erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
tftpboot 0x81000000 code.bin
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000
==== OEM installation using the Kermit and RS232 method ====
If you do not want to bother with running a tftpd server on your computer, especially considering the security concerns, you can also use a Kermit client to transfer the new image. It may take forever and a half (15-20min) to copy, but it's easier and more secure than running a tftpd server. These instructions assume you're using a Linux system, but they will give you all you need to do the same on a Windows box.
Requirements:
* terminal program (e.g. minicom) set to **115200 8N1**, no flow control
* file named //code.bin// containing openwrt firmware.
* Kermit client (these instructions will involve using C-Kermit under Linux)
In your terminal program you type:
erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
loadb 0x81000000
Hint: After you see Autobooting in 1 seconds type tpl and hit enter to get into command promt.
Fire up C-Kermit and run the following commands (or configure your Kermit client to these parameters):
set line /dev/ttyUSB0 # Just make sure you got the right USB interface
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send code.bin # Make sure you include a proper path to the file. That's why I just kept it in /home/$user
After the 15-20min file transfer, the new firmware should be on your router and you can continue in terminal:
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000
==== Upgrading OpenWrt ====
-> [[doc:howto:generic.sysupgrade]]
==== Back to original firmware ====
-> [[doc:howto:generic.uninstall]]
{{page>meta:infobox:dangerous&noheader&nofooter&noeditbtn}}
In case of the WR1043ND there is a catch: You download the stock firmware from the OEM: http://www.tplink.com/en/support/download/?model=TL-WR1043ND
* in case the file name of this firmware file does not contain the word **//"boot"//** in it, you can simply revert back to original firmware
* in case the file name of this firmware file does contain the word **//"boot"//** in it, you need to cut off parts of the image file //before// flashing it:
An example of an image file with the word "boot" in it is ''wr1043nv1_en_3_9_17_up_boot(091118).bin''.
Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:
dd if=orig.bin of=tplink.bin skip=257 bs=512
This has been confirmed by [[https://forum.openwrt.org/viewtopic.php?pid=110583#p110583|supertom64]]
===== Basic configuration =====
After flashing, proceed with [[doc:howto:basic.config|Basic configuration]].\\
Set up your Internet connection, configure wireless, configure USB port, etc.
===== Specific configuration =====
==== Interfaces ====
The default network configuration is:
^ Interface Name ^ Description ^ Default configuration ^
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth0 | LAN ports (1 to 4) + WAN | None |
| wlan0 | WiFi | Disabled |
==== Switch Ports (for VLANs) ====
Numbers 1-4 are Ports 1-4 as labeled on the unit, number 0 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself.
^ Port ^ Switch port ^
| Internet (WAN) | 0 |
| LAN 1 | 1 |
| LAN 2 | 2 |
| LAN 3 | 3 |
| LAN 4 | 4 |
| Gigabit Media Independent Interface | 5 |
http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PNid=18&PFid=15&Level=5&Conn=4&ProdID=197
Some issues with 10.03.1-rc4 on Hardware Ver.1.8 see [[https://forum.openwrt.org/viewtopic.php?pid=123269#p123269|this post]] for workaround.
==== Failsafe mode ====
-> [[doc:howto:generic.failsafe|OpenWrt Failsafe Mode]]
Power up your router. When the 'SYS' light starts to blink, press and hold the //QSS// button in the front-right until the blinking gets faster.
==== Recovery via serial console ====
You will see something like this:
.
