TP-Link WR1043ND — serial console and OpenWRT

I recently obtained a TP-Link TL-WR1043ND — a WiFi access-point and 5-port router capable of 802.11n @ 300Mbps. The device has a five 1Gbps Ethernet ports (4 LAN, 1 WAN) and can be flashed to run the linux-based OpenWRT. Most importantly, it is cheap — roughly $75 AUD at local places like Centrecom. This post discusses adding a connection to the serial port in preparation for further experiments, and an initial upgrade from factory firmware to OpenWRT.

Nice box, lots of ports, 400Mhz CPU, 8MB Flash, 32MB RAM, and cheap. The factory OS is a customised Linux, but you can re-flash it with OpenWRT from the factory firmware’s GUI. What’s not to love?

Adding serial port access

If you want to do low-level re-flashing of the unit via the uBoot console, you need serial port access. The following pictures show the WR1043ND’s TTL-level serial interface (a 4-pin header mount point on the PCB, near a point labelled “P1”) and my home-brew external serial port. I glued a 3-pin header to the side of the WAN port and cut out part of the rear panel to provide access for a 3-pin plug. Inside the box I used a short piece of shielded 2-pair cable (with shield as GND) to bring the RX, TX and GND connections to the 3-pin header.

The PCB’s serial port pins are wired as follows (the labels “x”,”y” and “z” are my — they do not appear on the PCB):

	P1	VCC
	x	GND
	y	RX	(TTL signal in from other device)
	z	TX	(TTL signal out to other device)

Note: The serial interface expects “TTL level” voltages (3.3-5V) not traditional RS232 voltages (which can be as high as +/-12V). I used a simple USB-Serial interface to plug my WR1043ND into my home FreeBSD desktop (this cable from DealExtreme).  When plugged in to my FreeBSD box the USB-Serial cable comes up as /dev/cuaU0. Since uBoot on the WR1043ND defaults to running at 115200 baud, I used the following line on my FreeBSD box to access the WR1043ND’s serial port:

cu -l /dev/cuaU0 -s 115200

Breaking into uBoot

When the WR1043ND powers up (or resets) you have one second to type “tpl” after uBoot prints “Autobooting in 1 seconds”. Do that, and you’re immediately dropped to the uBoot prompt.

    [gja@gjadesktop] /home/gja# cu -l /dev/cuaU0 -s 115200
    Connected

    U-Boot 1.1.4 (Aug  4 2010 - 20:06:51)

    AP83 (ar9100) U-boot 0.0.11
    DRAM:
    sri
    32 MB
    id read 0x100000ff
    flash size 8MB, sector count = 128
    Flash:  8 MB
    Using default environment

    In:    serial
    Out:   serial
    Err:   serial
    Net:   ag7100_enet_initialize...
    No valid address in Flash. Using fixed address
    : cfg1 0xf cfg2 0x7114
    eth0: 00:03:7f:09:0b:ad
    eth0 up
    eth0
    Autobooting in 1 secondsar7100>
    ar7100>
    ar7100>
    ar7100>
    ar7100> ?
    ?       - alias for 'help'
    reset   - Perform RESET of the CPU
    base    - print or set address offset
    bootm   - boot application image from memory
    bootp   - boot image via network using BootP/TFTP protocol
    cmp     - memory compare
    cp      - memory copy
    crc32   - checksum calculation
    erase   - erase FLASH memory
    flinfo  - print FLASH memory information
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    loady   - load binary file over serial line (ymodem mode)
    loop    - infinite loop on address range
    md      - memory display
    mm      - memory modify (auto-incrementing)
    mtest   - simple RAM test
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    rarpboot- boot image via network using RARP/TFTP protocol
    run     - run commands in an environment variable
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    ar7100>
    ar7100> printenv
    bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar9100-nor0:128k(u-boot),1024k(kernel),4096k(rootfs),64k(art)
    bootcmd=bootm 0xbf020000
    bootdelay=1
    baudrate=115200
    ethaddr=00:1D:0F:11:22:33
    ipaddr=192.168.0.2
    serverip=192.168.0.5
    stdin=serial
    stdout=serial
    stderr=serial
    ethact=eth0

    Environment size: 317/131068 bytes
    ar7100>

Booting factory firmware

With serial console active, I rebooted the WR1043ND to get a look at the factory firmware’s log output.

