Adding OpenWRT to TP-Link WR703N

I recently discovered the TP-Link TL-WR703N — a tiny WiFi router capable of 802.11n @ 150Mbps, powered by 5V from a USB port. The device has a single 100Mbps Ethernet port and can be flashed to run the linux-based OpenWRT. Most importantly, it is cheap — roughly ~$22 USD online at www.volumrates.com. This post discusses adding OpenWRT, connecting to the serial port  and re-flashing back to the factory firmware.

I received mine last week of November 2011, and poked at it over the weekend. It is so new they aren’t available for the English market yet — units are shipped with a Chinese GUI (http://translate.google.com is your friend!). The factory OS is linux, but if you want complete access you need to re-flash it with OpenWRT.

    

Flashing from factory firmware to OpenWRT

I grabbed http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin and stored it locally. (NOTE: When upgrading from factory original firmware, use “-squashfs-factory.bin”! Do not use the “-squashfs-sysupgrade.bin” version.)

Configured my home desktop machine to have an interface on 192.168.1/24

[gja@gjadesktop] /home/gja# ifconfig re0 alias 192.168.1.2/24

Then plugged in WR703N to USB power and cat5 to my home LAN.

Connected via browser to http://192.168.1.1 and logged in with “admin/admin” (then used Google translate to navigate my way around the factory firmware’s Chinese menus).

Found http://192.168.1.1/userRpm/SoftwareUpgradeRpm.htm as the correct URL for the firmware upgrade screen, clicked on the file selector window and selected my local copy of openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin

Curiously, I was then presented with:

"/home/gja/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
The selected filename already exists. If you
continue, the contents of the existing file will
be replaced.
Do you want to continue?"

This seemed odd given that I was supposed to be uploading/reading the file on disk, not writing to it.  Nevertheless, I confirmed it was okay, then pressed the upgrade button and again confirmed my desire to upgrade.

The web GUI presented me with a sliding bar across the window indicating upload progress, it took about a minute or so to upload, followed by another sliding window and percentage indicator which indicated “Software upgrade success, restarting…” After another minute, “Please wait. If your browser does not automatically refresh, please click your browser’s “Refresh” button.” (Of course, this isn’t going to work because the unit will be, I hope, now running OpenWRT in basic form without web GUI.)

The blue LED starts blinking. I can now ping 192.168.1.1 so I try telnet.

[gja@gjadesktop] /home/gja# telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
=== IMPORTANT ============================
Use 'passwd' to set your login password
this will disable telnet and enable SSH
------------------------------------------

BusyBox v1.19.3 (2011-11-29 04:47:41 MST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

 _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
	      |__| W I R E L E S S   F R E E D O M
ATTITUDE ADJUSTMENT (bleeding edge, r29353) ----------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:/#

Telnet logs me in with no password, and the blue LED is is now solidly on. Yay! Lets play around inside:

root@OpenWrt:/# df -h
Filesystem Size Used Available Use% Mounted on
rootfs 1.4M 204.0K 1.2M 14% /
/dev/root 1.5M 1.5M 0 100% /rom
tmpfs 14.4M 40.0K 14.3M 0% /tmp
tmpfs 512.0K 0 512.0K 0% /dev
root 14.4M 28.0K 14.3M 0% /tmp/root
overlayfs:/tmp/root 14.4M 28.0K 14.3M 0% /tmp/root
/dev/mtdblock3 1.4M 204.0K 1.2M 14% /overlay
overlayfs:/overlay 1.4M 204.0K 1.2M 14% /
root@OpenWrt:/#
root@OpenWrt:/# ifconfig
br-lan Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:72 errors:0 dropped:2 overruns:0 frame:0
TX packets:50 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4455 (4.3 KiB) TX bytes:8593 (8.3 KiB)

eth0 Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:181 errors:0 dropped:0 overruns:0 frame:0
TX packets:54 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:41334 (40.3 KiB) TX bytes:8857 (8.6 KiB)
Interrupt:4

