Hacking the TP-Link TL-WR703N – Part 2: Bring it back from the dead (How to unbrick it)

This morning, I realized that I actually had a 3.3V UART in my house that I could use to connect to my bricked TL-WR703N‘s serial port .. the Raspberry Pi runs on 3.3v! I dug up the instructions on how to hook it up on the OpenWrt forum. After hooking it up, configuring it, and firing up PuTTY, I found via the serial terminal output that OpenWrt was booting up just fine, but that the ethernet port was disabled. The problem is that mine has the newer bootloader which disables the LAN port:

U-Boot 1.1.4 (Mar 21 2013 – 10:09:10)

In my haste to flash it with OpenWrt, I missed the Gotchas in the OpenWrt wiki.  It turns out that my version of the TL-WR703N boots up with the ethernet port disabled, and the version of OpenWrt that I installed did not enable it. Fortunately, nebbia88 posted a special firmware which enables both the LAN port and WiFi by default, which I downloaded from dropbox (20170927: link is dead. download it here). The next step was to figure out how to get it loaded into my TL-WR703N. Unfortunately, the Raspberry Pi serial port was too flaky. It was printing out gibberish.

Method #1: Failsafe Mode

This is the easiest way to unbrick a TL-WR703N, because it doesn’t require any soldering, or even opening up the case. YOU DON’T NEED TO ACCESS THE TL-WR703N’s SERIAL PORT.  However, it will only work if your TL-WR703N will actually go into failsafe mode.

To get it into failsafe mode, power up the unit. The blue LED will flash once, and then go off for a few seconds. As soon as the LED turns on again, press the reset button. The LED should begin flashing very quickly, indicating that you are in failsafe mode. OpenWrt will always enable the ethernet port, and set its IP number to 192.168.1.1 when in failsafe mode. Next, set your host computer’s ethernet IP number to 192.168.1.2, and connect a CAT-5 cable between the TL-WR703N and the computer.  Instructions for this how to do this in Windows are below.

Step 1: open the Ethernet adapter’s property sheet:

properties

Step 2: double click on Internet Protocol Version 4:

ipv4

Step 3: Set your IP address to 192.168.1.2 and click OK:

ip

Step 4: Telnet to your TL-WR703N, in Windows, you can use PuTTY:

telnet
Step 5: After PuTTY connects, and you hit the enter key, you should be presented with the OpenWrt console:
console

If you cannot telnet into the TL-WR703N and get a console as shown above, then you will have to proceed to Method #2.

Before we can flash our new firmware file, openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin, we need to transfer it to the TL-WR703N.  One way to do it is to use nc, which is documented here, but I found it easier to use wget, which is also available in failsafe mode. First, we need to set up an http server on the host computer to send the file to OpenWrt.  onehttpd is a handy minimalist web server which can handle the task.  In Windows, simply drag and drop the folder containing your firmware file on top of onehttp-0.8.exe to launch the web server.

Step 6: Get the file into the TL-WR703N from the OpenWrt failsafe console, and the flash it in:

root@(none):/# cd /tmp
root@(none):/tmp# wget http://192.168.1.2:8080/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin
root@(none):/tmp# sysupgrade openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin
root@(none):/tmp# reboot

After the unit reboots, you should be able to ping it at 192.168.1.1 via the ethernet port.

Method #2: Bootloader Mode:

If you are not able to successfully enter OpenWrt failsafe mode, the bootloader is the only way to load the firmware. After hacking your TL-WR703N serial port, Connect your 3.3V UART->USB adapter to your host computer and connect to its virtual serial port using communication parameters: 115200,N,8,1. Open up your terminal program to connect to the virtual serial port. I used PuTTY:

puttyserial

Power up the TL-WR703N, and type “tpl” (without the quotes) and then the enter key immediately after Autobooting in 1 seconds appears. If you do it correctly, you will get the hornet> prompt:

hornet

The timing is a bit tricky. If you fail, just power cycle the TL-WR703N and try again. You don’t need to reset your serial terminal between tries. The bootloader only supports tftp to receive the new firmware file. In Windows, tftp32 is a free server which works well. Download either the 32-bit or 64-bit version according to your version of Windows. Launch tftp32.exe (or tftp64.exe), set the Current Directory to the folder where your firmware file resides, and the Server interfaces to your ethernet adapter:

tftpd

From the hornet prompt in the serial console, issue the following commands:

hornet> setenv serverip 192.168.1.2
hornet> tftpboot 0x81000000 openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin
hornet> erase 0x9f020000 +0x3c0000
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
hornet> bootm 9f020000

