(Copied from my own topic about this:)

FIXED! The answer turned out to be 0x60000
(thank you to Matti (snk) for the answer!)

Here is a complete tutorial for debricking a TP-LINK TL-WDR4900 v1 using serial. This is partly copied from the Wiki page (although the Wiki is also sometimes wrong!), and then completed. Maybe somebody can add this to the wiki? (honestly, I don't know how to)

Note: I am NOT responsible for you bricking your router further by using these instructions. All I know is that the Wiki instructions are incorrect and incomplete and that this unbricked my router.

---

Pre-requisits

* Serial RS232 connected from your machine to TL-WDR4900 & a terminal program (e.g. minicom, screen, putty) set to Speed (baud) 115200, Data bits 8 and Stop bits 1 (8N1), Flow control off. 3.3v.
* Copy a working & full OpenWrt firmware image into your TFTP server folder (e.g: openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-factory.bin).
* A TFTP server started on your local machine on LAN address 192.168.1.104.
* Connect your LAN-port to one of the routers LAN ports.

Flashing Procedure

* Router should be unplugged (power off), your serial line connected, terminal open and TFTP server installed not yet running.
* Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into openwrt.bin (to save some typing within the flash procedure).
* First goal is to get the command prompt from the U-Boot bootloader on your router.
* Plug in your router and be ready to type "vl" (NOTE: this is "v" and a the lowercase L, not a 1 (one)) just before you see the line Autobooting in 1 seconds:

In case you failed the right timing just restart the router and try again. Try until the prompt appears (until you're able to type commands):

1. Start the uBoot's TFTP client to download the image from your local machine by typing: tftpboot 0x1000000 openwrt.bin
(this is of course assuming the file on your TFTP server is called openwrt.bin)

The last line needs to show a size of f80000 hex, otherwise your image is unsuitable (In that case: do not attempt to flash!).

2. To select the SPI flash memory type: sf probe 0

3. Now we need to erase parts of the flash memory to be able to copy your fresh loaded firmware into it, just type in the prompt: sf erase 0x60000 0xf80000

4. Now just copy the image to the right place by typing: sf write 0x1000000 0x60000 0xf80000

5. Your TP-LINK TL-WDR4900 should now be working again. Simply reboot it by typing reset:

(Last edited by Boompje123 on 17 Jun 2013, 21:44)

---------

Also, for the sake of completeness, based on the above (although slightly wrong), here is how to return to stock firmware.
(Might also be useful to have on the Wiki)

Note: I am NOT responsible for you bricking your router by using these instructions. I used this method twice today on my v1 and it worked perfectly both times. That's all I know.

1. Download a stock firmware without BOOT in the filename. At the time of writing I believe the BETA firmware is the only available without BOOT. Available here: http://everbest.ftpserver.biz/TP-Link/T … 20Firmware

2. SCP it to the /tmp folder of your TP-LINK TL-WDR4900 (or use wget in console to get it there).

3. (optional) for the sake of simplicity, rename it stock.bin

4. SSH or telnet (console) into your router.

5. Browse to /tmp with: cd /tmp

6. Flash the firmware by typing: mtd -r write stock.bin firmware
(replace stock.bin with the filename of the file you put in /tmp)

7. Wait for it to reboot and you're done!

(Last edited by Boompje123 on 17 Jun 2013, 21:40)

I have updated wiki with your notes on "Written Flash Procedure". Thank you! Please, confirm I have not missed something.

My anti-virus do not like http://everbest.ftpserver.biz/TP-Link/T … 20Firmware direction. Could you check if we can use original firmware from this site - http://www.tp-link.com/en/support/downl … version=V1 ?

P.S. Please, consider registering at OpenWRT wiki to be able create/edit pages. It is a separate registration. Credential you have for forum are not working for wiki. Visit http://wiki.openwrt.org/start?do=register and register yourself.
Then learn a bit about how to use wiki - http://wiki.openwrt.org/meta/start.

(Last edited by otlabs on 17 Jun 2013, 23:15)

Thank you! Yep, they're fine although a little less specific then I posted them, but that's not a big deal; all the steps are there!

I don't know what's wrong with that website/firmware, my antivirus doesn't report anything. I'm not 100% sure but I imaging you cannot use a firmware WITH BOOT in the name (with bootloader), so you would have to strip that off. However, I have never done that myself and honestly, it's simply easier to grab that BETA firmware.

Anyways.. thanks for it all!

Emile

Thank you both otlabs and Boompje123!!!

So.. new question!