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:912 errors:0 dropped:0 overruns:0 frame:0
TX packets:912 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:62016 (60.5 KiB) TX bytes:62016 (60.5 KiB)

root@OpenWrt:/#
root@OpenWrt:/# cat /proc/cpuinfo
system type : Atheros AR9330 rev 1
machine : TP-LINK TL-WR703N v1
processor : 0
cpu model : MIPS 24Kc V7.4
BogoMIPS : 265.42
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented : mips16
shadow register sets : 1
kscratch registers : 0
core : 0
VCED exceptions : not available
VCEI exceptions : not available

root@OpenWrt:/#
root@OpenWrt:/tmp# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00100000 00010000 "kernel"
mtd2: 002d0000 00010000 "rootfs"
mtd3: 00160000 00010000 "rootfs_data"
mtd4: 00010000 00010000 "art"
mtd5: 003d0000 00010000 "firmware"
root@OpenWrt:/tmp#

Adding Web GUI to OpenWRT

When OpenWRT is first installed, it has no Web interface nor is WiFi enabled. Following http://embeddedtimes.blogspot.com/2011/09/tp-link-tl-wr703n-tiny-linux-capable.html

  • Set a password on the device (use the “passwd” command).  Note: once you’ve done this you will need to SSH to the device, telnet will be disabled.
  • Configure /etc/config/network with an IP address, gateway and DNS servers that allow the device to access the Internet. Either reboot the device or run “/etc/init.d/network restart” to apply the settings.
  • Run “opkg update” and “opkg install luci” to install the web interface.

Changed password to “admin”

root@OpenWrt:/# passwd
Changing password for root
New password:
Bad password: too short
Retype password:
Password for root changed by root
root@OpenWrt:/#

Read http://wiki.openwrt.org/doc/uci/network and changed /etc/config/network lines for eth0 from:

config 'interface' 'lan'
option 'ifname' 'eth0'
option 'type' 'bridge'
option 'proto' 'static'
option 'ipaddr' '192.168.1.1'
option 'netmask' '255.255.255.0'

to

config 'interface' 'lan'
option 'ifname' 'eth0'
option 'type' 'bridge'
option 'proto' 'static'
option 'ipaddr' '10.1.1.21'
option 'netmask' '255.255.255.0'
option 'dns' '10.1.1.12'
option 'gateway' '10.1.1.12'

(I’ve assigned 10.1.1.21 as static IP addr for my first WR703N on the home LAN)

Ran “/etc/init.d/network restart” and now we need to ssh in to 10.1.1.21.

[gja@gjadesktop]/home/gja(103)% ssh root@10.1.1.21
root@10.1.1.21's password:
BusyBox v1.19.3 (2011-11-29 04:47:41 MST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
 _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
	      |__| W I R E L E S S   F R E E D O M
ATTITUDE ADJUSTMENT (bleeding edge, r29353) ----------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:~#

Running the “opkg update” and “opkg install luci” steps took less than 2 minutes.