After it’s done running the commands, wait a few seconds, and power cycle the unit. After it reboots, you should be able to access the unit via its ethernet port.

Previous: Hacking the TP-Link TL-WR703N – Part 1: Brick it and then hack its serial port

43 thoughts on “Hacking the TP-Link TL-WR703N – Part 2: Bring it back from the dead (How to unbrick it)”

  1. Can I flash the Original WR703N firmware instead of the OpenWRT firmware via serial console?

    I was on DD-WRT 24461 wich caused not able to UP nor Downgrade and now I need to go back stock firmware to start all over again.

  2. Hello,

    Can you tell me if I can flash my bricked WR702N via serial console?
    I think it was un chinese version but i’am not sure.
    Thank you in advance

    1. Sorry, but I don’t know, I have not tried it. The first thing you should try is to see if you can get the serial console working. I suspect that the procedures that work on the 703N will work on the 702N. Perhaps you should try to see if failsafe mode works before resorting to the serial console method.

  3. Hey nice work. I want to ask a question. I have SOM9331 router with same board AR9331 which your router have, my router is dead and I am not able to get its Ethernet interface. I can access its serial interface but its also of no use as serial screen remains blank. LED light on board is very very dim. I don’t know how to recover fro this situation.

  4. So maybe you can help me or send me in the correct direction, iv been searching for days so far and no luck. I have bricked my WR703N, not the easy one either, the one where you choose erase flash in uboot thinking it would leave the boot portion alone.. the only way is to JTAG i think. Well i have all the lines soldered up and a Raspberry pi to use along with the pinouts. I’m just not sure of the process, more specifically the commands or where to find them. Also not sure if i need to flash stock FW first or what. The LED status light is a dim blue on power on and does not blink. Any help would be amazing!

    1. The firmware and uboot are separate, so you don’t have to flash in stock firmware before OpenWRT.
      But I wasn’t able to find any way to fix a corrupted bootloader via JTAG. There’s some info here on running uboot in RAM, but I don’t quite understand it:
      https://github.com/pepe2k/u-boot_mod/issues/2
      The only sure way I can find to fix it is to pull the flash chip and program it externally, then put it back in. The procedure is how you upgrade the flash chip and can be found here:
      https://wiki.openwrt.org/toh/tp-link/tl-wr703n#mb_flash_mod
      If you ever find a fix that works, please post it here, so others can learn from you.
      Thanks.

  5. I did find and read that page previously but since I erased it, I would have no way to back up the previous chip to get the data it says to extract and put into the new chip. That is if I’m reading that correctly. So the main firmware is not on the 4mb flash chip? The back story behind this is I found this at Goodwill for 3$ and it had airenabler on it, I was trying to figure out how to erase that to install dd-wrt so I can use it as a router for projects.

    1. You would need to get a copy of the flash chip contents from someone else. Actually, the idea was to get a full image from someone and burn it directly into the chip, including boot & openwrt. You could just use the original chip. Must have good SMT skills to do it, of course.

  6. Upon closer inspection, the flash chip has the model number “cFeon 032b-104HIP” on it. I’ve got everything soldered up to try an in system program but flashrom does not seem to detect the chip, not sure if it’s not supported or that it matters if the chip is still attached to the board. Any ideas? I’m about to remove the chip and try it.

  7. Took the chip off the board and was able to read it using flashrom!! So super happy about that. Now I need to find a file to flash over.

  8. I finally got to where I can try flashing bin files over and I thought I would be golden after that, but that is not the case, I soldered wires from the chip to the board and I still have the dim blue light. So either the wires are too long or the flash is bad/in the incorrect spot. Not really sure how to proceed now.

    1. Wow, I really admire your persistence. 1) what are you using to flash the chip 2) what files are you trying to flash in, and where did you get them?

  9. I love learning about this stuff and the feeling you have when you get something working is like nothing else. I’m using a raspberry pi 2 with the gpio pins. When I run the flashrom program, it will display the chip model number so I have a good connection to the chip.

    As far as files go, I’m pretty sure they are the stock files, IV tried quite a few from different sources, I have about 10 bookmarks on info on this thing. Have not found anyone’s flash dumps however.

  10. I was under the assumption the stock firmware did include a uboot, that would be my problem then!! I’m gonna be busy the next couple days then I will try it and let you know how it goes! I think that will do the trick! Thank you!

  11. Success!!! Well kind of, I took a uboot file and padded it to the size of my chip then flashed it over and BOOM! It boots. From there I started putty up to connect to the serial and beautiful text was showing, I used your instructions and now have openWrt installed and I can view the settings now at 192.168.1.1. The only thing I have noticed, I cant find any settings for wifi, I assume this is because I killed the ART partition of the flash. Now I will have to figure out how to install that. Thank you again for your help so far!

    1. Totally awesome! Congrats for making it this far!
      If there’s anything I can dump from mine that would help, just let me know. I don’t know what commands I would need to do it, so you would have to give me that, as well.

    1. I think we should keep the discussion here for posterity’s sake.

      I logged into mine, and here are some interesting things from dmesg. Have a look at yours, and compare:

      1) partitions:

      [ 0.490000] 0x000000000000-0x000000030000 : “u-boot”
      [ 0.490000] 0x000000030000-0x000000040000 : “u-boot-env”
      [ 0.510000] 0x000000040000-0x000000050000 : “factory”
      [ 0.530000] 0x000000050000-0x000000800000 : “firmware”

      2) wifi regulatory domain setup:

      [ 22.440000] cfg80211: Calling CRDA to update world regulatory domain
      [ 22.440000] cfg80211: World regulatory domain updated:
      [ 22.460000] cfg80211: DFS Master region: unset
      [ 22.470000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_ga
      in, max_eirp), (dfs_cac_time)
      [ 22.490000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (N/A, 2000
      mBm), (N/A)
      [ 22.510000] cfg80211: (2457000 KHz – 2482000 KHz @ 40000 KHz), (N/A, 2000
      mBm), (N/A)
      [ 22.510000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (N/A, 2000
      mBm), (N/A)
      [ 22.540000] cfg80211: (5170000 KHz – 5250000 KHz @ 80000 KHz), (N/A, 2000
      mBm), (N/A)
      [ 22.550000] cfg80211: (5250000 KHz – 5330000 KHz @ 80000 KHz, 160000 KHz A
      UTO), (N/A, 2000 mBm), (0 s)
      [ 22.570000] cfg80211: (5490000 KHz – 5730000 KHz @ 160000 KHz), (N/A, 2000
      mBm), (0 s)
      [ 22.590000] cfg80211: (5735000 KHz – 5835000 KHz @ 80000 KHz), (N/A, 2000
      mBm), (N/A)
      [ 22.610000] cfg80211: (57240000 KHz – 63720000 KHz @ 2160000 KHz), (N/A, 0
      mBm), (N/A)

      3) more wifi stuff:

      [ 23.120000] ieee80211 phy0: rt2x00_set_rt: Info – RT chipset 5350, rev 0500
      detected
      [ 23.120000] ieee80211 phy0: rt2x00_set_rf: Info – RF chipset 5350 detected
      [ 23.120000] ieee80211 phy0: Selected rate control algorithm ‘minstrel_ht’

      I’m wondering if you see any of the wifi stuff in your dmesg.. if so, then I don’t think you’re missing a partition.

  12. root@OpenWrt:/# dmesg
    [ 0.000000] Linux version 3.7.9 (johnchan@johnchan-laptop) (gcc version 4.6.4 20121210 (prerelease) (Linaro GCC 4.6-2012.12) ) #4 Sat Feb 23 00:21:01 EST 2013
    [ 0.000000] MyLoader: sysp=b7d0416e, boardp=c94fff79, parts=c52223a7
    [ 0.000000] bootconsole [early0] enabled
    [ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
    [ 0.000000] SoC: Atheros AR9330 rev 1
    [ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
    [ 0.000000] Determined physical RAM map:
    [ 0.000000] memory: 02000000 @ 00000000 (usable)
    [ 0.000000] Initrd not found or empty – disabling initrd
    [ 0.000000] Zone ranges:
    [ 0.000000] Normal [mem 0x00000000-0x01ffffff]
    [ 0.000000] Movable zone start for each node
    [ 0.000000] Early memory node ranges
    [ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
    [ 0.000000] On node 0 totalpages: 8192
    [ 0.000000] free_area_init_node: node 0, pgdat 802bfc90, node_mem_map 81000000
    [ 0.000000] Normal zone: 64 pages used for memmap
    [ 0.000000] Normal zone: 0 pages reserved
    [ 0.000000] Normal zone: 8128 pages, LIFO batch:0
    [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
    [ 0.000000] pcpu-alloc: [0] 0
    [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
    [ 0.000000] Kernel command line: board=TL-WR703N console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
    [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
    [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    [ 0.000000] __ex_table already sorted, skipping sort
    [ 0.000000] Writing ErrCtl register=00000000
    [ 0.000000] Readback ErrCtl register=00000000
    [ 0.000000] Memory: 29112k/32768k available (2111k kernel code, 3656k reserved, 409k data, 228k init, 0k highmem)
    [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    [ 0.000000] NR_IRQS:51
    [ 0.080000] Calibrating delay loop… 265.42 BogoMIPS (lpj=1327104)
    [ 0.080000] pid_max: default: 32768 minimum: 301
    [ 0.080000] Mount-cache hash table entries: 512
    [ 0.090000] NET: Registered protocol family 16
    [ 0.090000] MIPS: machine is TP-LINK TL-WR703N v1
    [ 0.350000] bio: create slab at 0
    [ 0.350000] Switching to clocksource MIPS
    [ 0.360000] NET: Registered protocol family 2
    [ 0.360000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    [ 0.370000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    [ 0.380000] TCP: Hash tables configured (established 1024 bind 1024)
    [ 0.380000] TCP: reno registered
    [ 0.380000] UDP hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.390000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.400000] NET: Registered protocol family 1
    [ 0.400000] PCI: CLS 0 bytes, default 32
    [ 0.420000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [ 0.420000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    [ 0.440000] msgmni has been set to 56
    [ 0.440000] io scheduler noop registered
    [ 0.440000] io scheduler deadline registered (default)
    [ 0.450000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    [ 0.460000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
    [ 0.460000] console [ttyATH0] enabled, bootconsole disabled
    [ 0.470000] ath79-spi ath79-spi: master is unqueued, this is deprecated
    [ 0.480000] m25p80 spi0.0: found en25q32b, expected m25p80
    [ 0.490000] m25p80 spi0.0: en25q32b (4096 Kbytes)
    [ 0.490000] 5 tp-link partitions found on MTD device spi0.0
    [ 0.500000] Creating 5 MTD partitions on “spi0.0”:
    [ 0.500000] 0x000000000000-0x000000020000 : “u-boot”
    [ 0.510000] 0x000000020000-0x0000000fdf88 : “kernel”
    [ 0.510000] mtd: partition “kernel” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only
    [ 0.530000] 0x0000000fdf88-0x0000003f0000 : “rootfs”
    [ 0.530000] mtd: partition “rootfs” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only
    [ 0.540000] mtd: partition “rootfs” set to be root filesystem
    [ 0.550000] mtd: partition “rootfs_data” created automatically, ofs=2D0000, len=120000
    [ 0.560000] 0x0000002d0000-0x0000003f0000 : “rootfs_data”
    [ 0.560000] 0x0000003f0000-0x000000400000 : “art”
    [ 0.570000] 0x000000020000-0x0000003f0000 : “firmware”
    [ 0.590000] libphy: ag71xx_mdio: probed
    [ 0.590000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
    [ 1.150000] ag71xx ag71xx.0 eth0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
    [ 1.160000] TCP: cubic registered
    [ 1.160000] NET: Registered protocol family 17
    [ 1.160000] 8021q: 802.1Q VLAN Support v1.8
    [ 1.170000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
    [ 1.180000] Freeing unused kernel memory: 228k freed
    [ 3.500000] Registered led device: tp-link:blue:system
    [ 6.210000] eth0: link up (100Mbps/Full duplex)
    [ 6.310000] jffs2: notice: (414) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 16 of xref (0 dead, 3 orphan) found.
    [ 6.520000] eth0: link down
    [ 8.430000] Compat-drivers backport release: compat-drivers-2013-01-08-3
    [ 8.440000] Backport based on wireless-testing.git master-2013-01-07
    [ 8.440000] compat.git: wireless-testing.git
    [ 8.520000] cfg80211: Calling CRDA to update world regulatory domain
    [ 8.520000] cfg80211: World regulatory domain updated:
    [ 8.530000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp)
    [ 8.530000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
    [ 8.540000] cfg80211: (2457000 KHz – 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
    [ 8.550000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
    [ 8.560000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
    [ 8.560000] cfg80211: (5735000 KHz – 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
    [ 8.880000] usbcore: registered new interface driver usbfs
    [ 8.880000] usbcore: registered new interface driver hub
    [ 8.890000] usbcore: registered new device driver usb
    [ 9.480000] ath: phy0: Unable to initialize hardware; initialization status: -5
    [ 9.490000] ath9k ar933x_wmac: failed to initialize device
    [ 9.490000] ath9k: probe of ar933x_wmac failed with error -5
    [ 9.540000] PPP generic driver version 2.4.2
    [ 9.790000] ip_tables: (C) 2000-2006 Netfilter Core Team
    [ 10.010000] NET: Registered protocol family 24
    [ 10.030000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
    [ 10.040000] ehci-platform ehci-platform: Generic Platform EHCI Controller
    [ 10.040000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
    [ 10.080000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
    [ 10.100000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
    [ 10.100000] hub 1-0:1.0: USB hub found
    [ 10.100000] hub 1-0:1.0: 1 port detected
    [ 10.130000] nf_conntrack version 0.5.0 (458 buckets, 1832 max)
    [ 14.290000] device eth0 entered promiscuous mode
    [ 14.430000] eth0: link up (100Mbps/Full duplex)
    [ 14.430000] br-lan: port 1(eth0) entered forwarding state
    [ 14.440000] br-lan: port 1(eth0) entered forwarding state
    [ 16.440000] br-lan: port 1(eth0) entered forwarding state

