User Tools

Site Tools


TP-Link TL-WR542g

This is a quite cheap 802.11g soho router. Due the small amount of flash and RAM it cannot be offically supported by OpenWrt.There is no way to flash PRODUCTION OpenWrt firmware through TP-Link's WEB directly, because of the limitation that it can accept only images less then 1179648 bytes long(hardcoded in firmware) so to get over this problem a vxkiller image (Backfire10.3 stripped heavily with MicroRedboot bootloader adapted for 2mb flash and 16mb ram) was developed by member xssa from forum

any questions releated to debuging please refer to the forum

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v? 20??-?? - not by any official firmware image similar to wr340gd

Hardware Highlights

CPU Ram Flash USB Serial JTag
Atheros AR2317 16MiB 2MiB No Yes No


TP-Link's web interface has a hardcoded limitation that it only accepts images less then 1.179.648 Bytes long. So you cannot even use the entire space available for a OpenWrt build. But you can surpass this problem by flashing a special OpenWrt firmware image called "VxKiller" developed by xssa first, and only then the actual firmware.

Installation of VxKiller-Image

"VxKiller" is a heavily stripped OpenWrt Backfire 10.03 with MicroRedboot bootloader adapted for 2MiB flash and 16MiB RAM. There is

  • no working DHCP server
  • no wireless driver
  • no WebUI
  • no SSH daemon
  • no writable RootFS

on this image. Its only purpose is to fit into the specs that the TP-Link's web interfaces accepts.

Note: This VxKiller was originally developed for the TP-LINK WR340G router which is the same hardware as the WR542G excluding the 16MB ram found in the wr542g

  1. download special OpenWrt Image "VxKiller" by XSSA:
  2. upgrade your TL-WR542G with the "wr340v5_linux.bin" (vxkiller) through TP-Link's web interface. After second reboot you can telnet to VxKiller firmware

Installation of full OpenWrt build

  1. download Kernel (custom load address for kernel is 80033800)
  2. download RootFS (IP Address is logon with root/ar2317)
  3. connect to the bootloader (RedBoot) and do
    fis init      ( Erases Flash rom )
    ip_addr -h  ( ip of TFTP server )
    load -r -v -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma       ( loads kernel to ram )
    fis create -r 0x80033800 -e 0x80033800 vmlinux.bin.l7        ( Write's kernel to flash custom load address for kernel is 80033800 current kernel is 2.6 )
    fis free       ( calculate in hexadecimal base 16 next erase block by using bc bc in linux )  
    load -r -v -b %{FREEMEMLO} openwrt-atheros-root.squashfs     ( loads kernel to ram )
    fis create -l 0x130000 rootfs         ( Write's to flash Default erase block addrees for xssa image )
    reset  ( Restart's router )
  4. optionally do:
    fis load -l vmlinux.bin.l7     ( for loading kernel from flash to ram  )
    exec      ( for executing kernel from ram ) 


→ cf. wireless.overview and wireless.utilities

  • Only Routed Client Mode works with the rootfs and kernel given here as dhcp server(dnsmasq) and firewall is not included in this build to save space
  • Remember:Client Bridge is not supported by atheros chipset by default due to the driver's limitation

Okay the rootfs and kernel you flashed to your router does not have opkg package system nor does it have wpa-supplicant preinstalled but there is another way to put wpa supplicant in the current build in the form of a binary

Instructions are

Download the wpa supplicant binary from this link

after this put this binary on any available ftp/http server, then download it to the /tmp directory onto your openwrt, add executable rights to it, and move it to the /usr/sbin (in windows use radienftp it is quite easy to setup)

Instruction : (in openwrt busybox issue following commands)

#cd /tmp

#wget ftp://user:pass@server_ip/wpa_supplicant

#chmod +x wpa_supplicant (make it executable)

#mv wpa_supplicant /usr/sbin

after this just configure cd /etc/config/wireless with the ssid of the router u wan to connect followed by the password

the corrrect syntax for wpa-psk config 'wifi-iface'

      option 'device' 'wifi0'
      option 'network' 'wan'
      option 'mode' 'sta'
      option 'key' '*********'
      option 'txpower' '19'
      option 'ssid' '**********'
      option 'encryption' '' (encryption you chosse psk,psk1)