root@OpenWrt:~# opkg update
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/Packages.gz.
Inflating http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/Packages.gz.
Updated list of available packages in /var/opkg-lists/snapshots.
root@OpenWrt:~#
root@OpenWrt:~# opkg install luci
Installing luci (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci_trunk+svn8016-1_ar71xx.ipk.
Installing uhttpd (30) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/uhttpd_30_ar71xx.ipk.
Installing luci-mod-admin-full (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-mod-admin-full_trunk+svn8016-1_ar71xx.ipk.
Installing luci-mod-admin-core (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-mod-admin-core_trunk+svn8016-1_ar71xx.ipk.
Installing luci-lib-web (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-web_trunk+svn8016-1_ar71xx.ipk.
Installing luci-lib-core (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-core_trunk+svn8016-1_ar71xx.ipk.
Installing lua (5.1.4-8) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/lua_5.1.4-8_ar71xx.ipk.
Installing liblua (5.1.4-8) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/liblua_5.1.4-8_ar71xx.ipk.
Installing libuci-lua (2011-11-14.1-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/libuci-lua_2011-11-14.1-1_ar71xx.ipk.
Installing luci-lib-sys (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-sys_trunk+svn8016-1_ar71xx.ipk.
Installing luci-lib-nixio (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-nixio_trunk+svn8016-1_ar71xx.ipk.
Installing luci-sgi-cgi (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-sgi-cgi_trunk+svn8016-1_ar71xx.ipk.
Installing luci-lib-lmo (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-lmo_trunk+svn8016-1_ar71xx.ipk.
Installing luci-proto-core (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-proto-core_trunk+svn8016-1_ar71xx.ipk.
Installing luci-i18n-english (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-i18n-english_trunk+svn8016-1_ar71xx.ipk.
Installing luci-lib-ipkg (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-lib-ipkg_trunk+svn8016-1_ar71xx.ipk.
Installing luci-theme-openwrt (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-theme-openwrt_trunk+svn8016-1_ar71xx.ipk.
Installing luci-theme-base (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-theme-base_trunk+svn8016-1_ar71xx.ipk.
Installing luci-app-firewall (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-app-firewall_trunk+svn8016-1_ar71xx.ipk.
Installing luci-proto-ppp (trunk+svn8016-1) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/luci-proto-ppp_trunk+svn8016-1_ar71xx.ipk.
Installing libiwinfo (16) to root...
Downloading http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/libiwinfo_16_ar71xx.ipk.
Configuring luci-lib-sys.
Configuring liblua.
Configuring libuci-lua.
Configuring lua.
Configuring luci-lib-core.
Configuring luci-lib-nixio.
Configuring luci-sgi-cgi.
Configuring luci-lib-lmo.
Configuring luci-lib-web.
Configuring luci-proto-core.
Configuring luci-i18n-english.
Configuring luci-mod-admin-core.
Configuring libiwinfo.
Configuring luci-theme-base.
Configuring luci-theme-openwrt.
Configuring luci-app-firewall.
Configuring luci-lib-ipkg.
Configuring luci-proto-ppp.
Configuring luci-mod-admin-full.
Configuring uhttpd.
Configuring luci.
root@OpenWrt:~#

Then from http://wiki.openwrt.org/doc/howto/luci.essentials 

Enable (so that it will be started at every boot) and start uHTTPd: 
root@OpenWrt:~# /etc/init.d/uhttpd enable
root@OpenWrt:~# /etc/init.d/uhttpd start

And voila! I can access OpenWRT via http://10.1.1.21/ using the root password I set with passwd.

From the openwrt GUI:

Router Name OpenWrt
Router Model TP-LINK TL-WR703N v1
Firmware Version OpenWrt Firmware Attitude Adjustment (r29353) / LuCI Trunk (trunk+svn8016)
Kernel Version 2.6.39.4
Local Time Fri Dec 2 23:28:53 2011
Uptime 1h 1m 50s
Load Average 0.14, 0.15, 0.10

Enabling Wireless interface under OpenWRT

The WLAN interface is initially not running (and the openwrt GUI says it is disabled).  See http://wiki.openwrt.org/doc/uci/wireless for details of config options. Using the GUI I selected “ENABLE” for the WiFi port, and in a few seconds it was running and the interface list now looks like this:

root@OpenWrt:~# ifconfig
br-lan Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
inet addr:10.1.1.21 Bcast:10.1.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1556 errors:0 dropped:10 overruns:0 frame:0
TX packets:1602 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:240661 (235.0 KiB) TX bytes:555863 (542.8 KiB)

eth0 Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8484 errors:0 dropped:0 overruns:0 frame:0
TX packets:3177 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2761465 (2.6 MiB) TX bytes:719030 (702.1 KiB)
Interrupt:4

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:25116 errors:0 dropped:0 overruns:0 frame:0
TX packets:25116 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1710042 (1.6 MiB) TX bytes:1710042 (1.6 MiB)

mon.wlan0 Link encap:UNSPEC HWaddr 5C-63-BF-BB-49-BE-00-47-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:49 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:5851 (5.7 KiB) TX bytes:0 (0.0 B)

wlan0 Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:336 (336.0 B)

root@OpenWrt:~#

Yay! Was able to set WPA2-PSK security via OpenWRT, then connected using an iPad2 I had lying around and successfully accessed the home LAN and internet (the iPad2 successfully DHCP’d from my home LAN’s DHCP server over the WR703N’s wlan service).

Cool.

