This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
toh:tp-link:tl-wr542g [2012/11/17 12:18] jow remove paid links |
toh:tp-link:tl-wr542g [2016/08/14 21:27] (current) xssa [Installation of VxKiller-Image] |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== TP-Link TL-WR542g ====== | ||
+ | This is a quite cheap 802.11g soho router. Due the small amount of flash and RAM it cannot be offically supported by OpenWrt.There is no way to flash PRODUCTION OpenWrt firmware through TP-Link's WEB directly, because of the limitation that it can accept only images less then 1179648 bytes long(hardcoded in firmware) so to get over this problem a vxkiller image (Backfire10.3 stripped heavily with MicroRedboot bootloader adapted for 2mb flash and 16mb ram) was developed by member xssa from forum | ||
+ | |||
+ | any questions releated to debuging please refer to the forum | ||
+ | |||
+ | https://forum.openwrt.org/viewtopic.php?id=17252&p | ||
+ | |||
+ | |||
+ | |||
+ | ===== Supported Versions ===== | ||
+ | ^ Version/Model ^ Launch Date ^ S/N ^ OpenWrt Version Supported ^ Model Specific Notes ^ | ||
+ | | v? | 20??-?? | - | **not by any official firmware image** | similar to [[toh/tp-link/wr340gd]] | | ||
+ | |||
+ | |||
+ | ===== Hardware Highlights ===== | ||
+ | ^ CPU ^ Ram ^ Flash ^ USB ^ Serial ^ JTag ^ | ||
+ | | Atheros AR2317 | 16MiB | 2MiB | No | Yes | No | | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | ===== Installation ===== | ||
+ | TP-Link's web interface has a hardcoded limitation that it only accepts images less then 1.179.648 Bytes long. So you cannot even use the entire space available for a OpenWrt build. But you can surpass this problem by flashing a special OpenWrt firmware image called "VxKiller" developed by xssa first, and only then the actual firmware. | ||
+ | |||
+ | |||
+ | ==== Installation of VxKiller-Image ==== | ||
+ | "VxKiller" is a heavily stripped OpenWrt Backfire 10.03 with MicroRedboot bootloader adapted for 2MiB flash and 16MiB RAM. There is | ||
+ | * no working DHCP server | ||
+ | * no wireless driver | ||
+ | * no WebUI | ||
+ | * no SSH daemon | ||
+ | * no writable RootFS | ||
+ | on this image. Its only purpose is to fit into the specs that the TP-Link's web interfaces accepts. | ||
+ | |||
+ | **''Note:''** This VxKiller was originally developed for the TP-LINK WR340G router which is the same hardware as the WR542G excluding the 16MB ram found in the wr542g | ||
+ | |||
+ | - download special OpenWrt Image "VxKiller" by XSSA: http://www.4shared.com/folder/cUkhCEJf/vxkiller.html | ||
+ | - upgrade your TL-WR542G with the "wr340v5_linux.bin" (vxkiller) through TP-Link's web interface. After second reboot you can telnet 192.168.1.1 to VxKiller firmware | ||
+ | |||
+ | |||
+ | ==== Installation of full OpenWrt build ==== | ||
+ | | **PREBUILT KERNEL AND ROOTFS MADE BY XSSA** | | ||
+ | | username:root,password:ar2317 | | ||
+ | |||
+ | - download Kernel (custom load address for kernel is 80033800) http://www.4shared.com/file/QNM7HCW8/openwrt-atheros-vmlinux.html | ||
+ | - download RootFS (IP Address is 192.168.1.55 logon with root/ar2317) http://www.4shared.com/file/RbLcfmY1/rootsq.html | ||
+ | - connect to the bootloader ([[doc:techref:bootloader:RedBoot]]) and do <code> | ||
+ | fis init ( Erases Flash rom ) | ||
+ | ip_addr -h ( ip of TFTP server ) | ||
+ | load -r -v -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma ( loads kernel to ram ) | ||
+ | fis create -r 0x80033800 -e 0x80033800 vmlinux.bin.l7 ( Write's kernel to flash custom load address for kernel is 80033800 current kernel is 2.6 ) | ||
+ | fis free ( calculate in hexadecimal base 16 next erase block by using bc bc in linux ) | ||
+ | load -r -v -b %{FREEMEMLO} openwrt-atheros-root.squashfs ( loads kernel to ram ) | ||
+ | fis create -l 0x130000 rootfs ( Write's to flash Default erase block addrees for xssa image ) | ||
+ | reset ( Restart's router ) | ||
+ | </code> | ||
