TP-Link TL-WR1043ND

Le routeur TP-Link TL-WR1043ND dans sa version courante, est compatible avec OpenWrt!

Ce routeur se décline dans les versions/modèles suivants.

Version/Modèle	S/N	Date de mise sur le marché	Versiond'OpenWrt compatible	Notes spécifiques au modèle
(DE)v1.0	-		Backfire 10.03.1	Similaire, Interface WEB en allemand
v1.1	-		Backfire 10.03.1	Similaire au WR941ND.
(DE)v1.1	-		Attitude Adjustment 12.09-beta2	Similaire, Interface WEB en allemand, V1.1 sur S/N sticker
v1.4	-		Backfire 10.03.1	même carte v1 gue v1.1
v1.5	-		Backfire 10.03.1	même carte v1 gue v1.1
v1.6	-		Backfire 10.03.1	Similaire
v1.7	-		Backfire 10.03.1	Similaire
v1.8	-		Testée OK avec Backfire 10.03.1 mais jamais les modèles v1.8 avec le bootloader courant de TP-LINK (ver. “U-Boot 1.1.4 (Mar 31 2012 - 10:40:21)”) nécessite la descente de version du bootloader décrite ci-après pour que le port WAN fonctionne avec Backfire 10.03.1; testée OK avecAttitude Adjustment 12.09-rc1	Similaire
v1.9	-		Testée OK avec Backfire 10.03.1 mais comme ces modèles sont équipés du bootloader courant de TP-LINK(ver. “U-Boot 1.1.4 (Mar 31 2012 - 10:40:21)”), ils nécessitent la descente en version du bootloader décrite ci-après pour que le port WAN fonctionne avec Backfire 10.03.1	Inconnu
v1.10	-		Testée OK avec Attitude Adjustment 12.09-rc1 Backfire 10.03.1 = BRICK!!	Similaire carte rev:1.1

La liste ci-dessus montre les premières versions d'OpenWrt compatibles. Les versions postérieures devraient être compatibles sauf mention contraire.

TP-Link Ultimate Wireless N Gigabit Router (TL-WR1043ND)

Voir paragraphes Hardware or Tags pour plus de détails.

Caractéristiques annoncées:

• 802.11n (300Mbps), 3 antennes
• 4x Gigabit Ethernet LAN ports, 1x Gigabit Ethernet WAN port
• 1x USB 2.0 port
• QSS (WPS) push button

Attention, la version v1.10 n'est compatible qu'avec Attitude Adjustment 12.09-rc1 ou postérieure. Backfire 10.03.1 CAUSE UN BRIQUAGE.

bogue qui neutralise le port WAN (modèle postérieurs à v1.8+). Il a été rapporté que le firmware des TP-Link sortis d'usine comprenne un nouveau chargeur d'amorçage qui neutralise le port WAN (port 0) au démarrage. Ce fut difficile de corriger cette fuite de commutateur, correction qui a été implémentée dans trunk entre r32942 - r32944 (45-46 corrige la fuite).

TOUS les nouvelles versions de matériel v1.8 ou postérieure (depuis ~Avril 2012) sont affectées par le bogue du port WAN . Ci-dessous, le code du chargeur d'amorçage concerné qui neutralise le por WAN au démarrage après l'écriture (flashing).

root@tpl2:~# grep -a U-Boot /dev/mtd0ro | cut -d'I' -f1
U-Boot 1.1.4 (Feb  6 2012 - 17:03:51)
U-Boot

• Essai du firmware TP-LINK, ver. TL-WR1043ND_V1_120405 avec une date de sortie du 5 avril 2012 : ce firmware met à jour le code du chargeur d'amorçage à une version du 31 mars 2012, mais a le même comportement de neutralisation du port WAN au démarrage que le firmware du 6 février 2012, c'est pourquoi les routeurs équipés de ce firmware nécessitent la descente en version du chargeur d'amorçage décrite plus bas.

U-Boot 1.1.4 (Mar 31 2012 - 10:40:21)
U-Boot

Contournement (peu élégant) du bogue de neutralisation du port WAN L'ancien firmware allemand (v3.9.17/100331) ne présente pas ce bogue. Le contournement implique de revenir à cette ancienne version et de re-écrire OpenWrt ensuite.