Setting multiple SSIDs

I did a basic experiment of adding a 2nd wireless interface, which seemed to be possible — used a 2nd SSID, and set a different WPA2-PSK password, and the iPad2 could ‘see’ both SSIDs. Connected to the 2nd SSID and confirmed that you needed the 2nd SSID’s password. Then confirmed that I could use the iPad2 from the back lounge successfully even though the WR703N was just sitting on the desk in my study.

root@OpenWrt:~# ifconfig
br-lan Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
inet addr:10.1.1.21 Bcast:10.1.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1619 errors:0 dropped:11 overruns:0 frame:0
TX packets:1667 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:250176 (244.3 KiB) TX bytes:569157 (555.8 KiB)

eth0 Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8583 errors:0 dropped:0 overruns:0 frame:0
TX packets:3244 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2783799 (2.6 MiB) TX bytes:732456 (715.2 KiB)
Interrupt:4

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:25116 errors:0 dropped:0 overruns:0 frame:0
TX packets:25116 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1710042 (1.6 MiB) TX bytes:1710042 (1.6 MiB)

mon.wlan0 Link encap:UNSPEC HWaddr 5C-63-BF-BB-49-BE-00-47-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:213 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:25673 (25.0 KiB) TX bytes:0 (0.0 B)

wlan0 Link encap:Ethernet HWaddr 5C:63:BF:BB:49:BE
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:642 (642.0 B)

root@OpenWrt:~#


Adding serial port access

If you want to do low-level re-flashing of the unit via the uBoot console, you need serial port access. My unit (v1.2) had really tiny PCB pads (rather than holes) near the words TP_OUT and TP_IN marked on the PCB at top right corner. These are the TX (signal output) and RX (signal input) serial lines respectively.

     

For anyone wondering about pulling the blue lid off — you can see three points around the case edge where you need to pry the case sides away from plastic catches on the lid underside of the lid: Top left (near LAN port), far right (near serial pads) and bottom right of the case (to the right of the USB port, hidden from view in my photo). The blue lid will eventually pop off, although you’ll undoubtedly scratch the plastic edges.

My first attempt at serial connection was nasty — the wires started pulling the pcb pads off the board!

First attempt — wires hanging off serial pads

Later I jury-rigged a second setup which is physically more stable (with a 3-pin header glued to the top of the USB port).

Second attempt — three pin header glued to USB socket, with GND soldered to the USB socket’s case

Note: The serial interface expects “TTL level” voltages (3.3-5V) not traditional RS232 voltages (which can be as high as +/-12V). I used a simple USB-Serial interface to plug my WR703N into my home FreeBSD desktop (this cable from DealExtreme).  When plugged in to my FreeBSD box the USB-Serial cable comes up as /dev/cuaU0. Since uBoot on the WR703N defaults to running at 115200 baud, I used the following line on my FreeBSD box to access the WR703N’s serial port:

cu -l /dev/cuaU0 -s 115200

When the WR703N powers up (or resets) you have one second to type “tpl” after uBoot prints “Autobooting in 1 seconds”. Do that, and you’re immediately dropped to the uBoot prompt.

U-Boot 1.1.4 (Sep 26 2011 - 11:13:45)

AP121-2MB (ar9330) U-boot

DRAM: 32 MB
led turning on for 1s...
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment

In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
hornet>
hornet>
hornet> ?
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
hornet>
hornet> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 362/65532 bytes
hornet>


Re-flashing the factory firmware

During my initial experiments I borked the WR703N with a broken OpenWRT image. This necessitated a re-flash back to the factory image using the factory image on a local TFTP server and serial port access to the uBoot console (as described above).

The following sequence worked for me:

  • tftpboot to download the factory image to RAM
  • erase the openwrt firmware from Flash
  • cp.b the factory image from RAM to Flash, then
  • bootm the newly installed factory firmware from Flash

(Similar to advice in http://wiki.openwrt.org/toh/tp-link/tl-wr841nd)

hornet> tftpboot 0x81000000 wr703nv1_cn_3_12_11_up(110926).bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'wr703nv1_cn_3_12_11_up(110926).bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)

hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000
61
Erased 60 sectors
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000
done

hornet> bootm 9f020000
## Booting image at 9f020000 ...
Uncompressing Kernel Image ... OK

Starting kernel ...