+ | - optionally do:<code> | ||
+ | fis load -l vmlinux.bin.l7 ( for loading kernel from flash to ram ) | ||
+ | exec ( for executing kernel from ram ) | ||
+ | </code> | ||
+ | |||
+ | |||
+ | ===== WPA SUPPLICANT ===== | ||
+ | -> cf. [[doc:howto:wireless.overview]] and [[doc:howto:wireless.utilities]] | ||
+ | |||
+ | * **Only Routed Client Mode works with the rootfs and kernel given here as dhcp server(dnsmasq) and firewall is not included in this build to save space** | ||
+ | * **Remember:Client Bridge is not supported by atheros chipset by default due to the driver's limitation** | ||
+ | |||
+ | Okay the rootfs and kernel you flashed to your router does not have opkg package system nor does it have wpa-supplicant preinstalled but there is another way to put wpa supplicant in the current build in the form of a binary | ||
+ | |||
+ | **Instructions are** | ||
+ | |||
+ | Download the wpa supplicant binary from this link | ||
+ | http://www.4shared.com/file/yBT313LX/wpa_supplicant.html | ||
+ | |||
+ | after this put this binary on any available | ||
+ | ftp/http server, then download it to the /tmp directory onto your | ||
+ | openwrt, add executable rights to it, and move it to the /usr/sbin | ||
+ | (in windows use radienftp it is quite easy to setup) | ||
+ | |||
+ | **Instruction : ** (in openwrt busybox issue following commands) | ||
+ | |||
+ | #cd /tmp | ||
+ | |||
+ | #wget ftp://user:pass@server_ip/wpa_supplicant | ||
+ | |||
+ | #chmod +x wpa_supplicant (make it executable) | ||
+ | |||
+ | #mv wpa_supplicant /usr/sbin | ||
+ | |||
+ | after this just configure cd /etc/config/wireless with the ssid of the router u wan to connect followed by the password | ||
+ | |||
+ | the corrrect syntax for wpa-psk | ||
+ | config 'wifi-iface' | ||
+ | option 'device' 'wifi0' | ||
+ | option 'network' 'wan' | ||
+ | option 'mode' 'sta' | ||
+ | option 'key' '*********' | ||
+ | option 'txpower' '19' | ||
+ | option 'ssid' '**********' | ||
+ | option 'encryption' '' (encryption you chosse psk,psk1) | ||
+ | |||
+ | |||
+ | **THIS METHOD WAS GIVEN BY XSSA THIS IS HIS BINARY** | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | ===== Hardware ===== | ||
+ | ==== Info ==== | ||
+ | | **Architecture:** MIPS 4KEc V6.4 | | ||
+ | | **Vendor:** Atheros | | ||
+ | | **Bootloader:** TPLINK proprietary after vxkiller (MICRO REDBOOT) | | ||
+ | | **System-On-Chip** Atheros AR2317 | | ||
+ | | **CPU/Speed** 200 Mhz | | ||
+ | | **Flash-Chip** Cfeon f16-100HIP SPI | | ||
+ | | **Flash size** 2 MiB | | ||
+ | | **RAM-chip** EtronTech EM639165TS-6G | | ||
+ | | **RAM:** 16 MiB | | ||
+ | | **Wireless:** Atheros AR2317 802.11b/g (integrated) | | ||
+ | | **Ethernet:** Marvell 88E6060 switch | | ||
+ | | **USB:** no | | ||
+ | | **Serial** [[#Serial|Yes]] | | ||
+ | | **JTAG:** No | | ||
+ | |||
+ | ==== Photos ==== | ||
+ | Model Number | ||
+ | |||
+ | //Front:// | ||
+ | |||
+ | **Photo of front of the casing** | ||
+ | |||
+ | //Back:// | ||
+ | |||
+ | **Photo of back of the casing** | ||
+ | |||
+ | ==== Opening the case ==== | ||
+ | **Note:** This will void your warranty! | ||
+ | |||
+ | *To remove the cover do a/b/c | ||
+ | |||
+ | //Main PCB// | ||
+ | |||
+ | **Photo of PCB** | ||
+ | |||
+ | ==== Serial ==== | ||
+ | There is an unsoldered 4 pin connector near the reset button. (Where the black, red, blue wires plugged on the picture.) The pinout is: 1: 3.3V (closest the the reset button) 2: GND 3: RX 4:TX | ||
+ | |||
+ | Baud: 38400, 8n1 | ||
+ | |||
+ | ===== To revert back to Vxworks ===== | ||
+ | Connect your router to your pc by ethernet cable, asign static IP to your PC - 192.168.1.10 netmask 255.255.255.0 | ||
+ | try to | ||
+ | ping 192.168.1.1 | ||
+ | telnet 192.168.1.1 | ||
+ | |||
+ | |||
+ | <code> | ||
+ | === IMPORTANT ============================ | ||
+ | Use 'passwd' to set your login password | ||
+ | this will disable telnet and enable SSH | ||
+ | ------------------------------------------ | ||
+ | |||
+ | |||
+ | BusyBox v1.15.3 (2010-04-26 19:06:00 EEST) built-in shell (ash) | ||
+ | Enter 'help' for a list of built-in commands. | ||
+ | |||
+ | _______ ________ __ | ||
+ | | |.-----.-----.-----.| | | |.----.| |_ | ||
+ | | - || _ | -__| || | | || _|| _| | ||
+ | |_______|| __|_____|__|__||________||__| |____| | ||
+ | |__| W I R E L E S S F R E E D O M | ||
+ | Backfire (10.03, r20974) -------------------------- | ||
+ | * 1/3 shot Kahlua In a shot glass, layer Kahlua | ||
+ | * 1/3 shot Bailey's on the bottom, then Bailey's, | ||
+ | * 1/3 shot Vodka then Vodka. | ||
+ | --------------------------------------------------- | ||
+ | root@OpenWrt:/# vxrestore | ||
+ | 3+0 records in | ||
+ | 3+0 records out | ||
+ | 2048+0 records in | ||
+ | 2048+0 records out | ||
+ | Unlocking radio ... | ||
+ | Writing from /tmp/radio.rom to radio ... | ||
+ | Unlocking board ... | ||
+ | Writing from /tmp/mac.rom to board ... | ||
+ | All eeprom stuff is done! | ||
+ | |||
+ | Now for reverting back to VxWorks you need to: | ||
+ | 1) prepare raw VxWorks image from correct firmware update image | ||
+ | by truncating first 20 bytes of it's header | ||
+ | Be CAREFULL - choosing wrong image will brick your device!!! | ||
+ | 2) put raw image into working TFTP server directory, say vxworks.raw | ||
+ | 3) restart your unit with pressed RESET key for !!!LESS then 5 sec!!! | ||
+ | be carefull, do not let to start this linux again because | ||
+ | it will revert board eeprom to linux version on restart | ||
+ | 4) telnet to 192.168.1.1:9000 | ||
+ | 5) in RedBoot prompt do | ||
+ | RedBoot> ^C | ||
+ | RedBoot> ip_address -h 192.168.1.10 | ||
+ | IP: 192.168.1.1, Default server: 192.168.1.10 | ||
+ | RedBoot> load -r -b %{FREEMEMLO} vxworks.raw | ||
+ | Using default protocol (TFTP) | ||
+ | Raw file loaded 0x80033800-0x8010e587, assumed entry at 0x80033800 | ||
+ | RedBoot> fis write -b %{FREEMEMLO} -l 0x120000 -f 0xbfc00000 | ||
+ | * CAUTION * about to program FLASH | ||
+ | at 0xbfc00000..0xbfd1ffff from 0x80033800 - continue (y/n)? y | ||
+ | carefully wait here about a one-two minute for complition | ||
+ | ... Erase from 0xbfc00000-0xbfd20000: .. | ||
+ | ... Program from 0x80033800-0x80153800 at 0xbfc00000: | ||
+ | RedBoot>reset | ||
+ | enjoy old days of VxWorks | ||
+ | </code> | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | ===== SD/MMC CARD MODD WIP gpio ===== | ||
+ | **It** is possible to implement a sd/mmc card modd on this router as it has a spi flash chip and hence uses spi bus the limitation of space can be overcome by this modd. A special kernel and rootfs containing the neccessary package required for openwrt to boot and opkg package system followed by the kernel modules required for SD/MMC modd (mod-mmc, kmod-mmc-over-gpio, kmod-mmc-spi, kmod-spi-bitbang, and kmod-spi-gpio) so that a sd/mmc card can be mounted. after this all other kernel modules and packages can be downloaded to the memory card | ||
+ | |||
+ | see the following post where similar setup has been done on same hardware | ||
+ | |||
+ | https://forum.openwrt.org/viewtopic.php?id=25368 (sd/mmc mod of 512mb on a usrobotic router with only 2mb flash) | ||
+ | |||
+ | http://tinyhack.com/2010/04/04/d-link-dir-300-serial-port-and-sd-mod/ (sd/mmc mod on a d-link dir-300 based on atheros ar2317 processor the same onw used in this router) | ||
+ | |||
+ | **Remember** | ||
+ | a total of 4 gpio pins are required for sd card modd | ||
+ | Standard SD Card pinout | ||
+ | sd card pinout | ||
+ | |||
+ | * Pin 2 (Data In/MOSI) | ||
+ | * Pin 7 (Data Out/MISO) | ||
+ | * Pin 5 in SD Card (CLK) | ||
+ | * Pin 1 in SD Card (Chip Select) | ||
+ | |||
+ | Anyone who found gpio pins or have any info regarding this modd for this router post in the forum | ||
+ | https://forum.openwrt.org/viewtopic.php?id=17252&p=8 | ||
+ | |||
+ | |||
+ | |||
+ | ===== Tags ===== | ||
+ | {{tag>2Flash}} |