TPLINK TL-WDR8500 TTL连接

mht

收了一个TPLINK的坑货WDR8500 V1，8M闪存，连USB口都没有，搞不了什么。这个路由应该是国内专供的，相关的资料是比较少的，拆机都很少见。
找了半天TTL的连接方法没找到，就自己试一下了，同时在此记录以备忘。

先上一个7天线靓照，这鬼东西，天线是不可拆的，全部放平占地巨大，不用的话收起来都没地方放。

--------------------
1. 拧下后背的4个螺丝，用撬片撬开上盖，就可以看到电路板了。这里借一张upsangel的拆机照，我自已拍的太烂。

红框位置就是TTL的安装位置。
2. 焊上插座，连上线，针脚对应的接法如下，即从左到右:VCC、GND、RXD、TXD：

接的时候RX和TX要交换一下，按图上接就对了。
3. 连上后发现无法输入，找了下电路板附近有一个未焊接的点(R208)，应该是少了一个电阻。
直接连上可以输入，所以直接焊上得了。太小了没有尖头的烙铁不好焊。

至此所有硬件改造完成。
最终完成体，用杜邦线接出来，盖上盖:

----------------------------------------------------------
要注意的几个点：
1. 原版固件的uboot用的波特率是117500，所以如果使用112500，uboot部分会乱码。
Baud rate:117500
Data bits:8
Parity: None
Stop bits: 1
Flow control:全部不要选

在出现 Autobooting in 1 seconds 时，按下 slp 就会停下来。
输入?就可以看到全部支持命令，可以随便玩了。（详见后面的）

2. 如果不按slp，会启动linux，此时波特率就变回112500了，可以改回去，否则输入是乱的。
其实不知道tplink设置的管理员用户密码是什么，进不了系统。
3.完整备份系统！（我就忘了备份，结果。。。）
----------------------------------------------------------
系统log记录:

1. U-Boot 1.1.4 (Feb 23 2016 - 18:18:16)(COMPRESSED)
   
2. 
   
3. ap152 - Dragonfly 1.0
   
4. 
   
5. DRAM:  128 MB
   
6. Top of RAM usable for U-Boot at: 88000000
   
7. Reserving 204k for U-Boot at: 87fcc000
   
8. Reserving 132k for malloc() at: 87fab000
   
9. Reserving 44 Bytes for Board Info at: 87faafd4
   
10. Reserving 36 Bytes for Global Data at: 87faafb0
    
11. Reserving 128k for boot params() at: 87f8afb0
    
12. Stack Pointer at: 87f8af98
    
13. Now running in RAM - U-Boot at: 87fcc000
    
14. Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
    
15. flash size 8MB, sector count = 2048
    
16. Flash:  8 MB
    
17. Using default environment
    
18. 
    
19. Autobooting in 1 seconds
    
20. verifying uboot partition...
    
21. ok
    
22. verifying kernel and romfs partition...
    
23. ok
    
24. 
    
25. U-Boot 1.1.4 (Feb 23 2016 - 18:26:40)
    
26. 
    
27. ap152 - Dragonfly 1.0
    
28. 
    
29. DRAM:  128 MB
    
30. Top of RAM usable for U-Boot at: 88000000
    
31. Reserving 135k for U-Boot at: 87fdc000
    
32. Reserving 132k for malloc() at: 87fbb000
    
33. Reserving 44 Bytes for Board Info at: 87fbafd4
    
34. Reserving 36 Bytes for Global Data at: 87fbafb0
    
35. Reserving 128k for boot params() at: 87f9afb0
    
36. Stack Pointer at: 87f9af98
    
37. Now running in RAM - U-Boot at: 87fdc000
    
38. Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
    
39. flash size 8MB, sector count = 2048
    
40. Flash:  8 MB
    
41. Using default environment
    
42. 
    
43. In:    serial
    
44. Out:   serial
    
45. Err:   serial
    
46. Net:   ath_gmac_enet_initialize...
    
47. No valid address in Flash. Using fixed address
    
48. ath_gmac_enet_initialize: reset mask:c02200
    
49. athr_mgmt_init ::done
    
50. Dragonfly  ----> S17 PHY *
    
51. athrs17_reg_init: complete
    
52. SGMII in forced mode
    
53. athr_gmac_sgmii_setup SGMII done
    
54. : cfg1 0x80000000 cfg2 0x7114
    
55. eth0: 00:11:12:13:14:15
    
56. eth0 up
    
57. eth0
    
58. Setting 0x181162c0 to 0x4b962100
    
59. Autobooting in 1 seconds
    
60. ## Booting image at 9f040000 ...
    
61.    Uncompressing Kernel Image ... OK
    
62. No initrd
    
63. ## Transferring control to Linux (at address 80060000) ...
    
64. ## Giving linux memsize in bytes, 134217728
    
65. 
    
66. Starting kernel ...
    
67. 
    
68. [    0.000000] Linux version 3.3.8 (tplink@tplink-0B) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Tue Feb 23 18:29:02 CST 2016
    
69. [    0.000000] bootconsole [early0] enabled
    
70. [    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
    
71. [    0.000000] SoC: Qualcomm Atheros QCA956X rev 0
    
72. [    0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
    
73. [    0.000000] Determined physical RAM map:
    
74. [    0.000000]  memory: 08000000 [url=home.php?mod=space&uid=162986]@[/url] 00000000 (usable)
    
75. [    0.000000] Initrd not found or empty - disabling initrd
    
76. [    0.000000] Zone PFN ranges:
    
77. [    0.000000]   Normal   0x00000000 -> 0x00008000
    
78. [    0.000000] Movable zone start PFN for each node
    
79. [    0.000000] Early memory PFN ranges
    
80. [    0.000000]     0: 0x00000000 -> 0x00008000
    
81. [    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
    
82. [    0.000000] Kernel command line:  board=AP152 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
    
83. [    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
    
84. [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
    
85. [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
    
86. [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    
87. [    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    
88. [    0.000000] Writing ErrCtl register=00000000
    
89. [    0.000000] Readback ErrCtl register=00000000
    
90. [    0.000000] Memory: 126364k/131072k available (2194k kernel code, 4708k reserved, 577k data, 180k init, 0k highmem)
    
91. [    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    
92. [    0.000000] NR_IRQS:83
    
93. [    0.000000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
    
94. [    0.060000] pid_max: default: 32768 minimum: 301
    
95. [    0.060000] Mount-cache hash table entries: 512
    
96. [    0.060000] Initialized recycle list for cpu 0.
    
97. [    0.070000] NET: Registered protocol family 16
    
98. [    0.070000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
    
99. [    0.080000] MIPS: machine is Qualcomm Atheros AP152 reference board
    
100. [    0.080000] registering PCI controller with io_map_base unset
     
101. [    0.090000] bio: create slab <bio-0> at 0
     
102. [    0.100000] PCI host bridge to bus 0000:00
     
103. [    0.100000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
     
104. [    0.110000] pci_bus 0000:00: root bus resource [io  0x0001]
     
105. [    0.110000] pci 0000:00:00.0: invalid calibration data
     
106. [    0.120000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
     
107. [    0.120000] pci 0000:00:00.0: using irq 40 for pin 1
     
108. [    0.130000] Switching to clocksource MIPS
     
109. [    0.130000] NET: Registered protocol family 2
     
110. [    0.140000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
     
111. [    0.140000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
     
112. [    0.150000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
     
113. [    0.150000] TCP: Hash tables configured (established 4096 bind 4096)
     
114. [    0.160000] TCP reno registered
     
115. [    0.160000] UDP hash table entries: 256 (order: 0, 4096 bytes)
     
116. [    0.170000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
     
117. [    0.170000] NET: Registered protocol family 1
     
118. [    0.190000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
     
119. [    0.190000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
     
120. [    0.200000] msgmni has been set to 246
     
121. [    0.210000] io scheduler noop registered
     
122. [    0.210000] io scheduler deadline registered (default)
     
123. [    0.220000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
     
124. [    0.240000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
     
125. [    0.250000] console [ttyS0] enabled, bootconsole disabled
     
126. [    0.250000] console [ttyS0] enabled, bootconsole disabled
     
127. [    0.260000] m25p80 spi0.0: found s25fl064k, expected m25p80
     
128. [    0.270000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
     
129. [    0.270000] Searching for RedBoot partition table
     
130. [    0.280000] 9 RedBoot partitions found on MTD device spi0.0
     
131. [    0.280000] Creating 9 MTD partitions on "spi0.0":
     
132. [    0.290000] 0x000000000000-0x00000001b800 : "factory_boot"
     
133. [    0.290000] mtd: partition "factory_boot" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
     
134. [    0.310000] 0x00000001b800-0x00000001c000 : "factory_info"
     
135. [    0.310000] 0x00000001c000-0x000000020000 : "art"
     
136. [    0.320000] 0x000000020000-0x000000030000 : "config"
     
137. [    0.330000] 0x000000030000-0x000000040000 : "normal_boot"
     
138. [    0.330000] 0x000000040000-0x00000013e340 : "kernel"
     
139. [    0.340000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
     
140. [    0.350000] 0x00000013e340-0x000000660000 : "rootfs"
     
141. [    0.360000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
     
142. [    0.370000] mtd: partition "rootfs" set to be root filesystem
     
143. [    0.380000] 0x000000660000-0x000000800000 : "rootfs_data"
     
144. [    0.380000] 0x000000040000-0x000000800000 : "firmware"
     
145. [    0.390000] Registered character driver slp_flash_chrdev
     
146. [    0.400000] u32 classifier
     
147. [    0.400000]     Performance counters on
     
148. [    0.400000]     input device check on
     
149. [    0.410000]     Actions configured
     
150. [    0.410000] nf_conntrack version 0.5.0 (1974 buckets, 7896 max)
     
151. [    0.420000] TCP cubic registered
     
152. [    0.420000] NET: Registered protocol family 17
     
153. [    0.430000] 8021q: 802.1Q VLAN Support v1.8
     
154. [    0.430000] Flash UID signiture check OK.
     
155. [    0.440000] ### of_selftest(): No testcase data in device tree; not running tests
     
156. [    0.450000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
     
157. [    0.460000] Freeing unused kernel memory: 180k freed
     
158. - preinit -
     
159. [    2.670000] JFFS2 notice: (328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
     
160. switching to jffs2
     
161. - init -
     
162. 
     
163. Please press Enter to activate this console. Sun May 27 14:55:00 UTC 2018
     
164. [    5.050000] ag71xx_mdio: probed
     
165. [    5.180000] eth0: Atheros AG71xx at 0xb9000000, irq 4
     
166. [    5.760000] eth0: Atheros AR8327 switch driver attached.
     
167. [    6.060000] WJL: qca_ar8327_hw_init() reg-0x30=0x80000400.2.
     
168. [    7.740000] ar8216_qm_err_check_work_start is called.
     
169. [    7.750000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
     
170. [    7.960000] PPP generic driver version 2.4.2
     
171. [    7.990000] asf: module license 'Proprietary' taints kernel.
     
172. [    8.000000] Disabling lock debugging due to kernel taint
     
173. [    8.360000] ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
     
174. [    8.440000] ath_rate_atheros loaded
     
175. [    8.510000] ath_tx99 loaded
     
176. [    8.660000] ath_dev loaded
     
177. [    9.650000] 2G Caldata02 02 00 02 03 04 05 06 00 00 00 00 00 00 00 00
     
178. [    9.660000] 5G Caldata20 2F 61 BC 01 01 12 34 56 78 90 12 00 00 20 00
     
179. [    9.670000] Restoring Cal data from Flash
     
180. [    9.680000]
     
181. [    9.680000] ART Version : -48.0.0
     
182. [    9.680000] SW Image Version : -48.0.0.0.0
     
183. [    9.690000] Board Revision :  
     
184. [    9.690000] ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125
     
185. [    9.710000] band steering initialized for direct attach hardware
     
186. [    9.710000] ieee80211_bsteering_attach: Band steering initialized
     
187. [    9.730000] Error!!! Check the target image for this feature!
     
188. [    9.740000] ath_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
     
189. [    9.740000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
     
190. [    9.750000]  *********** Cascade *************
     
191. [    9.760000] chip_id 0xa chip_revision 0x0
     
192. [    9.770000]
     
193. [    9.770000]  CLOCK PLL skipped
     
194. [    9.780000]
     
195. [    9.780000]  CE WAR Disabled
     
196. [    9.780000]
     
197. [    9.780000]  Target Version is 1000000
     
198. [    9.790000]
     
199. [    9.790000]  Flash Download Address  c0000
     
200. [    9.790000] ol_transfer_bin_file: flash data file defined
     
201. [    9.800000]
     
202. [    9.800000]  wifi1 NOR FLASH Select OFFSET 1000
     
203. [    9.810000] ol_transfer_bin_file 3935: Download Flash data len 12064
     
204. [    9.810000] Board extended Data download address: 0x0
     
205. [    9.840000]
     
206. [    9.840000]  Board data initialized
     
207. [    9.840000] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
     
208. [    9.850000]
     
209. [    9.850000]  Selecting  OTP binary for CHIP Version 0
     
210. [   10.010000] ol_transfer_bin_file 3770: downloading file 0, Download data len 8856
     
211. [   10.040000]
     
212. [   10.040000]  First OTP send param 8000
     
213. [   12.260000] ol_ath_download_firmware :First OTP download and Execute is good address:0x400 return param 4660
     
214. [   12.270000] ol_ath_download_firmware:##Board Id 1 , CHIP Id 0
     
215. [   12.280000] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
     
216. [   12.350000] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9984/hw.1/boardData_QCA9984_CUS239_5G_v1_001.bin
     
217. [   12.370000] ol_transfer_bin_file 3770: downloading file 3, Download data len 12064
     
218. [   12.380000] Board extended Data download address: 0x0
     
219. [   12.410000] ol_ath_download_firmware: Using 0x1234 for the remainder of init
     
220. [   12.420000]
     
221. [   12.420000]  Selecting  OTP binary for CHIP Version 0
     
222. [   12.440000] ol_transfer_bin_file 3770: downloading file 0, Download data len 8856
     
223. [   12.470000]
     
224. [   12.470000]  [Flash] : Ignore Module param
     
225. [   12.480000]
     
226. [   12.480000]  Second otp download Param 10000
     
227. [   14.710000] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0
     
228. [   14.710000]
     
229. [   14.710000]  Mission mode: Firmware CHIP Version 0
     
230. [   14.740000] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144
     
231. [   14.770000] Swap: bytes_left to copy: fw:16; dma_page:63732
     
232. [   14.770000] Swap: wrong length read:0
     
233. [   14.780000] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 198412 Target address 41b8a8
     
234. [   14.790000] scn=866c0380  target_write_addr=41b8a8 seg_info=872e1510
     
235. [   14.790000] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2
     
236. [   14.800000] bin_filename=QCA9984/hw.1/athwlan.bin swap_filename=/lib/firmware/QCA9984/hw.1/athwlan.codeswap.bin
     
237. [   14.810000] ol_transfer_bin_file: Downloading firmware file: QCA9984/hw.1/athwlan.bin
     
238. [   15.190000] ol_transfer_bin_file 3770: downloading file 1, Download data len 365656
     
239. [   16.360000] ol_ath_attach 6985 host_enable 0 nss_nwifi_offload 0
     
240. [   16.370000] Startup Mode-0 set
     
241. [   16.380000]
     
242. [   16.380000] <=== cfg max peer id 1056 ====>
     
243. [   16.390000] htt_peer_map_timer_init Enter pdev 862d8000 hrtimer 862dc868
     
244. [   16.390000]
     
245. [   16.390000]  htt_alloc_peer_map_mem : Alloc Success : host q vaddr 8787e000 paddr 787e000
     
246. [   16.400000]
     
247. [   16.400000]  htt_alloc_peer_map_mem : Flush Interval Configured to 256 pkts
     
248. [   16.420000] wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event
     
249. [   16.420000] Firmware_Build_Number:5
     
250. [   16.430000] host/RAM_fw Build Ver Mismatch: H:0xD6, F:0x5 !
     
251. [   16.430000]
     
252. [   16.430000]  RES CFG Support wmi_service_bitmap 9778
     
253. [   16.440000]
     
254. [   16.440000]  Sending Ext resource cfg: HOST PLATFORM as 1 and fw_feature_bitmap as 10 to TGT
     
255. [   16.450000] ol_ath_service_ready_event: tt_support: 1
     
256. [   16.460000] Peer Caching Enabled ; num_peers = 530, num_active_peers = 52 num_tids = 104, num_vdevs = 17
     
257. [   16.470000] ol_ath_alloc_host_mem_chunk req_id 2 idx 0 num_units 53 unit_len 256,
     
258. [   16.470000] ol_ath_alloc_host_mem_chunk req_id 3 idx 1 num_units 53 unit_len 1024,
     
259. [   16.480000] ol_ath_alloc_host_mem_chunk req_id 4 idx 2 num_units 53 unit_len 4096,
     
260. [   16.490000] ol_ath_alloc_host_mem_chunk req_id 1 idx 3 num_units 177 unit_len 1456,
     
261. [   16.500000] ol_ath_alloc_host_mem_chunk req_id 1 idx 4 num_units 177 unit_len 1456,
     
262. [   16.510000] ol_ath_alloc_host_mem_chunk req_id 1 idx 5 num_units 177 unit_len 1456,
     
263. [   16.520000] ol_ath_alloc_host_mem_chunk req_id 6 idx 6 num_units 35 unit_len 3072,
     
264. [   16.530000] ol_ath_alloc_host_mem_chunk req_id 7 idx 7 num_units 1 unit_len 12288,
     
265. [   16.540000] ol_ath_alloc_host_mem_chunk req_id 5 idx 8 num_units 132 unit_len 1948,
     
266. [   16.550000] ol_ath_alloc_host_mem_chunk req_id 5 idx 9 num_units 133 unit_len 1948,
     
267. [   16.550000] ol_ath_alloc_host_mem_chunk req_id 5 idx 10 num_units 133 unit_len 1948,
     
268. [   16.560000] ol_ath_alloc_host_mem_chunk req_id 5 idx 11 num_units 133 unit_len 1948,
     
269. [   16.650000] Add VHT80_80 channels: 5210 : 5290
     
270. [   16.650000] Add VHT80_80 channels: 5290 : 5210
     
271. [   16.660000] Add VHT80_80 channels: 5530 : 5610
     
272. [   16.660000] Add VHT80_80 channels: 5610 : 5530
     
273. [   16.670000] Add VHT80_80 channels: 5210 : 5530
     
274. [   16.670000] Add VHT80_80 channels: 5530 : 5210
     
275. [   16.680000] Add VHT80_80 channels: 5210 : 5610
     
276. [   16.680000] Add VHT80_80 channels: 5610 : 5210
     
277. [   16.690000] Add VHT80_80 channels: 5210 : 5690
     
278. [   16.690000] Add VHT80_80 channels: 5690 : 5210
     
279. [   16.700000] Add VHT80_80 channels: 5210 : 5775
     
280. [   16.700000] Add VHT80_80 channels: 5775 : 5210
     
281. [   16.710000] Add VHT80_80 channels: 5290 : 5530
     
282. [   16.710000] Add VHT80_80 channels: 5530 : 5290
     
283. [   16.710000] Add VHT80_80 channels: 5290 : 5610
     
284. [   16.720000] Add VHT80_80 channels: 5610 : 5290
     
285. [   16.720000] Add VHT80_80 channels: 5290 : 5690
     
286. [   16.730000] Add VHT80_80 channels: 5690 : 5290
     
287. [   16.730000] Add VHT80_80 channels: 5290 : 5775
     
288. [   16.740000] Add VHT80_80 channels: 5775 : 5290
     
289. [   16.740000] Add VHT80_80 channels: 5530 : 5690
     
290. [   16.750000] Add VHT80_80 channels: 5690 : 5530
     
291. [   16.750000] Add VHT80_80 channels: 5530 : 5775
     
292. [   16.760000] Add VHT80_80 channels: 5775 : 5530
     
293. [   16.760000] Add VHT80_80 channels: 5610 : 5775
     
294. [   16.770000] Add VHT80_80 channels: 5775 : 5610
     
295. [   16.770000] Add VHT80_80 channels: 5690 : 5775
     
296. [   16.770000] Add VHT80_80 channels: 5775 : 5690
     
297. [   16.790000] ieee80211_bsteering_attach: Band steering initialized
     
298. [   16.790000] rate power table override is only supported for AR98XX
     
299. [   16.800000]
     
300. [   16.800000]  BURSTING enabled by default
     
301. [   16.810000] __ol_ath_attach: needed_headroom reservation 44
     
302. [   16.810000] ol_ath_thermal_mitigation_attach: --
     
303. [   16.960000] GRE over IPv4 demultiplexor driver
     
304. [   16.980000] GRE over IPv4 tunneling driver
     
305. [   17.000000] ip_tables: (C) 2000-2006 Netfilter Core Team
     
306. [   17.180000] xt_time: kernel timezone is -0000
     
307. [   17.210000] NET: Registered protocol family 24
     
308. [   17.290000] p p t p driver version 0.8.5
     
309. [   17.740000] nf_conntrack_rtsp v0.6.21 loading
     
310. [   17.760000] nf_nat_rtsp v0.6.21 loading
     
311. [   17.820000] Registered character driver slp_gpio_chrdev
     
312. wifi-freq
     
313. Command failed: Not found
     
314. [   21.150000] device eth0 entered promiscuous mode
     
315. [   21.180000] device eth0.1 entered promiscuous mode
     
316. [   21.950000] eth0: link up (1000Mbps/Full duplex)
     
317. [   21.950000] br-lan: port 1(eth0.1) entered listening state
     
318. [   21.960000] br-lan: port 1(eth0.1) entered listening state
     
319. [   22.960000] br-lan: port 1(eth0.1) entered disabled state
     
320. Invalid command : st_ht_noamsdu
     
321. Invalid command : obss_rssi_th
     
322. Invalid command : obss_rx_rssi_th
     
323. [   27.870000] siwfreq
     
324. set encryption with driver
     
325. [   27.960000] set IEEE80211_IOC_WPA to WPA and RSN
     
326. [   27.970000] set Key Mgmt Algs to PSK!
     
327. [   27.970000] set cipher as AES
     
328. [   27.980000] set psksecret Abcde12345, length = 10
     
329. [   27.990000] set rekey period 86400
     
330. Interface doesn't accept private ioctl...
     
331. stafwd (8BE0): Invalid argument
     
332. [   28.310000] siwfreq
     
333. set encryption with driver
     
334. [   28.450000] set IEEE80211_IOC_WPA to WPA and RSN
     
335. [   28.460000] set Key Mgmt Algs to PSK!
     
336. [   28.470000] set cipher as AES
     
337. [   28.480000] set psksecret 987654321, length = 9
     
338. [   28.490000] set rekey period 86400
     
339. Interface doesn't accept private ioctl...
     
340. stafwd (8BE0): Invalid argument
     
341. [   29.810000] 8021q: adding VLAN 0 to HW filter on device ath0
     
342. [   29.820000] device ath0 entered promiscuous mode
     
343. [   29.820000] br-lan: port 2(ath0) entered listening state
     
344. [   29.830000] br-lan: port 2(ath0) entered listening state
     
345. [   29.910000] device ath2 entered promiscuous mode
     
346. [   29.920000] device wdscli0 entered promiscuous mode
     
347. [   30.220000] Enabling TX checksum bit for the vap ath1 features 4000
     
348. [   30.230000] Enabling SG bit for the vap ath1 features 4000
     
349. [   30.230000] Enabling SG bit for the vap ath1 features 4000
     
350. [   30.240000] Enabling TSO bit for the vap ath1 features 4000
     
351. [   30.240000] Enabling LRO bit for the vap ath1 features 4000
     
352. [   30.280000] siwfreq
     
353. set encryption with driver
     
354. [   30.370000] set IEEE80211_IOC_WPA to WPA and RSN
     
355. [   30.380000] set Key Mgmt Algs to PSK!
     
356. [   30.390000] set cipher as AES
     
357. [   30.390000] set psksecret Abcde12345, length = 10
     
358. [   30.400000] set rekey period 86400
     
359. [   30.410000] ME Pool succesfully initialized vaddr - 85560000 paddr - 0
     
360. [   30.410000] num_elems = 1424 buf_size - 64 pool_size = 102528
     
361. [   30.430000] Enable MCAST_TO_UCAST
     
362. Interface doesn't accept private ioctl...
     
363. stafwd (8BE0): Invalid argument
     
364. [   30.520000] su bfee 1 mu bfee 0 su bfer 1 mu bfer 1 impl bf 0 sounding dim 3
     
365. [   30.560000] Enabling TX checksum bit for the vap wdscli1 features 4000
     
366. [   30.560000] Enabling SG bit for the vap wdscli1 features 4000
     
367. [   30.570000] Enabling SG bit for the vap wdscli1 features 4000
     
368. [   30.570000] Enabling TSO bit for the vap wdscli1 features 4000
     
369. [   30.580000] Enabling LRO bit for the vap wdscli1 features 4000
     
370. [   30.750000] Enabling TX checksum bit for the vap ath3 features 4000
     
371. [   30.760000] Enabling SG bit for the vap ath3 features 4000
     
372. [   30.760000] Enabling SG bit for the vap ath3 features 4000
     
373. [   30.770000] Enabling TSO bit for the vap ath3 features 4000
     
374. [   30.770000] Enabling LRO bit for the vap ath3 features 4000
     
375. [   30.820000] siwfreq
     
376. Interface doesn't accept private ioctl...
     
377. stafwd (8BE0): Invalid argument
     
378. [   31.830000] br-lan: port 2(ath0) entered learning state
     
379. [   32.000000] 8021q: adding VLAN 0 to HW filter on device ath1
     
380. [   32.000000] device ath1 entered promiscuous mode
     
381. [   32.010000] br-lan: port 5(ath1) entered listening state
     
382. [   32.010000] br-lan: port 5(ath1) entered listening state
     
383. [   32.090000] device ath3 entered promiscuous mode
     
384. [   32.100000] device wdscli1 entered promiscuous mode
     
385. [   32.710000] [stat]Lan ip: C0A80001, Lan mask: FFFFFF00
     
386. [   32.710000] [stat]wan dev name: pppoe-internet
     
387. [   33.030000] ----IGMP init begin------
     
388. [   33.030000] wan_dev_index = 255 lan_dev_name=br-lan wan_dev_name=eth0.2
     
389. [   33.040000] ----IGMP has been loaded------
     
390. [   33.530000] wmi_unified_vdev_down_send for vap 0 (86770000)
     
391. [   33.540000] wmi_unified_vdev_start_send for vap 0 (86770000)
     
392. [   33.540000] ol_ath_vap_set_param: Now supported MGMT RATE is 6000(kbps) and rate code: 0x3
     
393. [   33.780000] ol_vdev_start_resp_ev for vap 0 (86770000)
     
394. [   33.790000] ol_ath_wmm_update:
     
395. [   34.000000] su bfee 1 mu bfee 0 su bfer 1 mu bfer 1 impl bf 0 sounding dim 3
     
396. [   34.010000] br-lan: topology change detected, propagating
     
397. [   34.010000] br-lan: port 2(ath0) entered forwarding state
     
398. [   34.020000] br-lan: port 5(ath1) entered learning state
     
399. wlan has already started in etc/init.d/network script.
     
400. [   36.020000] br-lan: topology change detected, propagating
     
401. [   36.020000] br-lan: port 5(ath1) entered forwarding state
     
402. Loading redirects
     
403. Loading dmz
     
404. Loading forbidhost
     
405. Loading localmanage
     
406. Loading hostctrl
     
407. Loading includes
     
408. RTNETLINK answers: No such file or directory
     
409. RTNETLINK answers: No such file or directory
     
410. RTNETLINK answers: No such file or directory
     
411. [   40.200000] HTB: quantum of class 10001 is big. Consider r2q change.
     
412. [   40.220000] HTB: quantum of class 20001 is big. Consider r2q change.
     
413. [   40.230000] HTB: quantum of class 10199 is big. Consider r2q change.
     
414. [   40.250000] HTB: quantum of class 20399 is big. Consider r2q change.
     
415. [   40.280000] HTB: quantum of class 20301 is small. Consider r2q change.
     
416. uci: Entry not found (guest_network.@guest_rule_2g[0])
     
417. uci: Entry not found (guest_network.@guest_rule_5g[0])
     
418. not ap mode, ignored.
     
419. not ap mode, ignored.
     
420. uci: Entry not found (guest_network.@guest_rule_2g[0])
     
421. uci: Entry not found (guest_network.@guest_rule_5g[0])
     
422. [   43.490000] br-lan: port 3(ath2) entered listening state
     
423. [   43.490000] br-lan: port 3(ath2) entered listening state
     
424. [   43.500000] 8021q: adding VLAN 0 to HW filter on device ath2
     
425. [   43.520000] br-lan: port 3(ath2) entered disabled state
     
426. [   43.610000] SFE IPv4 init
     
427. [   43.620000] set IEEE80211_IOC_WPA to WPA and RSN
     
428. [   43.640000] set Key Mgmt Algs to PSK!
     
429. [   43.700000] set cipher as AES
     
430. [   43.710000] set psksecret 987654321, length = 9
     
431. [   43.720000] set rekey period 86400
     
432. [   43.740000] SFE Fast-Classifier init
     
433. [   44.010000] wmi_unified_vdev_start_send for vap 2 (86770000)
     
434. [   44.010000] ol_ath_vap_set_param: Now supported MGMT RATE is 6000(kbps) and rate code: 0x3
     
435. [   44.020000] ol_vdev_start_resp_ev for vap 2 (86770000)
     
436. [   44.030000] su bfee 1 mu bfee 0 su bfer 1 mu bfer 1 impl bf 0 sounding dim 3
     
437. [   44.030000] br-lan: port 6(ath3) entered listening state
     
438. [   44.040000] br-lan: port 6(ath3) entered listening state
     
439. [   44.050000] 8021q: adding VLAN 0 to HW filter on device ath3
     
440. [   44.060000] wmi_unified_vdev_down_send for vap 2 (86770000)
     
441. [   44.090000] br-lan: port 6(ath3) entered disabled state
     

复制代码

全部支持的命令:

1. ath> help   
   
2. ?       - alias for 'help'
   
3. bootm   - boot application image from memory
   
4. cp      - memory copy
   
5. erase   - erase FLASH memory
   
6. help    - print online help
   
7. httpd   - start www server for firmware recovery
   
8. jmpaddr   - jump to a address
   
9. mct   - simple RAM test
   
10. md      - memory display
    
11. mm      - memory modify (auto-incrementing)
    
12. mtest   - simple RAM test
    
13. mw      - memory write (fill)
    
14. nm      - memory modify (constant address)
    
15. printenv- print environment variables
    
16. progmac - Set ethernet MAC addresses
    
17. progmac2 - Set ethernet MAC addresses
    
18. reset   - Perform RESET of the CPU
    
19. setenv  - set environment variables
    
20. tftpboot- boot image via network using TFTP protocol
    
21. version - print monitor version
    

复制代码

系统环境信息：

1. ath> printenv
   
2. bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:32k(u-boot1),32k(u-boot2),3008k(rootfs),896k(uImage),64k(mib0),64k(ART)
   
3. bootcmd=jmpaddr 0x9f030000
   
4. bootdelay=1
   
5. baudrate=115200
   
6. ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
   
7. ipaddr=192.168.1.1
   
8. serverip=192.168.1.10
   
9. loadaddr=0x82000000
   
10. dir=
    
11. lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
    
12. lf=tftp 0x80060000 ${dir}ap152${bc}-jffs2&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
    
13. lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f300000 +$filesize&&cp.b $fileaddr 0x9f300000 $filesize
    
14. stdin=serial
    
15. stdout=serial
    
16. stderr=serial
    
17. ethact=eth0
    
18. 
    
19. Environment size: 702/4092 bytes
    

复制代码

官方网站：
http://www.tp-link.com.cn/product_504.html

upsangel全球首拆：
https://upsangel.com/router-2/tplink-wdr8500-crack-n-test/

wikidevi：
https://wikidevi.com/wiki/TP-LINK_TL-WDR8500_v1.x

aini50563

帮顶，tp纯闭源软件，没搞头

蚩尤丿邪魅

还有散热板赚了

wuxeon

从2014的wdr7500到现在的wdr8500，tp除了坑钱毫无升级。

mht

wuxeon 发表于 2018-6-30 14:07
从2014的wdr7500到现在的wdr8500，tp除了坑钱毫无升级。

也不能说毫无升级，天线不是越来越多了吗。

trainer520

楼主您好，我手里有tp8500 V1.0  ，我是纯小白，看了您的几篇帖子，看到TTL接线后，关于连接电脑刷入Breed的后续操作没看明白，请问能在哪里学习到刷入Breed，谢谢您

mht

trainer520 发表于 2019-9-14 21:37
楼主您好，我手里有tp8500 V1.0  ，我是纯小白，看了您的几篇帖子，看到TTL接线后，关于连接电脑刷入Breed ...

纯小白不建议玩呢，刷机有风险，很可能会收获一只砖头的。
可以接受风险的话可以继续：

刷Breed说明可以参考H大的贴子，找TTL刷机说明
https://right.com.cn/forum/forum ... p;page=1#pid1011303

Breed使用breed-qca956x-uart_rx18_tx22-reset1.bin
(开机按reset键进Breed控制台)

第二步:
flash erase 0 0x1b800

第三步:
flash write 0 <内存地址> <数据大小>

重启后，进Breed控制台，备份完整的编程器固件(8M)。（如果可以的话网盘共享下，我取一下原厂的art）

david_x2014

请问dalao还在搞这个路由么，之前19年末我入手了这个8500的v1版本，现在是原厂固件，但是用着很不习惯，想刷个openwrt，有哪个靠谱稳定的版本推荐吗？
顺便问问它的flash是不是跟电脑一样的那种sop8那种针脚呢？是的话我就可以直接编程器+烧录夹把它的固件读出来了
还有就是问一下breed可不可以直接用编程器刷呢

mht

david_x2014 发表于 2020-2-18 19:27
请问dalao还在搞这个路由么，之前19年末我入手了这个8500的v1版本，现在是原厂固件，但是用着很不习惯，想 ...

没找到稳定版本的固件，我的固件据说速度不如原来的。有兴趣你可以自已试下。

flash在散热片、屏蔽罩下，就上图左上角那个。型号:Winbond W25Q64FVSIG
你可以试下能不能直接用烧录夹。做其他操作前请先做完整备份，刷完Breed后如果没有完整固件是没办法再刷回原厂版本的。
Breed肯定可以直接用编程器刷，直接放最前面就好了。

固件什么的麻烦自己去扒我的这个贴子吧。
https://www.right.com.cn/forum/thread-328619-1-1.html
百度云里有前几天编译的固件和 art / breed 及 源代码。

david_x2014

感谢楼主的支持。。。
不过路由已经被我刷挂了。。。
这个路由用烧录夹它会直接开机，开机是刷不了的
当时开机我以为是接反了，结果一反接就不能再开机了。。。

shana0914

mht 发表于 2020-2-18 20:17
没找到稳定版本的固件，我的固件据说速度不如原来的。有兴趣你可以自已试下。

flash在散热片、屏蔽罩 ...

5G有没有160mhz  信号咋样

dongzhi567

shana0914 发表于 2020-3-2 13:29
5G有没有160mhz  信号咋样

5g只有40mhz，信号偏弱，但很稳定

shana0914

dongzhi567 发表于 2020-3-13 13:54
5g只有40mhz，信号偏弱，但很稳定

还是用用官方了 官方信号好点

295277067

ath10k-firmware-qca9984_20200122-1 这是新驱动吗   能编译个支持160mhz的固件吗

mht

295277067 发表于 2020-3-16 21:21
ath10k-firmware-qca9984_20200122-1 这是新驱动吗   能编译个支持160mhz的固件吗

firmware不也是ipk文件吗，能用opkg更新吗？或者要先卸载掉老的？帮忙试下？
http://downloads.openwrt.org/sna ... 2-1_mipsel_24kc.ipk