 Booting AR9330(Hornet)...
 Linux version 2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #149 Mon Sep 26 11:13:59 CST 2011 flash_size passed from bootloader = 4
 CPU revision is: 00019374 (MIPS 24Kc)
 Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
 User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
 Zone PFN ranges:
 Normal 0x00000000 -> 0x00002000
 Movable zone start PFN for each node
 early_node_map[1] active PFN ranges
 0: 0x00000000 -> 0x00002000
 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M
 PID hash table entries: 128 (order: 7, 512 bytes)
 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
 Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
 Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
 Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
 Writing ErrCtl register=00000000
 Readback ErrCtl register=00000000
 Memory: 29864k/32768k available (1888k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem)
 Hierarchical RCU implementation.
 NR_IRQS:128
 plat_time_init: plat time init done
 Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
 Mount-cache hash table entries: 512
 NET: Registered protocol family 16
 ===== ar7240_platform_init: 0

 Whoops! This kernel is for product wr703 v1.0!

 bio: create slab <bio-0> at 0
 SCSI subsystem initialized
 usbcore: registered new interface driver usbfs
 usbcore: registered new interface driver hub
 usbcore: registered new device driver usb
 NET: Registered protocol family 2
 IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 TCP established hash table entries: 1024 (order: 1, 8192 bytes)
 TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
 TCP: Hash tables configured (established 1024 bind 1024)
 TCP reno registered
 NET: Registered protocol family 1
 AR7240 GPIOC major 0
 squashfs: version 4.0 (2009/01/31) Phillip Lougher
 NTFS driver 2.1.29 [Flags: R/O].
 msgmni has been set to 58
 alg: No test for lzma (lzma-generic)
 alg: No test for stdrng (krng)
 io scheduler noop registered
 io scheduler anticipatory registered
 io scheduler deadline registered
 io scheduler cfq registered (default)
 Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
 ttyS0: detected caps 00000000 should be 00000100
 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
 console [ttyS0] enabled
 PPP generic driver version 2.4.2
 NET: Registered protocol family 24
 cmdlinepart partition parsing not available
 set partition boot
 set partition kernel
 set partition rootfs
 set partition config
 set partition art
 set partition �
 Searching for RedBoot partition table
 5 RedBoot partitions found on MTD device ar7240-nor0
 Creating 5 MTD partitions on "ar7240-nor0":
 0x000000000000-0x000000020000 : "boot"
 0x000000020000-0x000000120000 : "kernel"
 0x000000120000-0x0000003e0000 : "rootfs"
 0x0000003e0000-0x0000003f0000 : "config"
 0x0000003f0000-0x000000400000 : "art"
 ->Oops: flash id 0x10215 .
 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
 Port Status 1c000004
 ar7240-ehci ar7240-ehci.0: ATH EHCI
 ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
 ehci_reset Intialize USB CONTROLLER in host mode: 3
 ehci_reset Port Status 1c000000
 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
 ehci_reset Intialize USB CONTROLLER in host mode: 3
 ehci_reset Port Status 1c000000
 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
 usb usb1: configuration #1 chosen from 1 choice
 hub 1-0:1.0: USB hub found
 hub 1-0:1.0: 1 port detected
 TCP cubic registered
 NET: Registered protocol family 17
 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
 All bugs added by David S. Miller <davem@redhat.com>
 ar7240wdt_init: Registering WDT success
 VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
 Freeing unused kernel memory: 116k freed
 init started: BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary
 This Board use 2.6.31
 xt_time: kernel timezone is -0000
 nf_conntrack version 0.5.0 (512 buckets, 5120 max)
 ip_tables: (C) 2000-2006 Netfilter Core Team
 insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
 insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
 PPPoL2TP kernel driver, V1.0
 PPTP driver version 0.8.3
 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory

 (none) mips #149 Mon Sep 26 11:13:59 CST 2011 (none)
 (none) login: Now flash open!
 Now flash open!
 Now flash open!
 Now flash open!
 Now flash open!
 Erase from 0X3E0000 to 0X3EC9C8:.
 Program from 0X3E0000 to 0X3EC9C8:
 write successfully
 ATHR_GMAC: Length per segment 1536
 ATHR_GMAC: fifo cfg 3 01f00140
 ATHR_GMAC: Mac address for unit 1:bf1f0006
 ATHR_GMAC: 6d:f4:2f:5c:b6:b7
 ATHR_GMAC: Max segments per packet : 1
 ATHR_GMAC: Max tx descriptor count : 40
 ATHR_GMAC: Max rx descriptor count : 96
 ATHR_GMAC: Mac capability flags : 4D83
 ATHR_GMAC: Mac address for unit 0:bf1f0000
 ATHR_GMAC: 61:58:d5:7f:5b:d9
 ATHR_GMAC: Max segments per packet : 1
 ATHR_GMAC: Max tx descriptor count : 40
 ATHR_GMAC: Max rx descriptor count : 252
 ATHR_GMAC: Mac capability flags : 4403
 athr_gmac_ring_alloc Allocated 640 at 0x81e79800
 athr_gmac_ring_alloc Allocated 4032 at 0x81d63000
 Setting Drop CRC Errors, Pause Frames and Length Error frames
 Setting PHY...mac 0
 athr_gmac_ring_alloc Allocated 640 at 0x81e79400
 athr_gmac_ring_alloc Allocated 1536 at 0x81f25000
 athr_gmac_mii_setup: MDC check failed
 Setting Drop CRC Errors, Pause Frames and Length Error frames
 ATHRS26: resetting s26
 ATHRS26: s26 reset done
 Setting PHY...mac 1
 device eth0 entered promiscuous mode
 Now flash open!
 ATHR_GMAC: Enet Unit:1 PHY:4 is UP GMii 100Mbps full duplex
 ATHR_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
 Setting Drop CRC Errors, Pause Frames and Length Error frames
 br0: port 1(eth0) entering forwarding state
 nf_conntrack_rtsp v0.6.21 loading
 nf_nat_rtsp v0.6.21 loading
 asf: module license 'Proprietary' taints kernel.
 Disabling lock debugging due to kernel taint
 ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
 ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
 ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
 ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss)
 Boostrap clock 25MHz
 ar9300RadioAttach: Need analog access recipe!!
 Restoring Cal data from Flash
 ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0
 ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0
 wifi0: Atheros 9380: mem=0xb8100000, irq=2
 wlan_vap_create : enter. devhandle=0x80d182c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
 wlan_vap_create : exit. devhandle=0x80d182c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
 VAP device ath0 created

 DES SSID SET=TP-LINK_BB49BE
 ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c0a048a0 arg=81f54ac0
 wlan_vap_delete : enter. vaphandle=0x81c78000
 wlan_vap_delete : exit. vaphandle=0x81c78000
 wlan_vap_create : enter. devhandle=0x80d182c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
 wlan_vap_create : exit. devhandle=0x80d182c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
 VAP device ath0 created

 DES SSID SET=TP-LINK_BB49BE
 ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
 WARNING: Fragmentation with HT mode NOT ALLOWED!!
 device ath0 entered promiscuous mode
 br0: port 2(ath0) entering forwarding state
 ieee80211_ioctl_siwmode: imr.ifm_active=918144, new mode=3, valid=1
 br0: port 2(ath0) entering disabled state

 DES SSID SET=TP-LINK_BB49BE
 br0: port 2(ath0) entering forwarding state

 TL-WR703N mips #149 Mon Sep 26 11:13:59 CST 2011 (none)
 TL-WR703N login:
Advertisements

5 comments

  1. Many thanks to your post and guidelines. I’ve recently just gone down this path myself (with Barrier Breaker – Jan 2013).
    I have no experience in Linux – but eventually figured out how to add the various network entries via UCI command. Maybe insert the relevant UCI commands for people and this tutorial would be much more newbie friendly.
    Great post, many thanks for the level of detail!

  2. Thanks for sharing your thoughts. I really appreciate your efforts and I will be waiting for your next
    write ups thanks once again.

  3. This guy sells pre-modded units, cables, memory upgrades, and all kind of related goodies, all for western-world-next-to-nothing prices: http://stores.ebay.com/SLboat

  4. […] [- OpenWrt Wiki] 5). https://grenville.files.wordpress.co…-2-19nov11.jpg (one soldered) 6). Adding OpenWRT to TP-Link WR703N | Thinking too much 7). http://wiki.openwrt.org/doc/howto/usb.essentials 8). Index of […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: