       2816 mtdblock2
  31        3         64 mtdblock3
  31        4         64 mtdblock4

Here is the official link from tp-link - http://www.tp-link.com/us/download/TL-WR940N_V5.html

FCC ID on the router is the same as WR940NV4, so I took the normal WR940N v4 (EU) image, it was accepted by the webinterface firmware update. Seems to be working perfectly. V5 seems to be only a new packaging and firmware skin for their new logo.

Let me try building one and ill let you know my findings.

I just tried v4 firmware with v5 and it works straight out of the box. You have to do it via WebUI tho, because if you try tftp, serial says

original_product_id = 155189253, original_product_ver = 1   
recovery_product_id = 155189252, recovery_product_ver = 1
auto update firmware: product id verify fail!

However, it works fine via WebUI, Flashed EU version in my case.

THANKS!

I also tried TFTP, an it worked for me. Did you use the general factory file or the EU file?

EU. that might have been it.

sorry ... i am also trying to install LEDE on a Tp-Link WR940N v.5 but the webinterface does not accept me ... maybe i'm wrong version.
Can you tell me the exact link of the version to install?
Thanks in advance and sorry for my English (I'm using a translator)

What image have you installed? snapshot or 17.01.4?

I tried to install the lede-17.01.4-ar71xx-generic-tl-wr940n-v4-squashfs-factory

same problem here when trying to flash a 940N(BR) V5 using lede-17.01.4-ar71xx-generic-tl-wr940n-v4-squashfs-factory i receive an 18005 error in web interface page...

my hardware info in the tplink admin page:
hardware: WR940V v4/5 00000000
my FCC is TE7WR940NV4

anyone knows what's wrong ?!

and in the box of this 940N(BR) V5 its as 256 RAM and 32 FLASH, but in the WIKI pages of this model is 32 RAM and 4 of FLASH ?!?!!? maybe this 940N(BR) V5 can be different ?!?!?

i try to compile myself a firmware.. and generate 3 files squashfs factory, one .bin and other two -eu and -us.... but all of them give me the 18005 error trying to update de firmwre using web interface

Hi @mportela,
I try to prepare BR version of lede firmware. Can You test it?
This is latest LEDE snapshot.

1 Like

Try renaming the LEDE firmware file to a shorter name, such as factory.bin

Otherwise, try TFTP.

Hi Thankyou!!! It works like a charm... and no need to rename to shorter filename... just upgrade in the tplink webupdate normal GUI.

What do you do to compile this that works ? Its some patch, or just build using the branch SNAPSHOT ?!?!? I try with release 17.01.4 ... and generates 3 files... when you use the SNAPSHOT you just go to menuconfig and select the TARGET etc and then make ? how you generate this factory-br.bin file ?!!?!? or just rename some of then ?!?!

Enjoy some command tests in ssh (no Luci in your firmware):

==========================================================================================

root@LEDE:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.0M      2.0M         0 100% /rom
tmpfs                    13.3M     68.0K     13.3M   0% /tmp
tmpfs                    13.3M     32.0K     13.3M   0% /tmp/root
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock3          512.0K    208.0K    304.0K  41% /overlay
overlayfs:/overlay      512.0K    208.0K    304.0K  41% /

==========================================================================================

root@LEDE:~# free -m
             total       used       free     shared    buffers     cached
Mem:         27300      19256       8044        100       1676       5452
-/+ buffers/cache:      12128      15172
Swap:            0          0          0

==========================================================================================

ssh root@192.168.1.1


BusyBox v1.27.2 () built-in shell (ash)

     _________
    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (SNAPSHOT, r5447-e23ff063d3)
    \________\/    -----------------------------------------------------------

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@LEDE:~#

First i check BR version of stock image.
Firmware header have diffrent value of region code:
BR:
image
EU have 4555, US have 5553

I use hex editor to change this value in factory-eu.bin form 4555 to 4252 and use mktplinkfw tool from firmware-utils to check MD5 sum and again correct MD5 in hex editor.

Maybe someone add BR region code to mktplinkfw tool.

Ok, i Will try this with my custom firmware...

Thank You again!!!

If You have installed LEDE firmware just use sysupgrade image file.