Support for TP-LINK TL-WR940N Ver 6.0

amaurynieto · January 9, 2018, 3:53am

Hey there! So, Version 6.0 is out for 940N, was previously at 5.0. Here are the bootlogs, partitions, mtd.

Amazingly, it seems it's practically identical to Ver 5.0, save for the fact that there is only ONE LED as opposed to 5 or 6 with version 5.0

As far as I can see, they are the same on Wikidevi too.

https://wikidevi.com/wiki/TP-LINK_TL-WR940N_v6.x

https://wikidevi.com/wiki/TP-LINK_TL-WR940N_v4.x

@robimarko added support for several TP-LINK Devices of late. I wonder what his take is on it?

U-Boot 1.1.4 (Jul  4 2017 - 14:43:31)

ap151 - Dragonfly 1.0

DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 141k for U-Boot at: 81fdc000
Reserving 192k for malloc() at: 81fac000
Reserving 44 Bytes for Board Info at: 81fabfd4
Reserving 36 Bytes for Global Data at: 81fabfb0
Reserving 128k for boot params() at: 81f8bfb0
Stack Pointer at: 81f8bf98
Now running in RAM - U-Boot at: 81fdc000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x16
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
is_auto_upload_firmware=0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801cea10) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Booting QCA956x
Linux version 2.6.31 (tomcat@buildserver) (gcc version 4.3.3 (GCC) ) #47 Tue Jul 4 14:46:26 CST 2017
Ram size passed from bootloader =32M
flash_size passed from bootloader = 4
CPU revision is: 00019750 (MIPS 74Kc)
ath_sys_frequency: cpu 750 ddr 400 ahb 250
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:2 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 26864k/32768k available (1870k kernel code, 5904k reserved, 446k data, 120k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
r4k_clockevent_init: Ignoring int_usable failure
Calibrating delay loop... 374.78 BogoMIPS (lpj=749568)
Mount-cache hash table entries: 512

****************ALLOC***********************
 Packet mem: 802754a0 (0x300000 bytes)
********************************************

NET: Registered protocol family 16
ath_pcibios_init: bus 0
***** Warning PCIe 0 H/W not found !!!
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 52
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
5 cmdlinepart partitions found on MTD device ath-nor0
Creating 5 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000003e0000 : "rootfs"
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "art"
->Oops: flash id 0xc84016 .
Ooops, why the devices couldn't been initialed?
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 120k freed
init started:  BusyBox v1.01 (2017.07.04-06:49+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (512 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/af_key.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/xfrm_user.ko': No such file or directory

qca956x_GMAC: Length per segment 1536
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in interrupt mode unit1
qca956x_set_gmac_caps  CHECK DMA STATUS
mac:1 Registering S27....
qca956x_GMAC: RX TASKLET - Pkts per Intr:32
qca956x_GMAC: Max segments per packet :   1
qca956x_GMAC: Max tx descriptor count :   128
qca956x_GMAC: Max rx descriptor count :   128
qca956x_GMAC: Mac capability flags    :   2401
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in interrupt mode unit0
qca956x_set_gmac_caps  CHECK DMA STATUS
mac:0 Registering S27....
qca956x_GMAC: RX TASKLET - Pkts per Intr:32
qca956x_GMAC: Max segments per packet :   1
qca956x_GMAC: Max tx descriptor count :   128
qca956x_GMAC: Max rx descriptor count :   128
qca956x_GMAC: Mac capability flags    :   2401
 (none) mips #47 Tue Jul 4 14:46:26 CST 2017 (none)
(none) login: athr_gmac_ring_alloc Allocated 2048 at 0x81e83800
sram_desc_cnt 1536,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e83000
sram_desc_cnt 3072,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
ATHRS27: resetting s27
ATHRS27: s27 reset done
++++ athrs27_igmp_setup once---
++ PVID: 0x0000000b, bitmap: 0x0000001f
++ PVID: 0x00000003, bitmap: 0x0000001f
++ PVID: 0x00000005, bitmap: 0x0000001f
++ PVID: 0x00000007, bitmap: 0x0000001f
++ PVID: 0x00000009, bitmap: 0x0000001f
vtable vid: 0x00000002, bitmap 0x00000003
vtable vid: 0x00000004, bitmap 0x00000005
vtable vid: 0x00000006, bitmap 0x00000007
vtable vid: 0x00000008, bitmap 0x00000009
vtable vid: 0x0000000a, bitmap 0x0000000b
vtable vid: 0x0000000c, bitmap 0x0000000d
vtable vid: 0x0000000e, bitmap 0x0000000f
vtable vid: 0x00000010, bitmap 0x00000011
vtable vid: 0x00000012, bitmap 0x00000013
vtable vid: 0x00000014, bitmap 0x00000015
vtable vid: 0x00000016, bitmap 0x00000017
vtable vid: 0x00000018, bitmap 0x00000019
vtable vid: 0x0000001a, bitmap 0x0000001b
vtable vid: 0x0000001c, bitmap 0x0000001d
vtable vid: 0x0000001e, bitmap 0x0000001f
vtable vid: 0x00000020, bitmap 0x00000021
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
athr_gmac_ring_alloc Allocated 2048 at 0x81e98800
sram_desc_cnt 4608,mac Unit 0,Tx r->ring_desc 0xbd000c00
athr_gmac_ring_alloc Allocated 2048 at 0x81e98000
sram_desc_cnt 6144,mac Unit 0,Rx r->ring_desc 0xbd001200
956x_GMAC: eth0 in MII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth0 entered promiscuous mode
athr_gmac_ring_free Freeing at 0x81e98800
athr_gmac_ring_free Freeing at 0x81e98000
athr_gmac_ring_alloc Allocated 2048 at 0x81e98000
sram_desc_cnt 6144,mac Unit 0,Tx r->ring_desc 0xbd000c00
athr_gmac_ring_alloc Allocated 2048 at 0x81e98800
sram_desc_cnt 6144,mac Unit 0,Rx r->ring_desc 0xbd001200
956x_GMAC: eth0 in MII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
athr_gmac_ring_free Freeing at 0x81e83800
athr_gmac_ring_free Freeing at 0x81e83000
athr_gmac_ring_alloc Allocated 2048 at 0x81e83000
sram_desc_cnt 6144,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e83800
sram_desc_cnt 6144,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
adf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2.162.3 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
Enterprise mode: 0x03bda000
Restoring Cal data from Flash
------read crc is:0x00000000, calculate crc is:0x93c8e79f.
caldata crc check error.
ath_get_caps[6171] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6146] tx chainmask mismatch actual 7 sc_chainmak 0
ATH_RESERVED_TXBUF = 1000
wifi0: Atheros 956X: mem=0xb8100000, irq=2
ieee80211_extap_mac_add:70:4f:57:65:e0:b8
VAP device ath0 created
Setting Max Stations:33

 DES SSID SET=TP-Link_E0B8
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
athr_gmac_ring_free Freeing at 0x81e83000
athr_gmac_ring_free Freeing at 0x81e83800
br0: port 1(eth0) entering disabled state
athr_gmac_ring_alloc Allocated 2048 at 0x81e83800
sram_desc_cnt 6144,mac Unit 1,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x81e83000
sram_desc_cnt 6144,mac Unit 1,Rx r->ring_desc 0xbd000600
956x_GMAC: eth1 in RGMII MODE
Dragonfly -----> S27 PHY
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
 ieee80211_ioctl_siwmode: imr.ifm_active=918144, new mode=3, valid=1
br0: port 2(ath0) entering disabled state

 DES SSID SET=TP-Link_E0B8
br0: port 2(ath0) entering forwarding state
IPv6 over IPv4 tunneling driver
blockWps_proc_write 964: write value = 0

 TL-WR940N mips #47 Tue Jul 4 14:46:26 CST 2017 (none)
TL-WR940N login: root
Password:
Jan  1 00:00:54 login[81]: root login  on `ttyS0'

BusyBox v1.01 (2017.07.04-06:49+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

# cat /proc/meminfo
MemTotal:          26984 kB
MemFree:            8480 kB
Buffers:            2048 kB
Cached:             7276 kB
SwapCached:            0 kB
Active:             4304 kB
Inactive:           7348 kB
Active(anon):       2328 kB
Inactive(anon):        0 kB
Active(file):       1976 kB
Inactive(file):     7348 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2352 kB
Mapped:             2112 kB
Slab:               3820 kB
SReclaimable:        356 kB
SUnreclaim:         3464 kB
PageTables:          196 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       13492 kB
Committed_AS:       4772 kB
VmallocTotal:    1048404 kB
VmallocUsed:          60 kB
VmallocChunk:    1040048 kB


# cat /proc/cpuinfo
system type             : QCA956x
processor               : 0
cpu model               : MIPS 74Kc V5.0
BogoMIPS                : 374.78
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0004, 0x07a8, 0x0340, 0x0ff8]
ASEs implemented        : mips16 dsp
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available


# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00100000 00010000 "kernel"
mtd2: 002c0000 00010000 "rootfs"
mtd3: 00010000 00010000 "config"
mtd4: 00010000 00010000 "art"


# cat /proc/partitions
major minor  #blocks  name

  31        0        128 mtdblock0
  31        1       1024 mtdblock1
  31        2       2816 mtdblock2
  31        3         64 mtdblock3
  31        4         64 mtdblock4

--END--

robimarko · January 9, 2018, 9:34am

It looks like a simple device to add.
Altough Wikidevi has wrong specs for v6 as it uses QCA956X series.
It looks really similar to v5,it even has really low 4MB of flash and 32MB of RAM.

So seeing that 940N v5 was not merged due to that,I dont think it is good to support devices with this low amount of flash and especially RAM

amaurynieto · January 9, 2018, 12:25pm

Version 5 is an exact copy of v4 and works with v4. So no support was necessary.

4mb ram devices are invaluable. Even with no gui it proves to be a very powerful device with many functionalities (including vpn, ad block, etc) built in

I think it's a vital part of the ecosystem since router manufacturers will always try to cut their costs by adding cheaper hardware. Lede is not just for the enthusiast, it fills an important need in the professional space.

I have over 300 devices with 4mb that are deployed. All LEDE or OpenWRT. No Gui required.

robimarko · January 9, 2018, 12:29pm

Then v6 should work with v5 firmware too.
Well,actually only LEDs need adjustment.

Professional users will surely skip 4/32 MB devices because they know what pain it is.

amaurynieto · January 9, 2018, 12:54pm

Specific professionals looking for a maximum ROI in a field with heavy competition will forsake the perceived pain and build a flashable image that works out of the box for easy and pervasive distribution of a specific solution that does not require user intervention and is centrally administrated via openvpn.

For more intricate projects there is always ubiquiti, and others. But when you want to reach as many people as possible, succeeding with 4mb due to cost versus an unnecessary 8 or 16 at a higher price point is the difference in competitive pricing for specific use cases.

I think I can't be the only person in this space who feels this way.

robimarko · January 9, 2018, 1:00pm

What is the actual price difference between 4/32 and 8/64 MB devices?
WR842N v3 costs the same and has 16 MB of flash and 64MB of RAM.

It is not smart counting on barely squeezing images on 4/32MB devices,I doubt they will be supported for much longer

amaurynieto · January 9, 2018, 1:04pm

Availability for one, and there is a 10 dollar price difference at my wholesaler.

I agree with you on principle, I do. I just feel that if the option is there to run a barebone, it should be up to the enthusiast / professional / quasi professional to decide based on their circumstance.

robimarko · January 9, 2018, 1:05pm

Sure,but you cant expect any support for it then.

amaurynieto · January 9, 2018, 1:07pm

I fail to understand the underlying reasons why.

robimarko · January 9, 2018, 1:08pm

Because nobody will be willing to guarantee that it will work.
Especially due to only 32MB of RAM

amaurynieto · January 9, 2018, 2:56pm

Ok. Hopefully support will stick around long enough for me to find a replacement router that's readily available. Will post back with findings re the flash of v4/v5 on v6.

robimarko · January 9, 2018, 2:57pm

LEDs need to be removed.
You dont want GPIO pins going high for no reason

amaurynieto · January 9, 2018, 3:12pm

Would it be safe to say that 840v5 that you ported with one single led would probably work for 940v6 with one led, as well? Worth a shot.

robimarko · January 9, 2018, 3:21pm

No way, completely different architectures.
I will edit the mach file,but you will need to build it.

amaurynieto · January 9, 2018, 3:33pm

Of course. Thank you!

robimarko · January 9, 2018, 4:05pm

Can you confirm that remaining LED is WAN led?
That is what GPL tells me,but I cant find image of v6 to confirm it

amaurynieto · January 9, 2018, 4:15pm

Hi, yes, it is a WAN LED.

Tried flashing via TFTP with v4/v5, shows..

    Bytes transferred = 3932160 (3c0000 hex)
original_product_id = 155189254, original_product_ver = 1
recovery_product_id = 155189252, recovery_product_ver = 1
auto update firmware: product id verify fail!

And tried via WebGUI and got

Error Code 18005.

robimarko · January 9, 2018, 4:16pm

Off course,when it has different product ID.
That will be adressed too

robimarko · January 9, 2018, 4:27pm

You can go and build this branch
https://github.com/robimarko/openwrt/tree/WR940N-v6

amaurynieto · January 9, 2018, 4:27pm

Yes sir! Right now. Thank you. Will report back briefly.