     [..uBoot starts up...]
Autobooting in 1 seconds## Booting image at bf020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.15--LSDK-6.1.1.40 gcc version 3.4.4 #12 Wed Aug 4 20:01:01 CST 2010
flash_size passed from bootloader = 8
CPU revision is: 00019374
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=31:2 rootfstype=squashfs init=/sbin/init
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30148k/32768k available (1406k kernel code, 2604k reserved, 293k data, 112k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction... available.
NET: Registered protocol family 16
Jumpstart button pressed.
SCSI subsystem initialized
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPPoX init, max protocols:3
NET: Registered protocol family 24
pppox protocol 0 register. max:3
cmdlinepart partition parsing not available
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7100-nor0
Creating 5 MTD partitions on "ar7100-nor0":
0x00000000-0x00020000 : "boot"
0x00020000-0x00120000 : "kernel"
0x00120000-0x007e0000 : "rootfs"
0x007e0000-0x007f0000 : "config"
0x007f0000-0x00800000 : "art"
->Oops: flash id 0x10216 .
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7100wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 112k freed
init started: BusyBox v1.01 (2010.05.27-08:19+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
ip_conntrack version 2.4 (256 buckets, 5120 max) - 244 bytes per conntrack
statistics: module license 'BSD' taints kernel.
insmod: cannot open module `/lib/modules/2.6.15/kernel/flashid.ko': No such file or directory
pppox protocol 1 register. max:3
PPPoL2TP kernel driver, V0.17. fixed many bug. drop rcv pkts and xmit pkts while no buffer, use pass time HZ/4.only drop ip pkt. no printk. xl2tpd 15 retries xmit. 08.05
PPTP driver version 0.8.3
pppox protocol 2 register. max:3
insmod: cannot open module `/lib/modules/2.6.15/kernel/harmony.ko': No such file or directory
Now flash open!
Now flash open!
AG7100: Length per segment 1536
AG7100: Max segments per packet 1
AG7100: Max tx descriptor count 40
AG7100: Max rx descriptor count 252
AG7100: fifo cfg 3 00780008

 (none) mips #12 Wed Aug 4 20:01:01 CST 2010 (none)
(none) login: rtl8368s_getAsicPHYRegs(0, 1, 22, &data) return is 0, data is 0x00001000
++ PVID: 0x00000001, bitmap: 0x00000021
++ PVID: 0x00000003, bitmap: 0x0000003e
++ PVID: 0x00000005, bitmap: 0x0000003e
++ PVID: 0x00000007, bitmap: 0x0000003e
++ PVID: 0x00000009, bitmap: 0x0000003e
vtable vid: 0x00000002, bitmap 0x00000022
vtable vid: 0x00000004, bitmap 0x00000024
vtable vid: 0x00000006, bitmap 0x00000026
vtable vid: 0x00000008, bitmap 0x00000028
vtable vid: 0x0000000a, bitmap 0x0000002a
vtable vid: 0x0000000c, bitmap 0x0000002c
vtable vid: 0x0000000e, bitmap 0x0000002e
vtable vid: 0x00000010, bitmap 0x00000030
vtable vid: 0x00000012, bitmap 0x00000032
vtable vid: 0x00000014, bitmap 0x00000034
vtable vid: 0x00000016, bitmap 0x00000036
vtable vid: 0x00000018, bitmap 0x00000038
vtable vid: 0x0000001a, bitmap 0x0000003a
vtable vid: 0x0000001c, bitmap 0x0000003c
vtable vid: 0x0000001e, bitmap 0x0000003e
AG7100: pll reg 0x18050014: 0x1a000000 Writing 4
SIOCETHTOOL
bridge: can't decode speed from eth0: 0
device eth0 entered promiscuous mode
AG7100: pll reg 0x18050014: 0x1a000000 Writing 4
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
fuse init (API version 7.8)
fuse distribution version: 2.7.4
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Port Status c000004
ar7100-ehci ar7100-ehci.0: ATH EHCI
ar7100-ehci ar7100-ehci.0: new USB bus registered, assigned bus number 1
ar7100-ehci ar7100-ehci.0: irq 3, io mem 0x1b000000
hcc_params addr 0xbb000108 val 0x6 hcs_params addr 0xbb000104 val 0x10011
ar7100-ehci ar7100-ehci.0: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
SIOCENABLEFWD

 TL-WR1043N mips #12 Wed Aug 4 20:01:01 CST 2010 (none)
TL-WR1043N login

 [..at this stage the unit responds to http connections to 192.168.1.1 on LAN ports..]

Flashing from factory firmware to OpenWRT

First I grabbed  openwrt-ar71xx-tl-wr1043nd-v1-squashfs-factory.bin from http://downloads.openwrt.org/backfire/10.03/ar71xx/ (image built 6apr10) and stored it locally.  (NOTE: When upgrading from factory original firmware, use “-squashfs-factory.bin”! Do not use the “-squashfs-sysupgrade.bin” version.)

Configured the WR1043ND to exist on my home LAN, and used the factory GUI’s built-in firmware upgrade process to successfully re-flash the unit with openwrt-ar71xx-tl-wr1043nd-v1-squashfs-factory.bin from my desktop.