Does anyone know how to enable channel 12 and 13 on this device?
I live in NL, so it's completely legal to use them here

I've always used this for my 1043nd:
http://luci.subsignal.org/~jow/reghack/

However, that doesn't work on the WDR4900

You might try searching regarding enabling that during own compilation of trunk. I THINK that is what I read in passing....  (age, memory, you know

Did you also choose NL in "/etc/config/wireless" ?

kirschwasser: fiddling with country codes in /e/c/wireless will not help to enable cahnnel 12 and 13 in ap mode.

I am working on porting it to PPC as we speak and I ordered myself a WDR4900 to test, however if you're willing to give me remote access I can probably finish it today or tomorrow. If you want, contact me at jow - at - openwrt.org

Sorry, not running OpenWRT on my wdr4900 right now - using stock. It's running as a WDS client (master being channel 13), hence I need channel 13 to use it.

I might go back to openwrt in the next few days.. If I do, I'll shoot you a message

Hope you get this figured out. Would be wonderful!

Emile

Ok, in any case you can try the binary here: http://luci.subsignal.org/~jow/reghack/reghack.ppc.elf

I see you have updated the instructions file as well.

I'll flash openwrt again and report back.

Thank you!

Worked perfectly! Thank you so much! Now I'm actually able to use openwrt on this router

One tiny thing.. The instructions should be:

cd /tmp/
wget http://luci.subsignal.org/~jow/reghack/reghack.ppc.elf
chmod +x reghack.ppc.elf
cp /lib/modules/*/ath.ko .
cp /lib/modules/*/cfg80211.ko .
./reghack.ppc.elf ath.ko
./reghack.ppc.elf cfg80211.ko
mv *.ko /lib/modules/*/
reboot

Mm strange.. Now that I'm able to use WDS with this router.. if I add a second wifi (AP) I can only get 65 mbit (wireless g) on that ssid

Anyone know how come?

11g is 54Mbps max, 65 is single stream 11n

Ah right of course! So does that explain why I'm only able to get that speed (on clients) with wds enabled?

Thank you, I fixed the readme. Would you mind to pm me the output of "iw list" after running reghack?
I want to confirm that it works correctly since I was not able to test it on real hardware yet.

Done! Sent it through forum e-mail
(not sure if that's the same as pm. Sorry about that)

Don't worry :-)

Updated the wiki with a bunch of stuff today

Please contribute if you can

Hi All,

With the wiki back to original firmware i have bricked my WDR4900...

I have followed the instructions found here to unbrick my 1.3 Version of tis router but it's not working for me.

I type in "vl" before and after "Autobooting in 1 seconds" tried it really nearby 100 times nothing helps to get tftboot possibility to get the stock firmware back...

After router boots up i can login but don't have the right credentials: root/5up don't work for me here.

Any help is appreciated

The whole uboot log is here:

U-Boot 2010.12-svn18602 (Mar 20 2013 - 10:42:31)

CPU:   P1014, Version: 1.0, (0x80f10110)
Core:  E500, Version: 5.1, (0x80212151)
Clock Configuration:
       CPU0:800  MHz,
       CCB:400  MHz,
       DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100  MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
Board: P1014RDB
SPI:   ready
DRAM:  128 MiB
L2:    256 KB enabled
Using default environment

PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000
  01:00.0     - 168c:abcd - Network controller
PCIe1: Bus 00 - 01
PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000
  03:00.0     - 168c:0033 - Network controller
PCIe2: Bus 02 - 03
In:    serial
Out:   serial
Err:   serial
Net:   initialization for Atheros AR8327/AR8328
AR8327/AR8328 v1.1 is found!
eTSEC1
Autobooting in 1 seconds
SF: Detected S25FL128S_64K with page size 256, total 16 MiB
16384 KiB S25FL128S_64K at 0:0 is now current device
SPI flash read successful
SPI flash read successful
## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   Linux-2.6.35
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2178245 Bytes = 2.1 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 03000000
   Booting using the fdt blob at 0x3000000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using P1010 RDB machine description
Memory CAM mapping: 64/64 Mb, residual: 0Mb
Linux version 2.6.35 (root@localhost.localdomain) (gcc version 4.5.1 (Sourcery G++ Lite 2010.09-55) ) #2 Mon Mar 4 16:55:10 CST 2013
bootconsole [udbg0] enabled
setup_arch: bootmem
p1010_rdb_setup_arch()
Found FSL PCI host bridge at 0x00000000ffe09000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe09000  ranges:
MEM 0x00000000a0000000..0x00000000bfffffff -> 0x00000000a0000000
  IO 0x00000000ffc10000..0x00000000ffc1ffff -> 0x0000000000000000
/pcie@ffe09000: PCICSRBAR @ 0xfff00000
Found FSL PCI host bridge at 0x00000000ffe0a000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe0a000  ranges:
MEM 0x0000000080000000..0x000000009fffffff -> 0x0000000080000000
  IO 0x00000000ffc00000..0x00000000ffc0ffff -> 0x0000000000000000
/pcie@ffe0a000: PCICSRBAR @ 0xfff00000
P1010 RDB board from Freescale Semiconductor
arch: exit
Zone PFN ranges:
  DMA      0x00000000 -> 0x00008000
  Normal   empty
  HighMem  empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: root=/dev/mtdblock3 rw console=ttyS0,115200 init=/sbin/init cache-sram-size=0x10000 cache-sram-offset=0xfff00000
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 125444k/131072k available (4088k kernel code, 5628k reserved, 216k data, 108k bss, 140k init)
Kernel virtual memory layout:
  * 0xfffcf000..0xfffff000  : fixmap
  * 0xff800000..0xffc00000  : highmem PTEs
  * 0xff7d8000..0xff800000  : early ioremap
  * 0xc9000000..0xff7d8000  : vmalloc & ioremap
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
    RCU-based detection of stalled CPUs is disabled.
    Verbose stalled-CPUs detection is disabled.
NR_IRQS:512
mpic: Setting up MPIC " OpenPIC  " version 1.2 at ffe40000, max 1 CPUs
mpic: ISU size: 256, shift: 8, mask: ff
mpic: Initializing for 256 sources
clocksource: timebase mult[5000000] shift[22] registered
Console: colour dummy device 80x25
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
xor: measuring software checksum speed
   8regs     :   981.000 MB/sec
   8regs_prefetch:   845.000 MB/sec
   32regs    :   977.000 MB/sec
   32regs_prefetch:   869.000 MB/sec
xor: using function: 8regs (981.000 MB/sec)
NET: Registered protocol family 16
             
GPIO_IER:0x0; GPIO_IMR:0x0;GPIO_ICR:0x0
PCI: Probing PCI hardware
pci 0000:00:00.0: ignoring class b20 (doesn't match header type 01)
pci 0000:00:00.0: PCI bridge to [bus 01-ff]
pci 0001:02:00.0: ignoring class b20 (doesn't match header type 01)
pci 0001:02:00.0: PCI bridge to [bus 03-ff]
pci 0000:01:00.0: BAR 6: assigned [mem 0xa0020000-0xa002ffff pref]
pci 0000:00:00.0: not setting up bridge for bus 0000:01
pci 0001:03:00.0: BAR 6: assigned [mem 0x80020000-0x8002ffff pref]
pci 0001:02:00.0: not setting up bridge for bus 0001:03
bio: create slab <bio-0> at 0
vgaarb: loaded
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
raid6: int32x1    115 MB/s
raid6: int32x2    200 MB/s
raid6: int32x4    285 MB/s
raid6: int32x8    239 MB/s
raid6: using algorithm int32x4 (285 MB/s)
Freescale Elo / Elo Plus DMA driver
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
fsl-ifc ffe1e000.ifc: Freescale Integrated Flash Controller
fsl-l2ctlr ffe20000.l2-cache-controller: [base:0xfff00000, size:0x10000] configured and loaded
fsl-elo-dma ffe21300.dma: #0 (fsl,eloplus-dma-channel), irq 20
fsl-elo-dma ffe21300.dma: #1 (fsl,eloplus-dma-channel), irq 21
fsl-elo-dma ffe21300.dma: #2 (fsl,eloplus-dma-channel), irq 22
fsl-elo-dma ffe21300.dma: #3 (fsl,eloplus-dma-channel), irq 23
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 245
alg: No test for stdrng (krng)
async_tx: api initialized (async)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Generic non-volatile memory driver v1.1
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0xffe04500 (irq = 42) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0xffe04600 (irq = 42) is a 16550A
brd: module loaded
loop: module loaded
of-flash ee000000.nor: do_map_probe() failed
fsl-espi ffe07000.spi: Freescale eSPI Controller driver at 0xc90a2000 (irq = 59)
fsl_m25p80 spi32766.0: s25sl128s (16384 Kbytes)
Creating 6 MTD partitions on "SPIFLASH0":
0x000000000000-0x000000050000 : "SPI (RO) U-Boot Image"
ftl_cs: FTL header not found.
0x000000050000-0x000000060000 : "SPI (RO) DTB Image"
ftl_cs: FTL header not found.
0x000000060000-0x000000300000 : "SPI (RO) Linux Kernel Image"
ftl_cs: FTL header not found.
0x000000300000-0x000000fe0000 : "SPI (RO) Compressed RFS Image"
ftl_cs: FTL header not found.
0x000000fe0000-0x000000ff0000 : "SPI (RW) UC Image"
ftl_cs: FTL header not found.
0x000000ff0000-0x000001000000 : "SPI (RW) Caldata Image"
ftl_cs: FTL header not found.
fsl-espi ffe07000.spi: chipselect 0 already in use
spi_master spi32766: spi_device register error /soc@ffe00000/spi@7000/legerity@0
Fixed MDIO Bus: probed
e1000e: Intel(R) PRO/1000 Network Driver - 1.0.2-k4
e1000e: Copyright (c) 1999 - 2009 Intel Corporation.
/proc/ptp_1588 created

IEEE1588: ptp-timer devicepresent in the system
IEEE1588: ptp-timer initialized
eth0: Gianfar Ethernet Controller Version 1.4-skbr1.1.5, 00:04:9f:ef:01:01
eth0: Running with NAPI enabled
eth0: RX BD ring size for Q[0]: 128
eth0: RX BD ring size for Q[1]: 128
eth0: RX BD ring size for Q[2]: 128
eth0: RX BD ring size for Q[3]: 128
eth0: RX BD ring size for Q[4]: 128
eth0: RX BD ring size for Q[5]: 128
eth0: RX BD ring size for Q[6]: 128
eth0: RX BD ring size for Q[7]: 128
eth0: TX BD ring size for Q[0]: 128
eth0: TX BD ring size for Q[1]: 128
eth0: TX BD ring size for Q[2]: 128
eth0: TX BD ring size for Q[3]: 128
eth0: TX BD ring size for Q[4]: 128
eth0: TX BD ring size for Q[5]: 128
eth0: TX BD ring size for Q[6]: 128
eth0: TX BD ring size for Q[7]: 128
Freescale PowerQUICC MII Bus: probed
PPP generic driver version 2.4.2
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
fsl-ehci fsl-ehci.0: Freescale On-Chip EHCI Host Controller
fsl-ehci fsl-ehci.0: new USB bus registered, assigned bus number 1
fsl-ehci fsl-ehci.0: irq 28, io base 0xffe22000
fsl-ehci fsl-ehci.0: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: raid10 personality registered for level 10
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
md: multipath personality registered for level -4
device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.17.0-ioctl (2010-03-05) initialised: dm-devel@redhat.com
device-mapper: multipath: version 1.1.1 loaded
device-mapper: multipath round-robin: version 1.0.0 loaded
device-mapper: multipath queue-length: version 0.1.0 loaded
device-mapper: dm-log-userspace: version 1.0.0 loaded
of_platform ffe01000.jr: failed to flush job queue 0
of_platform ffe02000.jr: failed to flush job queue 1
of_platform ffe03000.jr: failed to flush job queue 2
of_platform ffe04000.jr: failed to flush job queue 3
caam ffe30000.crypto: device ID = 0x0a14010000000000
caam ffe30000.crypto: job queues = 4
caam ffe30000.crypto: algapi error in job queue registration: -19
nf_conntrack version 0.5.0 (1960 buckets, 5120 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
Ooops, why the devices couldn't been initialed?
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
md: Waiting for all devices to be available before autodetect
md: If you don't use raid, use raid=noautodetect
md: Autodetecting RAID arrays.
md: Scanned 0 and added 0 devices.
md: autorun ...
md: ... autorun DONE.
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 140k init
usb 1-1: new high speed USB device using fsl-ehci and address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected

init started:  BusyBox v1.01 (2013.03.04-08:59+0000) multi-call binary
mount: Mounting devpts on /dev/pts failed: No such file or directory
This Board use 2.6.35
qcaswphy_driver: module license 'BSD' taints kernel.
Disabling lock debugging due to kernel taint
insmod: cannot open module `/lib/modules/2.6.35/kernel/x_tables.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.35/kernel/xt_tcpudp.ko': No such file or directory
xt_time: kernel timezone is -0000
insmod: cannot open module `/lib/modules/2.6.35/kernel/nf_conntrack.ko': No such file or directory
ip_tables: (C) 2000-2006 Netfilter Core Team
PPTP driver version 0.8.3
Processing /etc/rc.local
get hostname
mdev: not found
Hello, nat module!
thread: napt_ct_scan create success pid:988
netlink_kernel_create succeeded at tp_rule_nl_prot: [29]
napt_ct_scan_thread: time: 4
read mac addr sucessd: f81a675a9a9f
isis_ip_intf_entry_add id[0] for vid[1]
isis_ip_intf_entry_add id[1] for vid[2]
ACL(Index 0) For packet From Wan Port and TTL is zero
ACL is not yet enabled. Enabling...
ACL Rule(Index 2) For UDP with Zero Checksum

######## S17 SSDK init succeeded! ########
athrs17_vlan_config finished
athrs17_init:done
athrs17_config_aneg
PHYID: 0
PHYID: 1
PHYID: 2
PHYID: 3
PHYID: 4
Ooops, why the devices couldn't been initialed?
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0.1) entering learning state
br0: port 1(eth0.1) entering learning state
hnat_enable_write 542: hnat_control:value = 1

++++ athrs17_igmp_setup once
s17 vlan full
+++ athrs17_igmp_vtable_create failed
---- set vlan table error
device eth0 left promiscuous mode
br0: port 1(eth0.1) entering learning state

tp-link login: device eth0 entered promiscuous mode
br0: port 1(eth0.1) entering forwarding state
br0: port 1(eth0.1) entering forwarding state
isis_ip_intf_entry_add id[1] for vid[2]
PHY: mdio@ffe24000:00 - Link is Up - 1000/Full
ACL Rule(Index 1) For Packet From WAN to LAN Port And DIP is in lan net
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 9.2.0_U10.1020 (Atheros/multi-bss)
cal_buf:cbc6c1a4
cal_buf[0]:cbc6c1a4
CalAddr[0]:cbc6c1a4
CalAddr[1]:cbc701a4
===>pdev->bus->number:1
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
Oops: Exception in kernel mode, sig: 11 [#1]
P1010 RDB
last sysfs file:
Modules linked in: umac(+) ath_dev(P) ath_dfs(P) ath_rate_atheros(P) ath_hal(P) asf(P) adf nf_nat_rtsp nf_conntrack_rtsp nf_nat_h323 nf_nat_tftp nf_conntrack_tftp nf_nat_ftp nf_conntrack_ftp nf_nat_pptp nf_conntrack_pptp tp_domain(P) fsl_m25p80_flash_ioctl(P) statistics(P) pptp br_filter(P) ts_kmp cls_fw cls_basic sch_sfq sch_prio sch_htb ipt_TRIGGER ipt_REJECT ipt_REDIRECT ipt_MASQUERADE iptable_raw iptable_nat iptable_filter ip_tables nf_nat_proto_gre nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state xt_conntrack nf_conntrack_h323 nf_conntrack_proto_gre ipt_multiurl xt_time xt_string xt_multiport xt_mac xt_iprange xt_comment xt_TCPMSS xt_mark qcaswphy_driver(P)
NIP: cb9b79c4 LR: cb9b7604 CTR: cb9dd8fc
REGS: c7115a6c TRAP: 0700   Tainted: P             (2.6.35)
MSR: 00029000 <EE,ME,CE>  CR: 44284488  XER: 20000000
TASK = c78ce480[1298] 'insmod' THREAD: c7114000
GPR00: 000017d4 c7115b1c c78ce480 00000000 fffffcb0 c71159ba cba032b0 000017d4
GPR08: 00000002 c7be0000 cba01c90 00000001 84000422 1004648c 0000003a c7115be4
GPR16: 00000000 cba374f4 00000010 c7115a58 c7bbd540 cba01c38 00000000 cba40000
GPR24: cba3e3a8 00000000 c7112553 cba02490 cba01c28 00000000 cba032b0 c7be0000
NIP [cb9b79c4] ath_hal_init_channels+0x8e0/0x1564 [ath_hal]
LR [cb9b7604] ath_hal_init_channels+0x520/0x1564 [ath_hal]
Call Trace:
Instruction dump:
2f870800 38600000 41871078 3880fcb0 8a41008a 3b7c0868 3b41cba3 3a6100a8
3821016c 419d748c 7fc6f378 7c070378 <4fff9a52> 4800006c a1180014 2f880000
---[ end trace 4443740e13f85c30 ]---
fuse init (API version 7.14)
SCSI subsystem initialized

You have to type vl (lowercase V and lowercase L) slightly before the "Autobooting in 1 seconds"
No need to press enter I think. Just the vl

You're 100% sure both TX and RX work, right? Just wanna make sure that both serial wires are connected properly
eg. you can type something into the login/password fields that are asked for?

I can type the username and password after booting up so i think it's the right connection of tx and rx.

Ok, then I'm guessing you're not timing it right

again, it has to be before "Autobooting in 1 seconds"
even before you see it

I think the booting pauses briefly when you see:
AR8327/AR8328 v1.1 is found!
eTSEC1

That's when you should type it