• Étape 1 (optionelle, nécessaire seulement si OpenWrt est installé): si votre port WAN est actuellement neutralisé, suivez le guide suivant pour revenir à la situation de sortie d'usine.

• Étape 2: Installez le firmware d'origine allemand (v3.9.17) via l'interface WEB de TP-Link. Téléchargez le fichier du firmware “wr1043nv1_de_3_9_17_up_boot(100331).bin /.zip”. (Cherchez le ou obtenez le à cette adresse). Une fois le firmware allemand installé, le code u-boot sur un routeur v1.9 devrait avoir descendu à la version du 17 novembre 2009 :

grep -a U-Boot /dev/mtd0ro | cut -d'I' -f1

U-Boot 1.1.4 (Nov 17 2009 - 11:56:26)
U-Boot

• Étape 3: écrivez le bonne image du firmware OpenWrt en fonction de votre modèle/version:!:. Ceci devrait ré-activer le port WAN.

MISE EN GARDE: écrire une verision d'OpenWrt incompatible sur les modèles v1.10 CAUSE UN BRIQUAGE.

Problème sur les modem USB 3G (puissance insuffisante). Le routeur ne délivre pas une puissance suffisante pour beaucoup de modems USB 3G, ce qui peut conduire à un comportement erratique, des connexions perdues/manquées. Si un modem USB 3G doit être utilisé, envisagez un autre routeur (ex: Buffalo WZR-HP-AG300H)

Image pré-compilée

1. Téléchargez une Attitude Adjustment 12.09 Beta 2 (image stable) pré-compilée.

Instructions génériques d'écriture

• downloads Vous devriez télécharger une image stable dont le nom contient les mots factory et SquashFS (depuis la plate-forme ar71xx).
• generic.flashing Après cela, écrivez le fichier du firmware dans la mémoire flash de votre routeur.

• Vous pouvez toujours construire (//build//) votre propre image en vous basant sur Kamikaze ou sur Backfire. Choisissez la plate-forme Atheros AR71xx/AT7240/AR913x et utilisez un profil TP-Link WR1043ND v1 .

Notes:

Problèmes avec le sans fil

• Dans Backfire 10.03.1 (ou supérieure), l'interface sans fil est présente mais désactivée par defaut. Après écriture, vous devez l'activer dans les paramètrages (Network/WiFi) pour qu'elle fonctionne “out of the box”.
• Les anciennes versions pré-compilées N'INCLUENT PAS le module du noyau pour l'interface sans fil. Pour activer le wifi, il vous faut installer le module kmod-ath9k et régénérer la configuration (voirconfiguration du sans fil).

Bogue d'écritue du firmware pour les anciens modèles

• Dans les anciens modèles de routeurs, le port WAN DOIT être connecté à Internet ou à un serveur DHCP pendant l'écriture du firmware OpenWrt via l'interface WEB de TP-Link (option “firmware upgrade” ). Si le port WAN est déconnecté, OpenWrt ne pourra être écrit et le routeur retournera au firmware original au redémarrage.
• MISE À JOUR: ceci semble réglé dans les modèles v1.8 ou postérieurs, en utilisant le firmware original 20110429. Laisser connecté dos à dos le client Windows du PC effectuant la mise à jour est suffisant.

Lisez l'article Agencement de la mémoire flash pour mieux comprendre. Il contient pas mal d'explications. Puis regardons l'agencement spécifique à ce routeur.

ART = Atheros Radio Test - il contienv l'adresse mac et les données de calibration du sans fil (EEPROM). S'il est manquant ou corrompu , ath9k ne fonctionnera plus.

Voici une feuille de calcul LibreOfficepour mieux comprendre: http://ubuntuone.com/2aPBH9pwkxtYzy93S0cS1z .

Install openwrt-ar71xx-tl-wr1043ndv1-squashfs-factory.bin using the “Firmware Upgrade” page of web interface of the original firmware.

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:

#!/bin/bash

# Pass the firmware image file to be flashed as the first and only
# command line argument.
#
# The second curl call will time out, but it is expected. Once the
# script exits, you can unplug the ethernet cable and proceed to the
# next router, but do KEEP each router ON POWER until the new image is
# fully written! When flashing is done the router reboots
# automatically (as shown by all the leds flashing once).

curl \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.1.1/userRpm/SoftwareUpgradeRpm.htm' \
  --form "Filename=@$1" -F 'Upgrade=Upgrade' \
  http://192.168.1.1/incoming/Firmware.htm > /dev/null

sleep 1

curl \
  --max-time 2 \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.1.1/incoming/Firmware.htm' \
  http://192.168.1.1/userRpm/FirmwareUpdateTemp.htm >  /dev/null

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process).

Quick howto recover from bad flash. (full log)

Requirements:

• terminal program (e.g. minicom) set to 115200 8N1, no flow control
• file named code.bin containing openwrt firmware.
• tftpd server with an address 192.168.0.5 (configurable with setenv command, printenv first if unsure)

The simplest tftpd server to use is dnsmasq. Install and run with dnsmasq --enable-tftp --tftp-root=/code.bindirectory

Commands:

After you see Autobooting in 1 seconds type tpl and hit enter to get into command promt.

erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
tftpboot 0x81000000 code.bin
cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000

If you do not want to bother with running a tftpd server on your computer, especially considering the security concerns, you can also use a Kermit client to transfer the new image. It may take forever and a half (15-20min) to copy, but it's easier and more secure than running a tftpd server. These instructions assume you're using a Linux system, but they will give you all you need to do the same on a Windows box.

Requirements:

• terminal program (e.g. minicom) set to 115200 8N1, no flow control
• file named code.bin containing openwrt firmware.
• Kermit client (these instructions will involve using C-Kermit under Linux)

In your terminal program you type:

erase 0xbf020000 +7c0000 # 7c0000: size of the firmware (be aware that you may have a different size thus bricking your router)
loadb 0x81000000

Hint: After you see Autobooting in 1 seconds type tpl and hit enter to get into command promt.

Fire up C-Kermit and run the following commands (or configure your Kermit client to these parameters):

set line /dev/ttyUSB0 # Just make sure you got the right USB interface
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send code.bin # Make sure you include a proper path to the file. That's why I just kept it in /home/$user

After the 15-20min file transfer, the new firmware should be on your router and you can continue in terminal:

cp.b 0x81000000 0xbf020000 0x7c0000
bootm 0xbf020000

→ generic.sysupgrade

WARNING: Recent versions of trunk are reported to brick the 1043ND and other devices:

https://forum.openwrt.org/viewtopic.php?pid=176604

Unless you know what you're doing, use the latest stable version.

→ generic.uninstall

With the WR1043ND router, there is a catch: the stock firmware is obtained from the OEM: http://www.tplink.com/en/support/download/?model=TL-WR1043ND

• in case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware
• in case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it:

An example of an image file with the word “boot” in it is wr1043nv1_en_3_9_17_up_boot(091118).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:

dd if=orig.bin of=tplink.bin skip=257 bs=512

This has been confirmed by supertom64

Après avoir flasher votre routeur, procédez à une configuration de base.
Réglez votre connexion Internet, configurez vos connexions sans fil, configurez vos ports USB, etc.

Since this is the same for all TP-LINK products, see TP-LINK firmware features.

The default network configuration is:

L'interface Gigabit Media Independent est la connexion interne vers le routeur.

La version 2.x ne récupère pas les lan et wan via eth0.1/eth0.2 mais via eth0 (wan) et eth1 (lan). Eth0 est dans le même vlan que le port 5 du switch. Dans ces conditions, le port 6 de la version 2.x est un accès cpu additionnel utilisé uniquement pour le trafic wan. Le wan est dans le VLAN 2 et il ne faut pas le modifier, au risque de le perdre. Il faut donc démarrer les vlan à 3, en les attachant à la sous-interface eth1.x.

Voir sur le schéma:

http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PNid=18&PFid=15&Level=5&Conn=4&ProdID=197

Problèmes connus avec la v10.03.1-rc4 sur la version 1.8 du routeur. Se référer à ce post (en) pour une solution corrective.

Il existe aussi un problème sur les VLAN de numéro > 9 (en tous cas sur la v1.4 en v10.03.1-RC6 r28680 et la version 1.8 et v12.09-rc1 r34185). Utiliser des VLAN > 9 rends le routeur inaccessible sur cette interface.

See OpenWrt Failsafe Mode for general information. Based on generic failsafe, here are peculiarities :

1. Listen on the WAN port. (tcpdump .....)
2. Power up your router. When the 'SYS' light starts to blink, press and hold the QSS button on the right side of the front panel until the blinking of 'SYS' LED gets faster. If that won't work instead of holding the button press it and keep pressing it until the blinking gets faster. Alternatively you may try both methods on the RESET button on the back panel between USB and power plug.
3. After entering the failsafe mode (sys LED flashing very fast) , swap your Ethernet connection from WAN port to LAN port 1 and the telnet 192.168.1.1 to repair your device as explained here.

You will see something like this:

.
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0 up
eth0
Autobooting in 1 seconds

Type

tpl

during this 1 second period. Then continue with OEM installation using the TFTP and RS232 method

The Realtek 8366RB supports: VLAN, Jumbo Frames (not supported by the SoC), bandwidth control, port priority, storm filtering, QoS, ACL. Not all of these features are actually supported by OpenWrt. Supported VLAN IDs are 1-15 (VLAN Configuration Mode 2 ?). See: Ticket #7977

• Filesystems performance results and performance howto for help on measuring.
• USB Benchmarks results.

With a cheap Wattmeter i measured 6.9W idle and 9W under load.

My TL-WR1043ND DE (v1.0) came bundled with the following PSU:

Specifications:

I successfully used the ATX PSU (from my computer) to power the router. All I did was buying a plug with above specifications and soldered a Molex-plug to the other end.

I have measured simultaneously Voltage and Current on the DC-Side of the Router with 2 analogue Multimeters.

It looks like my AC-DC Adapter is stabilized and delivers exactly 12 Volts.

1. Without LAN Connected, without any USB device, Openwrt Running with WLAN 10dBm (b/g AP mode) : 250mA 2. With 1x100MBit LAN, 1xHuawei E1750 in idle (not connected) : 320 mA 3. With HSDPA Connection active : 400mA

The HSDPA Modem seems draw a lot of Power as soon as any Data is transferred. In total i guess approx. 500mA. (Was NOT possible to measure exactly because my Amperemeter is very slow...)

Higher Resolution Picture

Note: This will void your warranty! The case of the WR1043N is composed of 4 pieces:

• Top cover (white, with logo)
• Bottom cover (white, with sticker)
• Front (transparent, black)
• Outer frame (black, vents on the sides)

There are only two screws at the back of the device, under the rubber feet. The rest of the case is kept together by two latches at the front of the device, and a system of guides and hooks in the front.

1. Remove the antennas.
2. Remove the rubber feet in the back and undo the screws.
3. Unscrew all three retaining nuts on the antenna connectors and carefully push them into the housing. If you find this hard to do, leave them in place: you'll have to pay attention and avoid pulling the outer frame, as there are wires running from the back of the device all the way to the front of the board.
4. Push one of the bottom screws back into place to lift the top cover, and keep it that way using a finger.
5. With the top slightly open, push the bottom cover away. Use a screwdriver if you can't reach it with your fingers.
6. If you have unscrewed the antenna connectors, now you can remove outer frame. Otherwise just carefully slide it out of the way: this will expose the clips that keep the top and bottom covers together.
7. With a flathead screwdriver or similar tool, gently pry the two front clips apart. Each clip has two latches and is located near the corners, next to the black front. Put your screwdriver behind the latches and push it towards the ethernet ports.
8. Now the top cover can slide out the vertical guides on the black front.
9. The black front also has three plastic hooks that go into matching holes in the bottom cover. To remove it, pull the front away and then push it down.

Pictures can be found here

1. Place the board on the bottom cover, so that the two plastic pins at the front keep it in place.
2. If you undid the antenna connectors, put them back in and tighten the nuts.
3. Place the outer frame behind the board and make sure it sits flush to the connectors.
4. Insert the hooks of the front into the holes in the bottom cover, don't push it in yet.
5. Make the top cover slide into the vertical guides on the front. Don't push it down yet.
6. Push the front towards the back so the hooks are engaged, then push down the top cover.
7. Fasten the screws and re-apply the rubber feet.