Architecture: MIPS 4KEc V6.4
Vendor: Atheros
Bootloader: TPLINK proprietary after vxkiller (MICRO REDBOOT)
System-On-Chip Atheros AR2317
CPU/Speed 200 Mhz
Flash-Chip Cfeon f16-100HIP SPI
Flash size 2 MiB
RAM-chip EtronTech EM639165TS-6G
RAM: 16 MiB
Wireless: Atheros AR2317 802.11b/g (integrated)
Ethernet: Marvell 88E6060 switch
USB: no
Serial Yes


Model Number


Photo of front of the casing


Photo of back of the casing

Opening the case

Note: This will void your warranty!

  • To remove the cover do a/b/c

Main PCB

Photo of PCB


There is an unsoldered 4 pin connector near the reset button. (Where the black, red, blue wires plugged on the picture.) The pinout is: 1: 3.3V (closest the the reset button) 2: GND 3: RX 4:TX

Baud: 38400, 8n1

To revert back to Vxworks

Connect your router to your pc by ethernet cable, asign static IP to your PC - netmask try to ping telnet

=== IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH

BusyBox v1.15.3 (2010-04-26 19:06:00 EEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
Backfire (10.03, r20974) --------------------------
  * 1/3 shot Kahlua    In a shot glass, layer Kahlua
  * 1/3 shot Bailey's  on the bottom, then Bailey's,
  * 1/3 shot Vodka     then Vodka.
root@OpenWrt:/# vxrestore
3+0 records in
3+0 records out
2048+0 records in
2048+0 records out
Unlocking radio ...
Writing from /tmp/radio.rom to radio ...
Unlocking board ...
Writing from /tmp/mac.rom to board ...
All eeprom stuff is done!

Now for reverting back to VxWorks you need to:
 1) prepare raw VxWorks image from correct firmware update image
    by truncating first 20 bytes of it's header
    Be CAREFULL - choosing wrong image will brick your device!!!
2) put raw image into working TFTP server directory, say vxworks.raw
3) restart your unit with pressed RESET key for !!!LESS then 5 sec!!!
   be carefull, do not let to start this linux again because
   it will revert board eeprom to linux version on restart
4) telnet to
5) in RedBoot prompt do
RedBoot> ^C
RedBoot> ip_address -h                                                              
IP:, Default server:
RedBoot> load -r -b %{FREEMEMLO} vxworks.raw
Using default protocol (TFTP)
Raw file loaded 0x80033800-0x8010e587, assumed entry at 0x80033800
RedBoot> fis write -b %{FREEMEMLO} -l 0x120000 -f 0xbfc00000
* CAUTION * about to program FLASH
 at 0xbfc00000..0xbfd1ffff from 0x80033800 - continue (y/n)? y        
carefully wait here about a one-two minute for complition
... Erase from 0xbfc00000-0xbfd20000: ..
... Program from 0x80033800-0x80153800 at 0xbfc00000: 
        enjoy old days of VxWorks 


It is possible to implement a sd/mmc card modd on this router as it has a spi flash chip and hence uses spi bus the limitation of space can be overcome by this modd. A special kernel and rootfs containing the neccessary package required for openwrt to boot and opkg package system followed by the kernel modules required for SD/MMC modd (mod-mmc, kmod-mmc-over-gpio, kmod-mmc-spi, kmod-spi-bitbang, and kmod-spi-gpio) so that a sd/mmc card can be mounted. after this all other kernel modules and packages can be downloaded to the memory card

see the following post where similar setup has been done on same hardware (sd/mmc mod of 512mb on a usrobotic router with only 2mb flash) (sd/mmc mod on a d-link dir-300 based on atheros ar2317 processor the same onw used in this router)

Remember a total of 4 gpio pins are required for sd card modd Standard SD Card pinout sd card pinout

  • Pin 2 (Data In/MOSI)
  • Pin 7 (Data Out/MISO)
  • Pin 5 in SD Card (CLK)
  • Pin 1 in SD Card (Chip Select)

Anyone who found gpio pins or have any info regarding this modd for this router post in the forum


toh/tp-link/tl-wr542g.txt · Last modified: 2013/06/30 12:04 by lorema