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0 up
eth0
Autobooting in 1 seconds
Type
tpl
during this 1 second period. Then continue with [[#OEM installation using the TFTP and RS232 method]]
===== Hardware =====
==== Info ====
| **[[wp>Instruction set|Architecture]]:** | [[wp>MIPS architecture|MIPS]] |
| **Vendor:** | [[wp>Qualcomm Atheros]] |
| **[[doc:techref:Bootloader]]:** | [[doc:techref:bootloader:uboot|U-Boot]] |
| **[[doc:hardware:soc|System-On-Chip]]:** | AR9132 rev 2 (MIPS 24Kc V7.4) |
| **[[doc:hardware:cpu|CPU]]/Speed** | 24Kc V7.4 400 Mhz |
| **Flash-Chip:** | [[http://www.spansion.com/Support/Datasheets/S25FL064P_00_03_e.pdf|ST 25P64V6P]] |
| **Flash size:** | 8192 KiB |
| **RAM:** | 32 MiB |
| **Wireless:** | Atheros AR9103 2.4ghz 802.11bgn |
| **Ethernet:** | [[http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PNid=18&PFid=15&Level=5&Conn=4&ProdID=197|RealTek RTL8366RB 5-port Gigabit switch w/ vlan support]], [[doc:techref:swconfig]] |
| **Internet:** | n/a |
| **USB:** | Yes 1 x 2.0 |
| **[[doc:hardware:port.serial|Serial]]:** | [[#Serial|Yes]] |
| **[[doc:hardware:port.jtag|JTAG]]:** | [[#JTAG|Yes]] |
The Realtek [[http://realtek.info/pdf/rtl8366_8369_datasheet_1-1.pdf|8366RB]] supports: VLAN, Jumbo Frames (not supported by the SoC), bandwidth control, port priority, storm filtering, QoS, ACL. Not all of these features are actually supported by OpenWrt. Supported VLAN IDs are 1-15 (VLAN Configuration Mode 2 ?). See: [[https://dev.openwrt.org/ticket/7977|Ticket #7977]]
==== Performance ====
See -> [[doc:hardware:performance]] for results and [[doc:howto:performance]] for help for measuring
==== Power Consumption ====
With a cheap Wattmeter i measured 6,9W idle and 9W under load.
==== Photos ====
{{:toh:tp-link:tl-wr1043nd-v16.jpg?700|Version 1.6 Main board}}
[[http://wiki.openwrt.org/_media/inbox/tl-wr1043nd_v14.jpg|older version: v1.4]]
[[http://img5.imageshack.us/img5/5152/pcbfront.jpg|Higher Resolution Picture]]
==== Opening/closing the case ====
Note: This will void your warranty! The case of the WR1043N is composed of 4 pieces:
* Top cover (white, with logo)
* Bottom cover (white, with sticker)
* Front (transparent, black)
* Outer frame (black, vents on the sides)
There are only two screws at the back of the device, under the rubber feet. The rest of the case is kept together by two latches at the front of the device, and a system of guides and hooks in the front.
- Remove the antennas.
- Remove the rubber feet in the back and undo the screws.
- Unscrew all three retaining nuts on the antenna connectors and carefully push them into the housing. If you find this hard to do, leave them in place: you'll have to pay attention and avoid pulling the outer frame, as there are wires running from the back of the device all the way to the front of the board.
- Push one of the bottom screws back into place to lift the top cover, and keep it that way using a finger.
- With the top slightly open, push the bottom cover away. Use a screwdriver if you can't reach it with your fingers.
- If you have unscrewed the antenna connectors, now you can remove outer frame. Otherwise just carefully slide it out of the way: this will expose the clips that keep the top and bottom covers together.
- With a flathead screwdriver or similar tool, gently pry the two front clips apart. Each clip has two latches and is located near the corners, next to the black front. Put your screwdriver behind the latches and push it towards the ethernet ports.
- Now the top cover can slide out the vertical guides on the black front.
- The black front also has three plastic hooks that go into matching holes in the bottom cover. To remove it, pull the front away and then push it down.
Pictures can be found [[http://www.flickr.com/photos/19739482@N05/sets/72157624000636958/|here]]
=== Putting it back together ===
- Place the board on the bottom cover, so that the two plastic pins at the front keep it in place.
- If you undid the antenna connectors, put them back in and tighten the nuts.
- Place the outer frame behind the board and make sure it sits flush to the connectors.
- Insert the hooks of the front into the holes in the bottom cover, don't push it in yet.
- Make the top cover slide into the vertical guides on the front. Don't push it down yet.
- Push the front towards the back so the hooks are engaged, then push down the top cover.
- Fasten the screws and re-apply the rubber feet.
==== Serial ====
-> [[doc:hardware:port.serial]] general information about the serial port, serial port cable, etc.
How to connect to Serial Port:
Solder a header as shown in the picture or wires with a connector directly. The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.
Don’t forget that the **TX pin** of the serial port must linked to the **RX pin** of the router and the RX to TX!
{{:inbox:wr1043ndserial.jpg|}}
==== JTAG ====
-> [[doc:hardware:port.JTAG]] general information about the JTAG port, JTAG cable, etc.