Rebooted the WR1043ND while watching the serial console, and saw the upgrade to this relatively old version of OpenWRT was a success!

    Please stand by while rebooting the system.
    Restarting system.
    .

    U-Boot 1.1.4 (Aug  4 2010 - 20:06:51)

    AP83 (ar9100) U-boot 0.0.11
    DRAM:
    sri
    32 MB
    id read 0x100000ff
    flash size 8MB, sector count = 128
    Flash:  8 MB
    Using default environment

    In:    serial
    Out:   serial
    Err:   serial
    Net:   ag7100_enet_initialize...
    No valid address in Flash. Using fixed address
    : cfg1 0xf cfg2 0x7114
    eth0: 00:03:7f:09:0b:ad
    eth0 up
    eth0
    Autobooting in 1 seconds## Booting image at bf020000 ...
      Uncompressing Kernel Image ... OK

    Starting kernel ...

    Linux version 2.6.32.10 (openwrt@wrt1.marcant.net) (gcc version 4.3.3 (GCC) ) #20 Tue Apr 6 15:01:26 CEST 2010
    bootconsole [early0] enabled
    CPU revision is: 00019374 (MIPS 24Kc)
    Atheros AR9132 rev 2, CPU:400.000 MHz, AHB:200.000 MHz, DDR:400.000 MHz
    Determined physical RAM map:
    memory: 02000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00002000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
	0: 0x00000000 -> 0x00002000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
    Kernel command line: rootfstype=squashfs,yaffs,jffs2 noinitrd console=ttyS0,115200 board=TL-WR1043ND
    PID hash table entries: 128 (order: -3, 512 bytes)
    Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    Writing ErrCtl register=00000000
    Readback ErrCtl register=00000000
    Memory: 29332k/32768k available (2101k kernel code, 3436k reserved, 397k data, 152k init, 0k highmem)
    SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    Hierarchical RCU implementation.
    NR_IRQS:56
    Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    MIPS: machine is TP-LINK TL-WR1043ND
    bio: create slab <bio-0> at 0
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    TCP: Hash tables configured (established 1024 bind 1024)
    TCP reno registered
    NET: Registered protocol family 1
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    Registering mini_fo version $Id$
    JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
    yaffs Mar 28 2010 17:53:41 Installing.
    msgmni has been set to 57
    io scheduler noop registered
    io scheduler deadline registered (default)
    Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
    console [ttyS0] enabled, bootconsole disabled
    console [ttyS0] enabled, bootconsole disabled
    Atheros AR71xx SPI Controller driver version 0.2.4
    m25p80 spi0.0: s25sl064a (8192 Kbytes)
    Searching for RedBoot partition table in spi0.0 at offset 0x7e0000
    Searching for RedBoot partition table in spi0.0 at offset 0x7f0000
    No RedBoot partition table detected in spi0.0
    spi0.0: no WRT160NL signature found
    Creating 5 MTD partitions on "spi0.0":
    0x000000000000-0x000000020000 : "u-boot"
    0x000000020000-0x000000160000 : "kernel"
    0x000000160000-0x0000007f0000 : "rootfs"
    mtd: partition "rootfs" set to be root filesystem
    mtd: partition "rootfs_data" created automatically, ofs=2A0000, len=550000
    0x0000002a0000-0x0000007f0000 : "rootfs_data"
    0x0000007f0000-0x000000800000 : "art"
    0x000000020000-0x0000007f0000 : "firmware"
    Realtek RTL8366RB ethernet switch driver version 0.2.0
    rtl8366rb rtl8366rb: using GPIO pins 18 (SDA) and 19 (SCK)
    rtl8366rb rtl8366rb: RTL5937 ver. 3 chip found
    rtl8366-rtl: probed
    eth0: Atheros AG71xx at 0xb9000000, irq 4
    Atheros AR71xx hardware watchdog driver version 0.1.0
    TCP westwood registered
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
    Freeing unused kernel memory: 152k freed
    Please be patient, while OpenWrt loads ...
    gpio-buttons driver version 0.1.2
    input: gpio-buttons as /devices/platform/gpio-buttons/input/input0
    Button Hotplug driver version 0.3.1
    eth0: link up (1000Mbps/Full duplex)
    - preinit -
    Registered led device: tl-wr1043nd:green:usb
    Registered led device: tl-wr1043nd:green:system
    Registered led device: tl-wr1043nd:green:qss
    Registered led device: tl-wr1043nd:green:wlan
    Press the [f] key and hit [enter] to enter failsafe mode
    - regular preinit -
    jffs2 not ready yet; using ramdisk
    mini_fo: using base directory: /
    mini_fo: using storage directory: /tmp/root
    - init -
    eth0: link down