    1. Yeah, your wifi isn’t initializing properly, and your partitions are messed up.

      Oops, I just realized that the boot log I posted above is actually for a different OpenWrt router of mine. Anyway, I just checked, and mine is rev 1.6, so I don’t know if it’s compatible, but if you like, I can dump the partitions for you. Your partitions are not loaded in the proper locations. This is from the boot log in the OpenWrt wiki:

      0x000000000000-0x000000020000 : “u-boot”
      0x000000020000-0x000000120000 : “kernel”
      0x000000120000-0x0000003f0000 : “rootfs”
      mtd: partition “rootfs” set to be root filesystem
      mtd: partition “rootfs_data” created automatically, ofs=2A0000, len=150000
      0x0000002a0000-0x0000003f0000 : “rootfs_data”
      0x0000003f0000-0x000000400000 : “art”
      0x000000020000-0x0000003f0000 : “firmware”

      https://wiki.openwrt.org/toh/tp-link/tl-wr703n

  13. I’ve got nothing to loose trying it, it looks like my kernel is in the wrong spot but everything else is correct, I wonder how that would be wrong. Maybe from the modded bootloader?

  14. I used yours found in this article for the main firmware, and I wrote the uboot at the beginning of the chip. I also remember the uboot file size being 124 or 128, not 64kb

      1. Ok so those were the files I flashed before, I used the LuCI web interface to flash the squashfs-factory.bin, my dmesg was the same as before. When I flashed the jffs2-factory.bin my partitions match yours. What is the difference between the two? Also Wifi still does not work.

          1. Actually its off a bit still, this dmesg is the openwrt-ar71xx-generic-tl-wr703n-v1-jffs2-factory.bin installed with LuCI

            root@OpenWrt:/# dmesg
            [ 0.000000] Linux version 3.3.8 (tor2@toor) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Sat Dec 22 15:03:08 CET 2012
            [ 0.000000] MyLoader: sysp=b7d0416e, boardp=c94fff79, parts=c52223a7
            [ 0.000000] bootconsole [early0] enabled
            [ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
            [ 0.000000] SoC: Atheros AR9330 rev 1
            [ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
            [ 0.000000] Determined physical RAM map:
            [ 0.000000] memory: 02000000 @ 00000000 (usable)
            [ 0.000000] Initrd not found or empty – disabling initrd
            [ 0.000000] Zone PFN ranges:
            [ 0.000000] Normal 0x00000000 -> 0x00002000
            [ 0.000000] Movable zone start PFN for each node
            [ 0.000000] Early memory PFN ranges
            [ 0.000000] 0: 0x00000000 -> 0x00002000
            [ 0.000000] On node 0 totalpages: 8192
            [ 0.000000] free_area_init_node: node 0, pgdat 802cc0d0, node_mem_map 81000000
            [ 0.000000] Normal zone: 64 pages used for memmap
            [ 0.000000] Normal zone: 0 pages reserved
            [ 0.000000] Normal zone: 8128 pages, LIFO batch:0
            [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
            [ 0.000000] pcpu-alloc: [0] 0
            [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
            [ 0.000000] Kernel command line: board=TL-WR703N console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
            [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
            [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
            [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
            [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
            [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
            [ 0.000000] Writing ErrCtl register=00000000
            [ 0.000000] Readback ErrCtl register=00000000
            [ 0.000000] Memory: 29156k/32768k available (2084k kernel code, 3612k reserved, 397k data, 208k init, 0k highmem)
            [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
            [ 0.000000] NR_IRQS:51
            [ 0.000000] Calibrating delay loop… 265.42 BogoMIPS (lpj=1327104)
            [ 0.080000] pid_max: default: 32768 minimum: 301
            [ 0.080000] Mount-cache hash table entries: 512
            [ 0.090000] NET: Registered protocol family 16
            [ 0.090000] gpiochip_add: registered GPIOs 0 to 29 on device: ath79
            [ 0.100000] MIPS: machine is TP-LINK TL-WR703N v1
            [ 0.350000] bio: create slab at 0
            [ 0.360000] Switching to clocksource MIPS
            [ 0.360000] NET: Registered protocol family 2
            [ 0.370000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
            [ 0.370000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
            [ 0.380000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
            [ 0.380000] TCP: Hash tables configured (established 1024 bind 1024)
            [ 0.390000] TCP reno registered
            [ 0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
            [ 0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
            [ 0.400000] NET: Registered protocol family 1
            [ 0.410000] PCI: CLS 0 bytes, default 32
            [ 0.430000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
            [ 0.430000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
            [ 0.440000] msgmni has been set to 56
            [ 0.440000] io scheduler noop registered
            [ 0.450000] io scheduler deadline registered (default)
            [ 0.450000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
            [ 0.460000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
            [ 0.470000] console [ttyATH0] enabled, bootconsole disabled
            [ 0.480000] m25p80 spi0.0: found en25q32b, expected m25p80
            [ 0.490000] m25p80 spi0.0: en25q32b (4096 Kbytes)
            [ 0.490000] 5 tp-link partitions found on MTD device spi0.0
            [ 0.500000] Creating 5 MTD partitions on “spi0.0”:
            [ 0.500000] 0x000000000000-0x000000020000 : “u-boot”
            [ 0.510000] 0x000000020000-0x000000100000 : “kernel”
            [ 0.510000] 0x000000100000-0x0000003f0000 : “rootfs”
            [ 0.520000] mtd: partition “rootfs” set to be root filesystem
            [ 0.520000] split_squashfs: no squashfs found in “spi0.0”
            [ 0.530000] 0x0000003f0000-0x000000400000 : “art”
            [ 0.540000] 0x000000020000-0x0000003f0000 : “firmware”
            [ 0.560000] ag71xx_mdio: probed
            [ 0.560000] eth0: Atheros AG71xx at 0xb9000000, irq 4
            [ 1.120000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:00 [uid=004dd041, driver=Generic PHY]
            [ 1.130000] TCP cubic registered
            [ 1.130000] NET: Registered protocol family 17
            [ 1.130000] 8021q: 802.1Q VLAN Support v1.8
            [ 2.120000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x2b0000
            [ 2.130000] jffs2_build_filesystem(): unlocking the mtd device… done.
            [ 2.130000] jffs2_build_filesystem(): erasing all blocks after the end marker… done.
            [ 3.470000] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
            [ 3.480000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
            [ 3.490000] Freeing unused kernel memory: 208k freed
            [ 5.590000] Registered led device: tp-link:blue:system
            [ 8.120000] eth0: link up (100Mbps/Full duplex)
            [ 8.850000] eth0: link down
            [ 9.620000] Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993
            [ 9.620000] Backport based on wireless-testing.git master-2012-09-07
            [ 9.630000] compat.git: wireless-testing.git
            [ 9.770000] cfg80211: Calling CRDA to update world regulatory domain
            [ 9.780000] cfg80211: World regulatory domain updated:
            [ 9.780000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp)
            [ 9.790000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
            [ 9.800000] cfg80211: (2457000 KHz – 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
            [ 9.810000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
            [ 9.820000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
            [ 9.820000] cfg80211: (5735000 KHz – 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
            [ 10.020000] usbcore: registered new interface driver usbfs
            [ 10.030000] usbcore: registered new interface driver hub
            [ 10.030000] usbcore: registered new device driver usb
            [ 10.640000] ath: phy0: Unable to initialize hardware; initialization status: -5
            [ 10.640000] ath9k ar933x_wmac: failed to initialize device
            [ 10.650000] ath9k: probe of ar933x_wmac failed with error -5
            [ 10.710000] PPP generic driver version 2.4.2
            [ 10.790000] ip_tables: (C) 2000-2006 Netfilter Core Team
            [ 10.930000] NET: Registered protocol family 24
            [ 10.970000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
            [ 10.980000] ehci-platform ehci-platform: Generic Platform EHCI Controller
            [ 10.990000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
            [ 11.020000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
            [ 11.040000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
            [ 11.040000] hub 1-0:1.0: USB hub found
            [ 11.040000] hub 1-0:1.0: 1 port detected
            [ 11.100000] nf_conntrack version 0.5.0 (458 buckets, 1832 max)
            [ 11.420000] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver
            [ 14.130000] device eth0 entered promiscuous mode
            [ 15.120000] eth0: link up (100Mbps/Full duplex)
            [ 15.120000] br-lan: port 1(eth0) entered forwarding state
            [ 15.130000] br-lan: port 1(eth0) entered forwarding state
            [ 17.130000] br-lan: port 1(eth0) entered forwarding state

          2. I forgot to mention the diff with JFFS2 and SQUASHFS.. different formats for storing file systems in flash.
            I forget why I decided JFFS2 is better.
            OK, so it looks better than before. I will try to dump my art partition when I get some free time.
            Do you happen to know the dump/restore commands offhand, so I don’t have to look them up?

    1. I used a flash drive plugged into the USB port to copy the files out. For some reason, SCP wasn’t working today.
      My partition map:

      # cat /proc/mtd
      dev: size erasesize name
      mtd0: 00020000 00010000 “u-boot”
      mtd1: 000e1c10 00010000 “kernel”
      mtd2: 002ee3f0 00010000 “rootfs”
      mtd3: 00080000 00010000 “rootfs_data”
      mtd4: 00010000 00010000 “art”
      mtd5: 003d0000 00010000 “firmware”

      I backed up u-boot, art, and firmware for you.
      Download here: https://drive.google.com/open?id=0B3uBHX8TRsp5NC1NT3kyc0RYVTg

      Hope it helps! Keep me posted!

  15. I think I flashed the art file but not 100%. The wifi still does not work, how do I access the USB drive in uboot by chance? I have looked around and spent a while trying to locate it. I would like to do a backup of the art file and do a compare with your file. I also flashed your firmware for fun and it had no UI in the web browser so I flashed my other back.

    1. I don’t think you can access the USB drive in u-boot. You have to use TFTP via the ethernet port.
      I built the openwrt myself, and added stuff to automount the USB flash drive in /mnt/sda1. I’m not sure
      if it will work without my kernel/root/rootfs partitions. If you like, I can back those up for you as well.
      Unfortunately, I lost my firmware image. Yes, I didn’t compile in the Web GUI, in order to save space, but configuration
      via files is rather easy.
      I did some research, and apparently, the ART partitions should be OK to copy from one unit to another with same hardware.
      I doubt there was any change in the atheros part between 1.6 & 1.7.
      I also have a copy of the original chinese firmware, if you want to try flashing that in

        1. Okay, progress! It took many many trial and errors until i figured out the correct memory address and flash address. I used the following commands:
          tftpboot 0x80800000 art.backup
          erase 0x9f3f0000 +0x10000
          cp.b 0x80800000 0x9f3f0000 0x10000

          after that with a reboot, I now have a WiFi tab!! Now the problem is getting internet through it. I can successfully connect to it with my laptop using and edit settings. I’ve tried plugging a line from my modem to the router but my phone or laptop will say connected with no internet. I can also search for wifi with the router and connect to my main router, but it shows zero signal and zero dbm. Not sure why that it, but under the list of connections it shows a 100% strength.

          1. A small update, I changed the firmware to openwrt-special-wr703n-v1, it has a different interface then all the other openwrt I have tried. Anyway, all the menus work unlike the openwrt_tl-wr703n_base_2013-02-23_squash-factory bins. Anyway, I was able to successfully ping google and tried to install the files so I can bridge the router and it came back unknown package. I used the commands: opkg install relayd, opkg install luci-proto-relay. Not sure what I can do. Also this was all over wifi and using the eth port to use LUCI. So I guess thats good I got a ping over wifi.

  16. Sorry for the multi post but this is exciting! I did some more messing around with the settings and my network. I now have this actually working as a wireless AP. The test setup was this, wired gigabit network to my room on a gigabit switch, PC on one port and 703n on another port. changed the settings on the 703n so I can access my main dd-wrt router and the openwrt router at the same time wireless connected to the 703n. Speedtest on the 703n was 43 down and 5 up. Wired PC was 65 down and 5 up. That tells me the ART is working pretty darn well. So dare I say im 100% back from the dead? I would love to get wifi to Ethernet working, still not sure why I cant download those packages.

    1. Looks like you’re back in business! Congrats! You shouldn’t have to install any packages with the typical OpenWrt image. The setup to get it to talk out the Ethernet via LuCI is kind of esoteric & fiddly.. I always have trouble understanding it when I go to a new platform, but eventually get it working. I think something is wrong w/ your bridging setup.

      Via SSH, is your box able to ping sites external to your LAN? If not, that’s why opkg won’t download stuff. If you’re sure you need to update packages, you can just download the ipk files externally, move them to openwrt, and run opkg on the local ipk file.

  17. I’ve been pretty busy lately so I’ll have to mess with it when I get a chance.

    I have to say thank you so much!! I would not have been able to do this without your help or ART file. I really appreciate you taking the time to help. I posted in a few other places and no one else has really tried to help at all.

  18. Hi. I just wanted to thank you for this article. It is amazing. I found it about a year ago and I liked it so much. Today I needed to read this again and it helped me again. Thanks again. Keep up the good work 🙂

Leave a Reply