TP-LINK TL-WR940N v6 (ES) bricked

CyB3R · October 19, 2020, 6:59pm

Hi there, i have a over 100 units flashed and working just fine.. same model, same version, same box and look alike... at least in the decal.

yesterday we tried to install openwrt to the 5 new routers using the same computer (and others) than the previous ones and even the same image... after openwrt-factory loads... the router bricks and starts blinking in orange.. I was able to restore them over the TFTP method (192.168.0.66, tftpd etc) and i have OEM Firmware up again, but whatever version of openwrt ive tried is the same after upload the router goes out...

I have tried on different versions and do the same, i even try to tftp the openwrt image (several versions including sysupgrade version) without success.

Obviously something change, but im not sure what...

Thanks for your time reading this and for your help in advance.
JB

123serge123 · October 20, 2020, 6:22am

There is too little info in your request. Serial console log may be helpful.
One of the possible reason that flash chip was changed by vendor.
See this topic for details.

CyB3R · October 21, 2020, 4:42am

i will try to get the serial console working... i have to solder some points to make it work and my soldering iron is too thick to do that, i have a better one at the office... let you know...

But for know it indeed have the QH23B-104HIP chip...

thanks for your reply.

CyB3R · October 21, 2020, 5:47am

I have the serial output.. hope it helps to help.. Thanks! @123serge123

U-Boot 1.1.4 (Nov 15 2017 - 12:14:10)

ap151 - Dragonfly 1.0

DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 141k for U-Boot at: 81fdc000
Reserving 192k for malloc() at: 81fac000
Reserving 44 Bytes for Board Info at: 81fabfd4
Reserving 36 Bytes for Global Data at: 81fabfb0
Reserving 128k for boot params() at: 81f8bfb0
Stack Pointer at: 81f8bf98
Now running in RAM - U-Boot at: 81fdc000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x16
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
is_auto_upload_firmware=0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

[    0.000000] Linux version 4.9.214 (buildbot@0d27b924961c) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7989-82fbd85747) ) #0 Thu Feb 27 21:25:59 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros TP9343 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  board=TL-WR940N-v6  console=ttyS0,115200 rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 27604K/32768K available (3408K kernel code, 167K rwdata, 424K rodata, 216K init, 211K bss, 5164K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:750.000MHz, DDR:400.000MHz, AHB:250.000MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5096694524 ns
[    0.000008] sched_clock: 32 bits at 375MHz, resolution 2ns, wraps every 5726622718ns
[    0.008257] Calibrating delay loop... 373.55 BogoMIPS (lpj=1867776)
[    0.071138] pid_max: default: 32768 minimum: 301
[    0.076111] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.083096] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093512] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103916] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111670] NET: Registered protocol family 16
[    0.117956] MIPS: machine is TP-LINK TL-WR940N v6
[    0.613388] clocksource: Switched to clocksource MIPS
[    0.619826] NET: Registered protocol family 2
[    0.625382] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.632742] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.639506] TCP: Hash tables configured (established 1024 bind 1024)
[    0.646330] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.652503] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.659436] NET: Registered protocol family 1
[    0.668080] Crashlog allocated RAM at address 0x1f00000
[    0.675081] workingset: timestamp_bits=30 max_order=13 bucket_order=0
[    0.688303] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.694494] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.715316] io scheduler noop registered
[    0.719449] io scheduler deadline registered (default)
[    0.725350] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.734621] console [ttyS0] disabled
[    0.758492] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.767605] console [ttyS0] enabled
[    0.767605] console [ttyS0] enabled
[    0.775164] bootconsole [early0] disabled
[    0.775164] bootconsole [early0] disabled
[    0.790558] m25p80 spi0.0: unrecognized JEDEC id bytes: 1c, 70, 16
[    0.798023] libphy: Fixed MDIO Bus: probed
[    0.821577] libphy: ag71xx_mdio: probed
[    1.455479] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    1.465610] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.095253] ag71xx-mdio.1: Found an AR934X built-in switch
[    2.147524] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    2.155479] NET: Registered protocol family 10
[    2.164270] NET: Registered protocol family 17
[    2.168920] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.182453] 8021q: 802.1Q VLAN Support v1.8
[    2.188732] hctosys: unable to open rtc device (rtc0)
[    2.194827] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.202559] Please append a correct "root=" boot option; here are the available partitions:
[    2.211243] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.220301] Rebooting in 1 seconds..

After this the router cycles itself booting...

123serge123 · October 21, 2020, 8:56am

As you see flash chip en25qh32 (id 1c7016) is not supported. You need to backport support for the chip and recompile firmware. Simpy in linux kernel source file
/drivers/mtd/spi-nor/spi-nor.c find struct flash_info spi_nor_ids and add record
{ "en25qh32", INFO(0x1c7016, 0, 64 * 1024, 64, 0) },

CyB3R · October 26, 2020, 4:10am

i've never made my own build... im still reading to learn how to do it.. i have everything installed now in my linux machine.. now im trying to figure this out... Any hints? o where to focus? Thanks for your time mate..

123serge123 · October 28, 2020, 9:56am

I don't think that I can explain better that openwrt docs. Some hints:

You need compile openwrt branch openwrt-18.06 because of later realeses dont't support 4/32 devices (see 4/32 warnnig).
As example you can see this patch. As quick and dirty hack you can add en25qh32 chip directly into this file something like:


--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -954,6 +954,8 @@ static const struct flash_info spi_nor_i
 	{ "en25q32b",   INFO(0x1c3016, 0, 64 * 1024,   64, 0) },
 	{ "en25p64",    INFO(0x1c2017, 0, 64 * 1024,  128, 0) },
 	{ "en25q64",    INFO(0x1c3017, 0, 64 * 1024,  128, SECT_4K) },
+	{ "en25q128",   INFO(0x1c3018, 0, 64 * 1024,  256, SECT_4K) },
+	{ "en25qh32", INFO(0x1c7016, 0, 64 * 1024, 64, 0) },
 	{ "en25qh128",  INFO(0x1c7018, 0, 64 * 1024,  256, 0) },
 	{ "en25qh256",  INFO(0x1c7019, 0, 64 * 1024,  512, 0) },
 	{ "en25s64",	INFO(0x1c3817, 0, 64 * 1024,  128, SECT_4K),

It's simpler for me to make patched firmware for you than explain details .
You can try this firmware:

CyB3R · October 28, 2020, 10:37pm

Wow! that just worked as easy as upload.... Thank you i really appreciate your help! I'm going to read the docs and learn how to do it by myself.!

Thanks again for your time, patience and help!
JB.

123serge123 · October 29, 2020, 8:03am

Ok.
Good luck!

system · November 8, 2020, 8:03am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.