{{:inbox:TL-WR1043ND_JTagport.jpg?700|}}
JTAG Line:
[[http://forum.openwrt.org/viewtopic.php?pid=79931#p79931]]
Software:
Download EJTAG Debrick Utility 3.0.1 from [[http://ftp.dd-wrt.com/phpBB2/viewtopic.php?t=22655|here]]
Backup:
Backup wholeflash:
tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00800000
Backup UBoot:
tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00020000
Backup Firmware:
tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf020000 /length:00800000
W A R N I N G
At the moment it is NOT possible to UNBRICK the router by JTAG (no write access to flashrom).
so be very carefull not to overwrite the u-boot. Read more via:[[http://www.dd-wrt.com/phpBB2/viewtopic.php?p=421935#421935]] ==== GPIOs ==== -> [[doc:hardware:port.GPIO]] The AR913x platform provides 22 GPIOs. Some of them are used by the router for status LEDs, buttons and to communicate with the RTL8366RB. The table below shows the results of some investigation: ^ ^ ^ ^ Voltage level at GPIO in output-mode ^^ gpioX/value in input-mode when GPIO is: ^^^ ^ GPIO ^ Common Name ^ PCB Name ^ gpioX/value=1 ^ gpioX/value=0 ^ Floating ^ Pulled to GND ^ Pulled to Vcc ^ | 0 | | | | | | | | | 1 | USB | D18=D9 | 0V | 3.3V | 1 | 1 | 1 | | 2 | SYS | D19=D8 | 0V | 3.3V | 1 | 1 | 1 | | 3 | RESET | SW6 | 3.3V | 0V | 1 | 0 | 1 | | 4 | | | | | | | | | 5 | QSS | D31=D10 | 3.3V | 0V | 0 | 0 | 1 | | 6 | | | | | | | | | 7 | QSS-Button | SW8=SW9 | 3.3V | 0V | 1 | 0 | 1 | | 8 | Setting data direction to output and value to 0 causes hard reset of the SoC ||||||| | 9 | WLAN | D11=D7 | 0V | 3.3V | 1 | 1 | 1 | | 10 | P1-Tx | | overriden by tty-kernel module || 1 | 0 | 1 | | 11 | | | | | | | | | 12 | | | | | | | | | 13 | P1-Rx | | 3.3V | 0V | 0 | 0 | 1 | | 14 | | | | | | | | | 15 | | | | | | | | | 16 | | | | | | | | | 17 | | | | | | | | | 18 | Data line of the RTL8366RB ||||||| | 19 | Clock line of the RTL8366RB ||||||| | 20 | | GPIO20 | 3.3V | 0V | 1 | 0 | 1 | | 21 | | | | | | | | To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the [[http://squidge.sourceforge.net/gpio/|Squidge-Project]]. Kernel modules occupying that resource need to be removed before (e.g. "leds-gpio" and "gpio-buttons"). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc. ==== LEDs ==== How to configure LEDs in general, see the LED section in the [[doc/uci/system]]. The WR1043ND has 10 LEDs: ^ LED name ^ LED print ^ Internal name ^ Trigger ^ | Power | PWR | tl-wr1043nd:green:power | N/A | | System | SYS | tl-wr1043nd:green:system | ''heartbeat'' | | Wireless LAN | WLAN | tl-wr1043nd:green:wlan | ''netdev:wlan0'' | | LAN Port 4 | 4 | unknown | N/A | | LAN Port 3 | 3 | unknown | N/A | | LAN Port 2 | 2 | unknown | N/A | | LAN Port 1 | 1 | unknown | N/A | | Wide Area Network | WAN | tl-wr1043nd:green:wan | N/A | | Universal Serial Bus | USB | tl-wr1043nd:green:usb | ''ledtrig-usbdev'' | | Quick Security Setup | QSS | tl-wr1043nd:green:qss | User preference | ledtrig-usbdev is only available in attitude adjustment (Trunk) and in self-built Backfire images using [[https://dev.openwrt.org/ticket/9239|this set of patches]]. ==== Buttons ==== -> [[doc:howto:hardware.buttons]] The TP-Link TL-WR1043ND has two buttons: ^ BUTTON ^ Event ^ | Reset | reset | | Quick Security Setup | QSS | The QSS button is located at the front and can be easily pressed with a finger. The Reset button is located at the back and cannot be pressed with a finger, you need a small item to push it in. ===== Debricking ===== -> [[doc:howto:generic.debrick]] **NOTE:** If you accidentally bricked your router by overwriting the bootloader, try the following: - Desolder the Spansion SPI-Flash ([[http://www.spansion.com/Support/Datasheets/S25FL064P_00_03_e.pdf|here]] is the datasheet) from the board. I used tin foil to "mask" out everything else which I did not want to desolder and used a heat gun. It worked quite nice. - Find a way to connect the SPI flash to something with SPI interface.... I used a AVR microcontroller. {{:toh:tp-link:spi_flash1.pdf|Here}} you can download a pdf containing the layout for the adapter board I made to solder the Spansion SPI flash chip on, in order to connect it to the AVR. Attention, the PDF is mirrored and it is intended to manufacuring boards with the [[http://thomaspfeifer.net/direct_toner_pcb.htm | direct toner method]]. - Write the bootloader into the flash. I got my bootloader out of another wr1043nd. - Solder the chip back into the router. - The router shall now be unbricked. ===== Bootloader Mods ===== - you could read about [[doc:techref:bootloader]] in general and about [[doc:techref:bootloader:uboot|Das U-Boot]]/[[doc:techref:bootloader:uboot.config|Configuration of U-Boot]] in particular. - the uboot version you find on the 1043 is a fork of mainline U-Boot version 1.1.4 from 2005-12-17 [[ftp://ftp.denx.de/pub/u-boot/|see here]]. You can / you cannot FIXME take a current mainline version of uboot and simply cross-compile it for WR1043ND! TP-Link-Version: [[http://www.tp-link.com/support/gpl.asp]]. It contains the file ''u-boot-ap83.tar.bz2'' which is about 6,06 MiB in size, deflate this as well. The deflated source code will occupy about 37MiB of space, start with reading the ''README''. - also see [[ftp://ftp.denx.de/pub/u-boot/]] and compare the versions. - you may be able to cross compile the code with the OpenWrt [[wp>toolchain]] [[http://buildroot.org/|Buildroot]]. See [[doc:howto:build]] for guidance. But you may need to use other toolchain to crosscompile, like the ELDK (Embedded Linux Development Kit). - :!: **''Problem:''** you cannot test your bootloader, because for some obscure reason, you don't have write access to the flash via [[#JTAG]]. ==== Making bootloader partition writable ==== Look at target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr1043nd.c
static struct mtd_partition tl_wr1043nd_partitions[] = {
{
.name = "u-boot",
.offset = 0,
.size = 0x020000,
.mask_flags = MTD_WRITEABLE,
} , {
.name = "kernel",
.offset = 0x020000,
.size = 0x140000,
} , {
.name = "rootfs",
.offset = 0x160000,
.size = 0x690000,
} , {
.name = "art",
.offset = 0x7f0000,
.size = 0x010000,
.mask_flags = MTD_WRITEABLE,
} , {
.name = "firmware",
.offset = 0x020000,
.size = 0x7d0000,
}
};
Remove the line
.mask_flags = MTD_WRITEABLE,
for the partition named "u-boot" to make it writeable.
==== Change MAC Address ====
* Get the uboot image via the following command cat /dev/mtd0 > /tmp/uboot.org
* At the offset 0x1FC00 you will usually find your mac address. You can change it with an hex editor. I use [[http://www.dettus.net/dhex/ | dhex]].
* After changing the MAC and making the u-boot mtd flash portion writeable, you can write the modified uboot image back to flash: mtd write /tmp/uboot.mod u-boot where "uboot.mod" is the filename of your modified uboot image.
===== Hardware Mods =====
- as a beginner, you really should inform yourself about [[doc:hardware:soldering]] in general and then even obtain some experience!
==== 64MB RAM Mod ====
The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip. Replace it with any 32Mbit x 16bit chip. 333MHz instead of 400MHz also works fine. It's quite hard to find these chips. The best chance is to have a look at DDR-SODIMM. Since there are no 64Mbit x 16Bit DDR1 Chips available -> no 128 MB mod!
Working chips:
* Hynix HY5DU121622DTP-D43 (From Mustang DDR-SODIMM 512 MB)
* Infineon HYB25D512160BE (From Infineon DDR-SODIMM 512 MB)
**Additional list that may work:**
'' Type | ID Code | Vendor |
DDR |32Mx16 |PC400 TSOP Pb Free |HY5DU121622DTP-D43-C |Hynix |
DDR |32Mx16 |PC400 TSOP Pb Free |H5DU5162ETR-E3C |Hynix |
DDR |32Mx16 |PC400 Pb Free |K4H511638G-LCCC |Samsung |
DDR |32Mx16 |PC400 Pb Free |K4H511638J-LCCC |Samsung |
DDR |32Mx16 |PC400 |A3S12D40ETP-G5 |Zentel |
DDR |32Mx16 |PC400 |NT5DS32M16BS-5T |Nanya |
DDR |32Mx16 |PC400 PB Free |P3S12D40ETP-GUTT |Mira |
DDR |32Mx16 |PC333 CL2.5 TSOP |MT46V32M16TG-6T:F |Micron |
DDR |32Mx16 |PC333 CL2.5 TSOP |MT46V32M16P-6T:F |Micron |
DDR |32Mx16 |PC333 PB Free TSOP |EDD5116ADTA-6B-E |Elpida |
DDR |32Mx16 |PC333 PB Free TSOP |HYB25D512160CE-6 |Qimonda |
DDR |32Mx16 |PC333 PB Free TSOP |HYB25D512160CEL-6 |Qimonda |
DDR |32Mx16 |PC333 PB Free TSOP |HYB25D512160DE-6 |Qimonda |
''
{{:inbox:tplink-wr1043nd-rammod-small.jpg|}}
**To make router see all new 64 mb of RAM do via putty SSH client**
1.nvram set sdram_init=0x0013
2.nvram commit
3.reboot
root@OpenWrt:~# free
total used free shared buffers
Mem: 62104 17472 44632 0 1392
Total: 62104 17472 44632
==== I²C GPIO Mod ====
An I²C-bus can easily be added using the GPIO-lines of the AR913x-SoC. So far, the only usable ones which have been confirmed to work are GPIO 5 (the QSS-LED, easily solderable at D10,left pin with '+') as SDA and GPIO 20 (labeled on the pcb, next to the RAM chip) as SCL. There are only two pull-up resistors of 4,7k-10k needed, which have to be soldered between the apropriate GPIO line and Vcc (found at the spot labeled TP3V3, about 2 cm above the WiFi-shielding). The common ground can be obtained from the TP_GND spot (between P1 and the flash chip). Remember this bus runs at 3.3V level, when connecting I²C-devices.
{{ http://wiki.openwrt.org/_media/toh/tp-link/i2c-gpio.png }}
Unfortunately the precompiled packages don't seem to work properly, so building from sources is most likely necessary. Therefore, make sure the apropriate part of your OpenWRT-config file looks like that:
#
# I2C support
#
CONFIG_PACKAGE_kmod-i2c-core=y
CONFIG_PACKAGE_kmod-i2c-algo-bit=y
# CONFIG_PACKAGE_kmod-i2c-algo-pca is not set
# CONFIG_PACKAGE_kmod-i2c-algo-pcf is not set
CONFIG_PACKAGE_kmod-i2c-gpio=y
CONFIG_PACKAGE_kmod-i2c-gpio-custom=y
Besides that, check in the kernel-config, that the support for I²C character device is selected. In the kernel config file the appropriate line should look like that:
CONFIG_I2C_CHARDEV=m
To load the kernel module, do a:
insmod i2c-gpio-custom bus0=0,5,20
In many cases, GPIO 5 will already be occupied by the leds-gpio kernel module - causing the above command to fail. In case you don't need the leds at all, you can just unload the leds-gpio kernel module, remove the package or disable it in the OpenWRT-configuration. As an alternative, you can just release the binding of the QSS-LED in sysfs - thus keeping the function of the other LEDs.
==== I²C Tiny-USB Mod ====
Though not really a modification of the internal hardware, the [[doc:howto:usb.i2c-tiny-usb|I²C Tiny-USB]] adapter allows you to extend your router with an I²C bus over USB. It is not as cheap as the I²C-GPIO mod, but will not risk your warranty. Remember this bus runs at 5V level, when connecting I²C-devices.
===== Tags =====
{{tag>GigabitEthernet 5Port 1PHY USB JTAG 802.11bgn ath9k 3Ant DetachableAntenna 32RAM 8Flash MIPS MIPS32 24Kc JumboFrames 32RAM 8Flash }}