TP-Link TL-WR810N

TP-Link TL-WR810N

Same form factor as the TL-WR710N.
Powered from AC electric wall-socket, so the USB port delivers 5V, 1A and can power and charge a device.

Supported Versions

Hardware Highlights

Installation

Beware: ath79 Image for the TL-WR810N v1.1 (EU) is currently broken and will result in a soft-bricked device. Use the ar71xx image (http://downloads.openwrt.org/releases/19.07.7/targets/ar71xx/generic/) instead! See thread: https://forum.openwrt.org/t/tp-link-tl-wr810n-v1-ath79/48267. Update: OpenWRT 19.07.7 ath79 now does not result in a boot-loop on this device, but USB will not provide power. Snapshots from 27.2.2021 onward have USB-power-issue fixed, 21.02-rc2 should also have it fixed, see: ?p=openwrt/openwrt.git;a=commitdiff;h=62099d98e4746d8a4e9ee79360314c1900c8974e.

Recovery after this soft-brick may be possible via the tftpd method (see below).

TL-WR810N(EU) 1.1

Flashing using the factory firmware web interface

Install the OpenWrt factory image by doing a “firmware upgrade” through the web interface of the factory firmware.
After the installation completes, point your web browser to http://192.168.1.1, the IP address OpenWrt uses by default.

Flashing using TFTP only (without serial console)

Connect one of the ethernet ports to a host computer.
Change your host computer's IP address to 192.168.0.66/24. Note that the WR810N will have the IP address 192.168.0.86/24.
Run a TFTP server on your host computer.
Rename the OpenWrt factory image to wr810nv1_tp_recovery.bin and make it available via the TFTP server.
Press the 'WPS/Reset' button while powering up the device.
The bootloader will now load and flash the image from the TFTP server.

Flashing using the serial console

Gain serial access to the bootloader.
Connect one of the LAN ports to a host computer via an ethernet cable.
Change your host computer's IP address to 192.168.1.10/24.
Run a TFTP server on your host computer.
Make the OpenWrt factory image available via the TFTP server.

Enter the following commands into the bootloader prompt:

tftp  0x80800000 openwrt-ar71xx-generic-tl-wr810n-squashfs-factory.bin
erase 0x9f020000 +${filesize}
cp.b  0x80800000 0x9f020000 ${filesize}
bootm 0x9f020000

Revert to the original factory firmware

Download this file (kernel + rootfs partitions extracted from the original firmware + empty config partion) and flash it as described above using a TFTP server with or without a serial console.

TL-WR810N(US) 1.0

The US version is not as “open” as the EU version, see this forum post for information on how to flash OpenWrt onto the device.

Hardware Details

Model	TL-WR810N(EU)	TL-WR810N(US)
Version	1.1	1.0
Architecture:	MIPS 24Kc
Manufacturer:	Qualcomm Atheros
Bootloader:	U-Boot
System-On-Chip:	Qualcomm Atheros QCA9531-BL3A
CPU Frequency:	650MHz
Flash chip:	Winbond 25Q64FVSIG
Flash size:	8 MiB
RAM chip:	Zentel A3R12E40CBF-8E
RAM size:	64 MiB
Wireless:	SoC integrated
Antenae(s)	2 On-Board
Ethernet:	1 WAN 10/100, 1 LAN 10/100
USB:	1 x 2.0
Control Elements:	Reset button, operation mode switch	Reset button

TL-WR810N(EU) 1.1

Photos

Opening the Case

DANGER: HIGH VOLTAGE inside!
Opening this device exposes
parts under high voltage (110/230 VAC)!

Risk of deadly electrical shock
Risk of irreversable damage to other components attached, e.g. your PC connected via serial

Make sure to keep your fingers, conductive tools and serial cables away from the high voltage at all times!

Capacitors can still retain dangerous voltages
after disconnection from mains!

Continue at your own risk!

Start by inserting a pry tool above the ethernet connectors. Lift the lid, work in counterclockwise direction. Don't be afraid to apply quite some force, in particular at the corners of the case.

Removing the PCB from the Case

Remove the light pipe above the LED. The light pipe is melted with the plastic of the case to fixate it, and you have to break away the melted parts to get the light pipe loose. (But it can later be put back without any noticable damage from the outside.) Then remove the dots of ductile glue that hold the PCB to the case, use a knife or some other narrow tool and cut/press it slowly through the glue. Finally, start lifting the PCB out at the edge opposite to the ethernet connectors.

Serial

The serial console can be accessed through the following test points on the top of the PCB:

Test Point	Function	Note
TP_TX1	TX	Reaches only a maximum of ~2.5V because of pull-down resistor R64.
TP_RX1	RX	This test point is not directly connected to the SoC, next to it is an unpopulated jumper (R107) that needs to be closed. This can easily be done by soldering not the end of a piece of enamelled wire to the test point, but letting about 1mm of wire stand out of the solder joint over the pads of the jumper, and then pulling solder from the solder joint over the jumper.
TPGND1/TPGND2	GND

Board voltage is 3.3V. The parameters of the serial console are 115200 8N1. To access the U-Boot prompt, type tpl quickly when the bootloader is about to autoboot. For the factory firmware the password for root is sohoadmin.

Operation Mode Switch

The operation mode switch on the top of the device is wired to the GPIOs 0 and 1 as follows:

Position	GPIO 0 (BTN_1)	GPIO 1 (BTN_0)	slide-switch script name
Router/AP	0	1	mode-router-ap
Repeater	1	0	mode-repeater
Client	1	1	mode-client

GPIO 1 and GPIO 0 are mapped to the key codes BTN_0 and BTN_1, respectively. See here on how to attach functions to them directly or use slide-switch with the names in the table above.

TL-WR810N(US) 1.0

The US version has the same internal hardware as the EU version, but is slightly smaller and does not have the operation mode switch at the top.

TL-WR810N(EU) 2.0

The version 2.0 no longer provides an USB port.

Flash Layout

TL-WR810N(EU) 1.1 Flash Layout factory firmware
Layer0	raw flash 8192KiB
Layer1	mtd0 u-boot 128KiB	mtd1 kernel 1024KiB	mtd2 rootfs 6912KiB	mtd3 config 64KiB	mtd4 art 64KiB
Mountpoint	none	none	/	none	none
Filesystem	none	none	SquashFS	none	none
TL-WR810N(EU) 1.1 Flash Layout OpenWrt
Layer0	raw flash 8192KiB
Layer 1	mtd0 u-boot 128KiB	mtd5 firmware 8000KiB			mtd4 art 64KiB
Layer 2		mtd1 kernel ~1200KiB ¹⁾	mtd2 rootfs sizeof(firmware - kernel)
Layer 3				mtd3 rootfs_data sizeof(rootfs - /rom) ²⁾
Mountpoint	none	none	/rom	/overlay	none
Filesystem	none	none	SquashFS	JFFS2	none

Bootlogs

TL-WR810N(EU) 1.1 U-Boot Log

U-Boot 1.1.4 (Sep 18 2015 - 11:52:31) ap143-2.0 - Honey Bee 2.0 DRAM: 64 MB Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17 flash size 8MB, sector count = 128 Flash: 8 MB Using default environment In: serial Out: serial Err: serial Net: ath_gmac_enet_initialize... ath_gmac_enet_initialize: reset mask:c02200 Scorpion ---->S27 PHY* S27 reg init : cfg1 0x800c0000 cfg2 0x7114 eth0: ba:be:fa:XX:XX:XX athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10 eth0 up Honey Bee ----> MAC 1 S27 PHY * S27 reg init ATHRS27: resetting s27 ATHRS27: s27 reset done : cfg1 0x800c0000 cfg2 0x7214 eth1: ba:be:fa:XX:XX:XX athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10 athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10 athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10 athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10 eth1 up eth0, eth1 Setting 0x181162c0 to 0x60c1a100 is_auto_upload_firmware=0 Autobooting in 1 seconds <-- type "tpl" here ap143-2.0> help ? - alias for 'help' boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory cp - memory copy erase - erase FLASH memory help - print online help mct - simple RAM test md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables progmac - Set ethernet MAC addresses progmac2 - Set ethernet MAC addresses reset - Perform RESET of the CPU run - run commands in an environment variable setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version ap143-2.0> printenv bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:32k(u-boot1),32k(u-boot2),3008k(rootfs),896k(uImage),64k(mib0),64k(ART) bootcmd=bootm 0x9f020000 bootdelay=1 baudrate=115200 ethaddr=0xba:0xbe:0xfa:0xXX:0xXX:0xXX ipaddr=192.168.1.1 serverip=192.168.1.10 dir= lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize lf=tftp 0x80060000 ${dir}ap143-2.0${bc}-jffs2&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f300000 +$filesize&&cp.b $fileaddr 0x9f300000 $filesize stdin=serial stdout=serial stderr=serial ethact=eth0 Environment size: 684/65532 bytes

TL-WR810N(EU) 1.1 Factory Firmware Boot Log

## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting QCA953x Linux version 2.6.31 (tomcat@buildserver) (gcc version 4.3.3 (GCC) ) #54 Fri Sep 18 11:55:10 CST 2015 Ram size passed from bootloader =64M flash_size passed from bootloader = 8 CPU revision is: 00019374 (MIPS 24Kc) ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 391 ahb 216 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,115200 root=31:2 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1024k(kernel),6912k(rootfs),64k(config),64k(art) mem=64M PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 56196k/65536k available (1864k kernel code, 9264k reserved, 472k data, 120k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 433.15 BogoMIPS (lpj=866304) Mount-cache hash table entries: 512 ****************ALLOC*********************** Packet mem: 80278900 (0x600000 bytes) ******************************************** NET: Registered protocol family 16 ath_pcibios_init: bus 0 ***** Warning PCIe 0 H/W not found !!! registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 ATH GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 109 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered protocol family 24 5 cmdlinepart partitions found on MTD device ath-nor0 Creating 5 MTD partitions on "ath-nor0": 0x000000000000-0x000000020000 : "u-boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000007e0000 : "rootfs" 0x0000007e0000-0x0000007f0000 : "config" 0x0000007f0000-0x000000800000 : "art" ->Oops: flash id 0xef4017 . ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ath-ehci ath-ehci.0: ATH EHCI ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 13 ehci_reset Port Status 1c000000 ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 13 ehci_reset Port Status 1c000000 ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver nf_conntrack version 0.5.0 (1024 buckets, 5120 max) xt_time: kernel timezone is -0000 Ooops, why the devices couldn't been initialed? ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> athwdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 120k freed init started: BusyBox v1.01 (2015.09.18-03:58+0000) multi-call binary This Board use 2.6.31 insmod: cannot open module `/lib/modules/2.6.31/kernel/x_tables.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_tcpudp.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_MARK.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_TCPMSS.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_comment.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_iprange.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_mac.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_multiport.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_string.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_time.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ipt_multiurl.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/nf_conntrack.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_conntrack.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_state.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/nf_defrag_ipv4.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/nf_conntrack_ipv4.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/nf_nat.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ip_tables.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_filter.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_nat.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ipt_MASQUERADE.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ipt_REDIRECT.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ipt_REJECT.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ipt_TRIGGER.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/ts_kmp.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver, V1.0 PPTP driver version 0.8.3 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/af_key.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xfrm_user.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_mark.ko': No such file or directory Now flash open! Now flash open! qca955x_GMAC: Length per segment 1536 953x_GMAC: qca953x_gmac_attach Link Int Enabled qca953x_set_gmac_caps CHECK DMA STATUS mac:1 Registering S27.... qca955x_GMAC: RX TASKLET - Pkts per Intr:18 qca955x_GMAC: Max segments per packet : 1 qca955x_GMAC: Max tx descriptor count : 512 qca955x_GMAC: Max rx descriptor count : 128 qca955x_GMAC: Mac capability flags : 2D81 953x_GMAC: qca953x_gmac_attach Link Int Enabled qca953x_set_gmac_caps CHECK DMA STATUS mac:0 Registering S27.... qca955x_GMAC: RX TASKLET - Pkts per Intr:18 qca955x_GMAC: Max segments per packet : 1 qca955x_GMAC: Max tx descriptor count : 512 qca955x_GMAC: Max rx descriptor count : 128 qca955x_GMAC: Mac capability flags : 2581 (none) mips #54 Fri Sep 18 11:55:10 CST 2015 (none) (none) login: athr_gmac_ring_alloc Allocated 8192 at 0x83866000 athr_gmac_ring_alloc Allocated 2048 at 0x83858000 HONEYBEE ----> S27 PHY MDIO ATHRS27: resetting s27 ATHRS27: s27 reset done ++++ athrs27_igmp_setup once port0 vid is 0xb000b port1 vid is 0x30003 port2 vid is 0x50005 port3 vid is 0x70007 port4 vid is 0x90009 ++ PVID: 0x0000000b, bitmap: 0x0000001f ++ PVID: 0x00000003, bitmap: 0x0000001f ++ PVID: 0x00000005, bitmap: 0x0000001f ++ PVID: 0x00000007, bitmap: 0x0000001f ++ PVID: 0x00000009, bitmap: 0x0000001f vtable vid: 0x00000002, bitmap 0x00000003 vtable vid: 0x00000004, bitmap 0x00000005 vtable vid: 0x00000006, bitmap 0x00000007 vtable vid: 0x00000008, bitmap 0x00000009 vtable vid: 0x0000000a, bitmap 0x0000000b vtable vid: 0x0000000c, bitmap 0x0000000d vtable vid: 0x0000000e, bitmap 0x0000000f vtable vid: 0x00000010, bitmap 0x00000011 vtable vid: 0x00000012, bitmap 0x00000013 vtable vid: 0x00000014, bitmap 0x00000015 vtable vid: 0x00000016, bitmap 0x00000017 vtable vid: 0x00000018, bitmap 0x00000019 vtable vid: 0x0000001a, bitmap 0x0000001b vtable vid: 0x0000001c, bitmap 0x0000001d vtable vid: 0x0000001e, bitmap 0x0000001f vtable vid: 0x00000020, bitmap 0x00000021 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... athr_gmac_ring_alloc Allocated 8192 at 0x83884000 athr_gmac_ring_alloc Allocated 2048 at 0x83a90000 HONEYBEE ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... device eth0 entered promiscuous mode device eth1 entered promiscuous mode Now flash open! athr_gmac_ring_free Freeing at 0x83866000 athr_gmac_ring_free Freeing at 0x83858000 athr_gmac_ring_alloc Allocated 8192 at 0x83866000 athr_gmac_ring_alloc Allocated 2048 at 0x83858000 HONEYBEE ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading adf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 10.2-00082-4 (Atheros/multi-bss) __ath_attach: Set global_scn[0] Enterprise mode: 0x03fc0000 Restoring Cal data from Flash ath_get_caps[6191] rx chainmask mismatch actual 3 sc_chainmak 0 ath_get_caps[6166] tx chainmask mismatch actual 3 sc_chainmak 0 ATH_RESERVED_TXBUF = 1000 wifi0: Atheros ???: mem=0xb8100000, irq=2 ath_pci: 10.2-00082-4 (Atheros/multi-bss) VAP device ath0 created Setting Max Stations:32 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 Set freq vap stop send + 832f8000 Set freq vap stop send -832f8000 Set wait done --832f8000 Set freq vap stop send + 832f8000 Set freq vap stop send -832f8000 Set wait done --832f8000 athr_gmac_ring_free Freeing at 0x83866000 athr_gmac_ring_free Freeing at 0x83858000 br0: port 1(eth0) entering disabled state athr_gmac_ring_alloc Allocated 8192 at 0x83a98000 athr_gmac_ring_alloc Allocated 2048 at 0x83858000 HONEYBEE ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... device ath0 entered promiscuous mode br0: port 3(ath0) entering forwarding state VAP device ath7 created ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1 This command only support on Host AP mode. br0: starting userspace STP failed, starting kernel STP ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 br0: port 3(ath0) entering disabled state DES SSID SET=TP-LINK_XXXX br0: topology change detected, propagating br0: port 3(ath0) entering forwarding state device ath7 entered promiscuous mode br0: topology change detected, propagating br0: port 4(ath7) entering forwarding state ====>>>>wlanBootupAll ok br0: port 3(ath0) entering disabled state DES SSID SET=TP-LINK_XXXX br0: topology change detected, propagating br0: port 3(ath0) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1 br0: port 3(ath0) entering disabled state usb_power_write 1084: write gpio(Port11):value = 0 DES SSID SET=TP-LINK_XXXX br0: topology change detected, propagating br0: port 3(ath0) entering forwarding state usb_power_write 1078: write gpio(Port11):value = 1 fuse init (API version 7.12) SCSI subsystem initialized Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. (all_group_send_igmp_leave)810, has delete all IGMP groups and timer qca955x_GMAC: GE0 RX DMA ENABLE Now flash open! Erase from 0X7E0000 to 0X7EAD80:. Program from 0X7E0000 to 0X7EAD80: write successfully

TL-WR810N(EU) 1.1 OpenWrt Boot Log

## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 4.1.20 (bauarbeiter@buildmaschine) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 r49114) ) #10 Mon Apr 11 10:42:10 UTC 2016 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc) [ 0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: board=TL-WR810N console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 60428K/65536K available (2778K kernel code, 139K rwdata, 684K rodata, 292K init, 195K bss, 5108K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:83 [ 0.000000] Clocks: CPU:650.000MHz, DDR:392.651MHz, AHB:216.666MHz, Ref:25.000MHz [ 0.000000] clocksource MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns [ 0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns [ 0.008238] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688) [ 0.071113] pid_max: default: 32768 minimum: 301 [ 0.076116] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.083094] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.093853] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.104956] NET: Registered protocol family 16 [ 0.111154] MIPS: machine is TP-LINK TL-WR810N [ 0.573170] Switched to clocksource MIPS [ 0.578802] NET: Registered protocol family 2 [ 0.584440] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.591810] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.598600] TCP: Hash tables configured (established 1024 bind 1024) [ 0.605451] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.611633] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.618635] NET: Registered protocol family 1 [ 0.624523] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.649602] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.655839] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.669325] io scheduler noop registered [ 0.673538] io scheduler deadline registered (default) [ 0.679177] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.686395] console [ttyS0] disabled [ 0.710323] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A [ 0.719439] console [ttyS0] enabled [ 0.719439] console [ttyS0] enabled [ 0.726997] bootconsole [early0] disabled [ 0.726997] bootconsole [early0] disabled [ 0.738825] m25p80 spi0.0: found s25fl064k, expected m25p80 [ 0.744684] m25p80 spi0.0: s25fl064k (8192 Kbytes) [ 0.750806] 5 tp-link partitions found on MTD device spi0.0 [ 0.756631] Creating 5 MTD partitions on "spi0.0": [ 0.761586] 0x000000000000-0x000000020000 : "u-boot" [ 0.767725] 0x000000020000-0x0000001500e8 : "kernel" [ 0.773796] 0x0000001500e8-0x0000007f0000 : "rootfs" [ 0.779759] mtd: device 2 (rootfs) set to be root filesystem [ 0.785721] 1 squashfs-split partitions found on MTD device rootfs [ 0.792115] 0x000000470000-0x0000007f0000 : "rootfs_data" [ 0.798593] 0x0000007f0000-0x000000800000 : "art" [ 0.804368] 0x000000020000-0x0000007f0000 : "firmware" [ 0.835343] libphy: ag71xx_mdio: probed [ 1.426124] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY] [ 1.436335] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII [ 2.025723] ag71xx-mdio.1: Found an AR934X built-in switch [ 2.069092] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII [ 2.077459] NET: Registered protocol family 10 [ 2.086008] NET: Registered protocol family 17 [ 2.090700] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 2.103951] 8021q: 802.1Q VLAN Support v1.8 [ 2.116053] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 2.125832] Freeing unused kernel memory: 292K (803e7000 - 80430000) [ 3.025951] init: Console is alive [ 3.029752] init: - watchdog - [ 3.988179] usbcore: registered new interface driver usbfs [ 3.994059] usbcore: registered new interface driver hub [ 3.999644] usbcore: registered new device driver usb [ 4.011596] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 4.020165] ehci-platform: EHCI generic platform driver [ 4.025761] ehci-platform ehci-platform: EHCI Host Controller [ 4.031741] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 4.042066] ehci-platform ehci-platform: irq 3, io mem 0x1b000000 [ 4.063208] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00 [ 4.070699] hub 1-0:1.0: USB hub found [ 4.075030] hub 1-0:1.0: 1 port detected [ 4.082788] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 4.090979] ohci-platform: OHCI generic platform driver [ 4.099399] uhci_hcd: USB Universal Host Controller Interface driver [ 4.116793] init: - preinit - [ 4.573299] usb 1-1: new full-speed USB device number 2 using ehci-platform [ 4.690561] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 4.720072] random: procd urandom read with 7 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 6.855335] mount_root: jffs2 not ready yet, using temporary tmpfs overlay [ 6.902977] procd: - early - [ 6.906916] procd: - watchdog - [ 7.545433] procd: - ubus - [ 7.601028] procd: - init - Please press Enter to activate this console. [ 8.420933] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 8.441095] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68 [ 8.448820] Backport generated by backports.git backports-20151218-0-g2f58d9d [ 8.459914] ip_tables: (C) 2000-2006 Netfilter Core Team [ 8.477215] nf_conntrack version 0.5.0 (948 buckets, 3792 max) [ 8.523133] xt_time: kernel timezone is -0000 [ 8.598802] PPP generic driver version 2.4.2 [ 8.606389] NET: Registered protocol family 24 [ 8.682305] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47 [ 17.125374] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [ 17.153295] jffs2_build_filesystem(): unlocking the mtd device... done. [ 17.160205] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 20.324195] device eth1 entered promiscuous mode [ 20.360462] br-lan: port 1(eth1) entered forwarding state [ 20.366164] br-lan: port 1(eth1) entered forwarding state [ 20.477455] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 21.253257] br-lan: port 1(eth1) entered disabled state [ 22.586780] eth0: link up (100Mbps/Full duplex) [ 22.591512] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 32.823274] done. [ 32.825321] jffs2: notice: (971) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 79.843054] random: nonblocking pool is initialized BusyBox v1.24.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- DESIGNATED DRIVER (Bleeding Edge, r49161) ----------------------------------------------------- * 2 oz. Orange Juice Combine all juices in a * 2 oz. Pineapple Juice tall glass filled with * 2 oz. Grapefruit Juice ice, stir well. * 2 oz. Cranberry Juice ----------------------------------------------------- root@OpenWrt:/# cat /proc/cpuinfo system type : Qualcomm Atheros QCA9533 ver 2 rev 0 machine : TP-LINK TL-WR810N processor : 0 cpu model : MIPS 24Kc V7.4 BogoMIPS : 432.53 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb] isa : mips1 mips2 mips32r1 mips32r2 ASEs implemented : mips16 shadow register sets : 1 kscratch registers : 0 package : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available

Table of Contents

TP-Link TL-WR810N

Supported Versions

Hardware Highlights

Installation

TL-WR810N(EU) 1.1

Flashing using the factory firmware web interface

Flashing using TFTP only (without serial console)

Flashing using the serial console

Revert to the original factory firmware

TL-WR810N(US) 1.0

Hardware Details

TL-WR810N(EU) 1.1

Photos

Opening the Case

Removing the PCB from the Case

Serial

Operation Mode Switch

TL-WR810N(US) 1.0

TL-WR810N(EU) 2.0

Flash Layout

Bootlogs

Tags