    Please press Enter to activate this console. eth0: link up (1000Mbps/Full duplex)
    device eth0.1 entered promiscuous mode
    device eth0 entered promiscuous mode
    br-lan: port 1(eth0.1) entering forwarding state
    PPP generic driver version 2.4.2
    ip_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 24
    nf_conntrack version 0.5.0 (460 buckets, 1840 max)
    CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
    nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
    sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
    jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
    jffs2_build_filesystem(): unlocking the mtd device... done.
    jffs2_build_filesystem(): erasing all blocks after the end marker... done.
    mini_fo: using base directory: /
    mini_fo: using storage directory: /overlay

    BusyBox v1.15.3 (2010-04-06 03:14:11 CEST) built-in shell (ash)
    Enter 'help' for a list of built-in commands.

      _______                     ________        __
    |       |.-----.-----.-----.|  |  |  |.----.|  |_
    |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
    |_______||   __|_____|__|__||________||__|  |____|
	      |__| W I R E L E S S   F R E E D O M
    Backfire (10.03, r20728) --------------------------
      * 1/3 shot Kahlua    In a shot glass, layer Kahlua
      * 1/3 shot Bailey's  on the bottom, then Bailey's,
      * 1/3 shot Vodka     then Vodka.
    ---------------------------------------------------
    root@OpenWrt:/#
    root@OpenWrt:/# ifconfig
    br-lan    Link encap:Ethernet  HWaddr F4:EC:38:EB:F2:56
	      inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
	      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
	      RX packets:458 errors:0 dropped:0 overruns:0 frame:0
	      TX packets:160 errors:0 dropped:0 overruns:0 carrier:0
	      collisions:0 txqueuelen:0
	      RX bytes:109362 (106.7 KiB)  TX bytes:122057 (119.1 KiB)

    eth0      Link encap:Ethernet  HWaddr F4:EC:38:EB:F2:56
	      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
	      RX packets:458 errors:0 dropped:0 overruns:0 frame:0
	      TX packets:232 errors:0 dropped:0 overruns:0 carrier:0
	      collisions:0 txqueuelen:1000
	      RX bytes:117606 (114.8 KiB)  TX bytes:152637 (149.0 KiB)
	      Interrupt:4

    eth0.1    Link encap:Ethernet  HWaddr F4:EC:38:EB:F2:56
	      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
	      RX packets:458 errors:0 dropped:0 overruns:0 frame:0
	      TX packets:160 errors:0 dropped:0 overruns:0 carrier:0
	      collisions:0 txqueuelen:0
	      RX bytes:111194 (108.5 KiB)  TX bytes:122697 (119.8 KiB)

    eth0.2    Link encap:Ethernet  HWaddr F4:EC:38:EB:F2:56
	      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
	      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
	      TX packets:71 errors:0 dropped:0 overruns:0 carrier:0
	      collisions:0 txqueuelen:0
	      RX bytes:0 (0.0 B)  TX bytes:28897 (28.2 KiB)

    lo        Link encap:Local Loopback
	      inet addr:127.0.0.1  Mask:255.0.0.0
	      UP LOOPBACK RUNNING  MTU:16436  Metric:1
	      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
	      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
	      collisions:0 txqueuelen:0
	      RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

    root@OpenWrt:/#

Conclusion:

So far so good — having confirmed the unit will run OpenWRT I hope to pursue some more interesting experiments in the near future!

Advertisements

3 comments

  1. Bachi Peachy · ·

    Cool posting LAN Under !! I just ordered my new WR1043ND
    I suppose I have to check my hardware version and flash with stable attitude_adjustment
    and then add openflow 1.3 package ( https://github.com/CPqD/ofsoftswitch13/wiki/OpenFlow-1.3-for-OpenWRT) to do some SDN research.
    Hope I can add a package without having to compile entire distro. Did not have much in compiling Openwrt on my Mac OSX 10.8.3. Any tips?
    Any idea how to add a package that is not in original binary?
    Thx – bachipeachy

  2. Glad the info helped. I haven’t tried building OpenWRT under Mac OSX. The two approaches I’ve tried include building inside a Linux VM customised for the purpose (http://caia.swin.edu.au/urp/diffuse/openwrt/ — down the page under “OpenWRT build environment Virtual Machines”) and building natively under FreeBSD (http://caia.swin.edu.au/urp/diffuse/openwrt/buildunderfreebsd.html)

  3. Hey would you mind letting me know which hosting company you’re working with? I’ve loaded
    your blog in 3 different web browsers and I must say this blog loads a lot quicker
    then most. Can you suggest a good internet hosting provider at
    a reasonable price? Thank you, I appreciate it!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: