Академический Документы
Профессиональный Документы
Культура Документы
H/W
/
v1.1
v1.4
v1.5
v1.6
v1.7
v1.8
(DE)v1.0
S/N
OpenWrt
Backfire 10.03
WR941ND.
Same v1 board as
Backfire 10.03
v1.1
Same v1 board as
Backfire 10.03
v1.1
Backfire 10.03
Backfire 10.03.1
rc4
Backfire 10.03.1
rc6 or trunk
Backfire 10.03.1- ,
rc4
WebUI
It appears that in order to use the "Firmware upgrade" option in the original firmware
for installing OpenWRT, the WR1043ND must be connected to internet, or at least to a
dhcp server on its WAN port - otherwise it won't flash the OpenWRT image, but come
up with original firmware again after reboot. UPDATE: not a problem with hardware
v1.8 running stock firmware 20110429: leaving connected back to back the Windows
client PC performing the upgrade was good enough.
Flash Layout
Please read the article Flash Layout for a better understanding. It contains a couple of
explanations. Then let's have a quick view at flash layout of this particular device:
TP-Link WR1043ND Flash Layout stock firmware
Layer
m25p80 spi0.0: m25p64 8192KiB
0
Layer mtd
mtd1
1 0
mt
d3
64
Ki
B
Size in 128
8000KiB
KiB KiB
ufirmware
boot
mount non
/
point e
filesys non
SquashFS?
tem e
TP-Link WR1043ND Visual Flash Layout OpenWrt
Name
1408
2944
art
non
e
non
e
812
8
Offset 0
128
x64Ki
B
oo
Block
s
Layer
m25p80 spi0.0: m25p64 8192KiB
0
mtd
0 uLayer
boot mtd5 firmware 8000KiB
1
128
KiB
Layer
2
mount
point
filesys
mtd1 kernel
mtd2 rootfs 6720KiB
1280KiB
/
mini_fo
mt
d4
art
64
Ki
B
tem
Layer
3
Size in 128
1280KiB
KiB KiB
ukernel
boot
mount non
none
point e
filesys non
none
tem e
Name
5184KiB
64
Ki
B
rootfs_data
art
/rom
/overlay
SquashFS
JFFS2
non
e
non
e
ART = Atheros Radio Test - it contains mac addresses and calibration data for the wifi
(EEPROM). If it is missing or corrupt, ath9k won't come up anymore.
OEM-
openwrt-ar71xx-tl-wr1043ndv1-squashfs-factory.bin
"Firmware Upgrade" - .
OEM-
-
. :
#!/bin/bash
# --
.
#
# curl , .
# Ethernet-
# ,
# , !
# (
# ).
curl \
--user admin:admin \
--user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0)
Gecko/20100101 Firefox/12.0' \
--referer 'http://192.168.1.1/userRpm/SoftwareUpgradeRpm.htm' \
--form "Filename=@$1" -F 'Upgrade=Upgrade' \
http://192.168.1.1/incoming/Firmware.htm > /dev/null
sleep 1
curl \
--max-time 2 \
--user admin:admin \
--user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0)
Gecko/20100101 Firefox/12.0' \
--referer 'http://192.168.1.1/incoming/Firmware.htm' \
http://192.168.1.1/userRpm/FirmwareUpdateTemp.htm > /dev/null
The simplest tftpd server to use is dnsmasq. Install and run with dnsmasq enabletftp tftp-root=/code.bindirectory
Commands:
After you see Autobooting in 1 seconds type tpl and hit enter to get into command
promt.
erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that
you may have a different size thus bricking your router)
tftpboot 0x81000000 code.bin
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000
Hint: After you see Autobooting in 1 seconds type tpl and hit enter to get into command
promt.
Fire up C-Kermit and run the following commands (or configure your Kermit client to
these parameters):
set line /dev/ttyUSB0 # Just make sure you got the right USB interface
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send code.bin # Make sure you include a proper path to the file.
That's why I just kept it in /home/$user
After the 15-20min file transfer, the new firmware should be on your router and you can
continue in terminal:
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000
Upgrading OpenWrt
generic.sysupgrade
Warning!
This section describes actions that might damage your
device or firmware. Proceed with care!
In case of the WR1043ND there is a catch: You download the stock firmware from the
OEM: http://www.tplink.com/en/support/download/?model=TL-WR1043ND
in case the file name of this firmware file does not contain the word "boot" in it,
you can simply revert back to original firmware
in case the file name of this firmware file does contain the word "boot" in it,
you need to cut off parts of the image file before flashing it:
After flashing, proceed with Basic configuration.
Set up your Internet connection, configure wireless, configure USB port, etc.
( VLAN)
Numbers 1-4 are Ports 1-4 as labeled on the unit, number 0 is the Internet (WAN) on
the unit, 5 is the internal connection to the router itself.
Port
Switch port
Internet (WAN)
0
LAN 1
1
LAN 2
2
LAN 3
3
LAN 4
4
Gigabit Media Independent Interface 5
http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PNid=18&PFid=15
&Level=5&Conn=4&ProdID=197
Some issues with 10.03.1-rc4 on Hardware Ver.1.8 see this post for workaround.
Failsafe mode
OpenWrt Failsafe Mode
Power up your router. When the 'SYS' light starts to blink, press and hold the QSS
button in the front-right until the blinking gets faster.
Type
tpl
during this 1 second period. Then continue with OEM installation using the TFTP and
RS232 method
Architecture:
Vendor:
Bootloader:
System-OnChip:
CPU/Speed
Flash-Chip:
Flash size:
RAM:
Wireless:
Ethernet:
Internet:
USB:
Serial:
JTAG:
MIPS
Qualcomm Atheros
U-Boot
AR9132 rev 2 (MIPS 24Kc V7.4)
24Kc V7.4 400 Mhz
ST 25P64V6P
8192 KiB
32 MiB
Atheros AR9103 2.4ghz 802.11bgn
RealTek RTL8366RB 5-port Gigabit switch w/ vlan support,
swconfig
n/a
Yes 1 x 2.0
Yes
Yes
The Realtek 8366RB supports: VLAN, Jumbo Frames (not supported by the SoC),
bandwidth control, port priority, storm filtering, QoS, ACL. Not all of these features are
actually supported by OpenWrt. Supported VLAN IDs are 1-15 (VLAN Configuration
Mode 2 ?). See: Ticket #7977
See performance for results and performance for help for measuring
,
6,9 , - 9 .
There are only two screws at the back of the device, under the rubber feet. The rest of
the case is kept together by two latches at the front of the device, and a system of guides
and hooks in the front.
Serial
port.serial general information about the serial port, serial port cable, etc. How to
connect to Serial Port:
Solder a header as shown in the picture or wires with a connector directly. The device
uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so
do not try to connect it to a common serial adapter: you will certainly fry the serial
circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL
available on the market, just be careful with the voltage: the standard is 5V and it may
also damage your board. Look for the ones with 3.3V or with both voltages and a way
to switch between them.
Dont forget that the TX pin of the serial port must linked to the RX pin of the router
and the RX to TX!
JTAG
port.JTAG general information about the JTAG port, JTAG cable, etc.
JTAG Line:
http://forum.openwrt.org/viewtopic.php?pid=79931#p79931
Software:
Download EJTAG Debrick Utility 3.0.1
Backup:
Backup wholeflash:
tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000
/length:00800000
Backup UBoot:
tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000
/length:00020000
Backup Firmware:
WARNING
At the moment it is NOT possible to UNBRICK the router by JTAG (no write access
to flashrom).
so be very carefull not to overwrite the bootloader.
GPIOs
port.GPIO The AR913x platform provides 22 GPIOs. Some of them are used by the
router for status LEDs, buttons and to communicate with the RTL8366RB. The table
below shows the results of some investigation:
Voltage level at GPIO in
output-mode
GPIO
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Common
Name
PCB
Name
USB
SYS
RESET
D18=D9
D19=D8
SW6
0V
0V
3.3V
QSS
D31=D10 3.3V
3.3V
3.3V
0V
1
1
1
1
1
0
1
1
1
0V
QSSSW8=SW9 3.3V
0V
1
0
1
Button
Setting data direction to output and value to 0 causes hard reset of the SoC
WLAN D11=D7 0V
3.3V
1
1
1
P1-Tx
overriden by tty-kernel module 1
0
1
P1-Rx
3.3V
0V
0V
To make the GPIOs available via sysfs, the required ones have to be exported to
userspace, as it is explained on a page of the Squidge-Project. Kernel modules
occupying that resource need to be removed before (e.g. "leds-gpio" and "gpiobuttons"). In output-mode, voltage levels of the GPIOs were measured against GND,
after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode,
the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating
(initial state), pulled to GND or pulled to Vcc.
How to configure LEDs in general, see the LED section in the system.
The WR1043ND has 10 LEDs:
LED name
LED print
Internal name
Trigger
Power
PWR
tl-wr1043nd:green:power N/A
System
SYS
tl-wr1043nd:green:system heartbeat
Wireless LAN
WLAN
tl-wr1043nd:green:wlan netdev:wlan0
LAN Port 4
4
unknown
N/A
LAN Port 3
3
unknown
N/A
LAN Port 2
2
unknown
N/A
LAN Port 1
1
unknown
N/A
Wide Area Network WAN
tl-wr1043nd:green:wan N/A
ledtrig-usbdev
Universal Serial Bus USB
tl-wr1043nd:green:usb
Quick Security Setup QSS
tl-wr1043nd:green:qss
User preference
ledtrig-usbdev is only available in attitude adjustment (Trunk) and in self-built Backfire
images using this set of patches.
Debricking
generic.debrick
NOTE: If you accidentally bricked your router by overwriting the bootloader, try the
following:
1. Desolder the Spansion SPI-Flash (here is the datasheet) from the board. I used
tin foil to "mask" out everything else which I did not want to desolder and used a
heat gun. It worked quite nice.
2. Find a way to connect the SPI flash to something with SPI interface. I used a
AVR microcontroller. Here you can download a pdf containing the layout for
the adapter board I made to solder the Spansion SPI flash chip on, in order to
connect it to the AVR. Attention, the PDF is mirrored and it is intended to
manufacuring boards with the direct toner method.
3. Write the bootloader into the flash. I got my bootloader out of another
wr1043nd.
4. Solder the chip back into the router.
5. The router shall now be unbricked.
Bootloader Mods
1. you could read about bootloader in general and about Das U-Boot/Configuration
of U-Boot in particular.
2. the uboot version you find on the 1043 is a fork of mainline U-Boot version
1.1.4 from 2005-12-17 see here. You can / you cannot
take a
current mainline version of uboot and simply cross-compile it for WR1043ND!
TP-Link-Version: http://www.tp-link.com/support/gpl.asp. It contains the file uboot-ap83.tar.bz2 which is about 6,06 MiB in size, deflate this as well. The
deflated source code will occupy about 37MiB of space, start with reading the
README.
3. also see ftp://ftp.denx.de/pub/u-boot/ and compare the versions.
4. you may be able to cross compile the code with the OpenWrt toolchain
Buildroot. See build for guidance. But you may need to use other toolchain to
crosscompile, like the ELDK (Embedded Linux Development Kit).
5.
Problem: you cannot test your bootloader, because for some obscure reason,
you don't have write access to the flash via JTAG.
} , {
.name
= "art",
.offset
= 0x7f0000,
.size
= 0x010000,
.mask_flags = MTD_WRITEABLE,
} , {
.name
= "firmware",
.offset
= 0x020000,
.size
= 0x7d0000,
}
};
MAC
At the offset 0x1FC00 you will usually find your mac address. You can change
it with an hex editor. I use dhex.
After changing the MAC and making the u-boot mtd flash portion writeable, you
can write the modified uboot image back to flash:
mtd write /tmp/uboot.mod u-boot
1. as a beginner, you really should inform yourself about soldering in general and
then even obtain some experience!
64MB
The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256
mebibit/8=32MiByte) 400MHz chip. Replace it with any 32Mbit x 16bit chip. 333MHz
instead of 400MHz also works fine. It's quite hard to find these chips. The best chance
is to have a look at DDR-SODIMM. Since there are no 64Mbit x 16Bit DDR1 Chips
available no 128 MB mod!
Working chips:
To make router see all new 64 mb of RAM do via putty SSH client
1.nvram set sdram_init=0x0013
2.nvram commit
3.reboot
root@OpenWrt:~# free
total used free shared buffers
Mem: 62104 17472 44632 0 1392
IC GPIO
An IC-bus can easily be added using the GPIO-lines of the AR913x-SoC. So far, the
only usable ones which have been confirmed to work are GPIO 5 (the QSS-LED, easily
solderable at D10,left pin with '+') as SDA and GPIO 20 (labeled on the pcb, next to the
RAM chip) as SCL. There are only two pull-up resistors of 4,7k-10k needed, which
have to be soldered between the apropriate GPIO line and Vcc (found at the spot labeled
TP3V3, about 2 cm above the WiFi-shielding). The common ground can be obtained
from the TP_GND spot (between P1 and the flash chip). Remember this bus runs at
3.3V level, when connecting IC-devices.
Unfortunately the precompiled packages don't seem to work properly, so building from
sources is most likely necessary. Therefore, make sure the apropriate part of your
OpenWRT-config file looks like that:
#
# I2C support
#
CONFIG_PACKAGE_kmod-i2c-core=y
CONFIG_PACKAGE_kmod-i2c-algo-bit=y
# CONFIG_PACKAGE_kmod-i2c-algo-pca is not set
# CONFIG_PACKAGE_kmod-i2c-algo-pcf is not set
CONFIG_PACKAGE_kmod-i2c-gpio=y
CONFIG_PACKAGE_kmod-i2c-gpio-custom=y
Besides that, check in the kernel-config, that the support for IC character device is
selected. In the kernel config file the appropriate line should look like that:
CONFIG_I2C_CHARDEV=m
In many cases, GPIO 5 will already be occupied by the leds-gpio kernel module causing the above command to fail. In case you don't need the leds at all, you can just
unload the leds-gpio kernel module, remove the package or disable it in the OpenWRTconfiguration. As an alternative, you can just release the binding of the QSS-LED in
sysfs - thus keeping the function of the other LEDs.
IC Tiny-USB
Though not really a modification of the internal hardware, the IC Tiny-USB adapter
allows you to extend your router with an IC bus over USB. It is not as cheap as the ICGPIO mod, but will not risk your warranty. Remember this bus runs at 5V level, when
connecting IC-devices.