→ port.serial general information about the serial port, serial port cable, etc. How to connect to Serial Port:

Solder a header as shown in the picture or wires with a connector directly. The device uses TTL @ 3.3V and not a standard RS-232 Serial that operates between 3 and 15V, so do not try to connect it to a common serial adapter: you will certainly fry the serial circuit or even the whole board. There are plenty of USB to TTL and RS-232 to TTL available on the market, just be careful with the voltage: the standard is 5V and it may also damage your board. Look for the ones with 3.3V or with both voltages and a way to switch between them.

Don’t forget that the TX pin of the serial port must linked to the RX pin of the router and the RX to TX!

Speed: 115200 baud

Some revisions require a jumper between the RX serial pin and the resistor R326 to enable serial writes. See this post for details:

https://forum.openwrt.org/viewtopic.php?pid=176448#p176448

If you find that the serial console will not accept write commands, check with a multimeter that you have continuity between RX and R362.

If you don't have continuity you will need to jumper them, here is my working example:

I went to the right hand side of the resistor for ease of soldiering, but there may be better solutions.

I also noticed that the small hole just below R362 has continuity to the RX pin so that may provide a cleaner solution with a much smaller jumper.

→ port.jtag general information about the JTAG port, JTAG cable, etc.

JTAG Line:

http://forum.openwrt.org/viewtopic.php?pid=79931#p79931

Software:

Download EJTAG Debrick Utility 3.0.1

Backup:

Backup whole flash:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00800000

Backup UBoot:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf000000 /length:00020000

Backup Firmware:

tjtag3.exe -backup:custom /fc:25 /window:bf000000 /start:bf020000 /length:00800000

W A R N I N G At the moment it is NOT possible to UNBRICK the router by JTAG (no write access to flashrom), therefore be very careful not to overwrite the u-boot.

→ port.gpio The AR913x platform provides 22 GPIOs. Some of them are used by the router for status LEDs, buttons and to communicate with the RTL8366RB. The table below shows the results of some investigation:

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. “leds-gpio” and “gpio-buttons”). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

How to configure LEDs in general, see the LED section in the led_configuration.

The WR1043ND has 10 LEDs:

ledtrig-usbdev is only available in attitude adjustment (Trunk) and in self-built Backfire images using this set of patches.

→ hardware.button. For custom action on pressing button the easy way with 00-button script works nicely.

The TP-Link TL-WR1043ND has two buttons:

The QSS button is located at the front and can be easily pressed with a finger. The Reset button is located at the back and cannot be pressed with a finger, you need a small item (pen typically) to push it in.

Note: you don't need to configure or activate buttons to get the Failsafe mode working, it will work by default.

→ generic.debrick

NOTE: If you accidentally bricked your router by overwriting the bootloader, try the following:

1. Desolder the Spansion SPI-Flash (here is the datasheet) from the board. I used tin foil to “mask” out everything else which I did not want to desolder and used a heat gun. It worked quite nice.
2. Find a way to connect the SPI flash to something with SPI interface.... I used a AVR microcontroller. Here you can download a pdf containing the layout for the adapter board I made to solder the Spansion SPI flash chip on, in order to connect it to the AVR. Attention, the PDF is mirrored and it is intended to manufacturing boards with the direct toner method.
3. Write the bootloader into the flash. I got my bootloader out of another wr1043nd.
4. Solder the chip back into the router.
5. The router shall now be unbricked.

1. you could read about bootloader in general and about Das U-Boot/Configuration of U-Boot in particular.
2. the uboot version you find on the 1043 is a fork of mainline U-Boot version 1.1.4 from 2005-12-17 see here. You can / you cannot take a current mainline version of uboot and simply cross-compile it for WR1043ND! TP-Link-Version: http://www.tp-link.com/support/gpl.asp. It contains the file u-boot-ap83.tar.bz2 which is about 6,06 MiB in size, deflate this as well. The deflated source code will occupy about 37MiB of space, start with reading the README.
3. also see ftp://ftp.denx.de/pub/u-boot/ and compare the versions.
4. you may be able to cross compile the code with the OpenWrt toolchain Buildroot. See toolchain for guidance. But you may need to use other toolchain to crosscompile, like the ELDK (Embedded Linux Development Kit).
5. Problem: you cannot test your bootloader, because for some obscure reason, you don't have write access to the flash via JTAG.

Look at target/linux/ar71xx/files/arch/mips/ar71xx/mach-tl-wr1043nd.c (in trunk it's target/linux/ar71xx/files/drivers/mtd/tplinkpart.c)

static struct mtd_partition tl_wr1043nd_partitions[] = {
  {
    .name   = "u-boot",
    .offset   = 0,
    .size   = 0x020000,
    .mask_flags = MTD_WRITEABLE,
  } , {
    .name   = "kernel",
    .offset   = 0x020000,
    .size   = 0x140000,
  } , {
    .name   = "rootfs",
    .offset   = 0x160000,
    .size   = 0x690000,
  } , {
    .name   = "art",
    .offset   = 0x7f0000,
    .size   = 0x010000,
    .mask_flags = MTD_WRITEABLE,
  } , {
    .name   = "firmware",
    .offset   = 0x020000,
    .size   = 0x7d0000,
  }
};

Remove the line

.mask_flags = MTD_WRITEABLE,

for the partition named “u-boot” to make it writeable.

• Get the uboot image via the following command

  cp /dev/mtd0ro /tmp/uboot.org

• Verify is a 1 to 1 copy (expect no output)

  cmp -l /dev/mtd0ro /tmp/uboot.org

• Backup your original uboot

  tar -czf /tmp/uboot.tar.gz -C /tmp uboot.org
  ln -s /tmp/uboot.tar.gz /www/uboot.tar.gz

  and download via http://192.168.1.1/uboot.tar.gz

• At the offset 0x1FC00 you will usually find your mac address.

  hexdump -n 6 -s 130048 -e '"%06.6_ax " 5/1 "%02X:" 1/1 "%02X""\n"' /tmp/uboot.org

• You can change it with an hex editor. I use dhex. Or use the following command

  newmac=00:BA:AD:BE:EF:69
  echo $newmac | awk -v FS="[: -]" '{for (i=1; i<=NF; i++) printf "%c", ("0x" $i)+0 }' | dd conv=notrunc bs=1 count=6 seek=130048 of=/tmp/uboot.org
  mv /tmp/uboot.org /tmp/uboot.mod

• Double check your newly created, or spoof MAC Address:

  hexdump -C -n 16 -s 130048 /tmp/uboot.mod
  cmp -l /dev/mtd0ro /tmp/uboot.mod

• After changing the MAC and making the u-boot mtd flash portion writeable, you can write the modified uboot image back to flash:

  mtd write /tmp/uboot.mod u-boot

  where “uboot.mod” is the filename of your modified uboot image.

• If the above command fails, you missing the custom firmware step, don't go any further.
• After reboot a new radio1 will be created with default interface. To keep current settings and prevent radio1 creation

  uci set wireless.radio0.macaddr=$newmac
  uci commit wireless
  reboot & exit

• To get rid of wild radio1 after reboot, instead of the above prevention, get the cure:

  uci set wireless.radio0.macaddr=$(uci get wireless.radio1.macaddr)
  uci delete wireless.@wifi-iface[-1]
  uci delete wireless.radio1
  uci commit wireless

• Your old MAC Address could be recovered from the sticker in the back of your router. Write it down securely, if in a hard to access location.

1. as a beginner, you really should inform yourself about soldering in general and then even obtain some experience!

The Device uses a DDR1 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip. Replace it with any 32Mbit x 16bit chip. 333MHz instead of 400MHz also works fine. It's quite hard to find these chips. The best chance is to have a look at DDR-SODIMM. Since there are no 64Mbit x 16Bit DDR1 Chips available → no 128 MB mod!

Working chips:

• Hynix HY5DU121622DTP-D43 (From Mustang DDR-SODIMM 512 MB)
• Hynix HY5DU121622CTP-J (PC333 DDR RAM)
• Infineon HYB25D512160BE (From Infineon DDR-SODIMM 512 MB)

Additional list that may work:

root@OpenWrt:~# free
total used free shared buffers
Mem: 62104 17472 44632 0 1392
Total: 62104 17472 44632

An I²C-bus can easily be added using the GPIO-lines of the AR913x-SoC. So far, the only usable ones which have been confirmed to work are GPIO 5 (the QSS-LED, easily solderable at D10,left pin with '+') as SDA and GPIO 20 (labeled on the pcb, next to the RAM chip) as SCL. There are only two pull-up resistors of 4,7k-10k needed, which have to be soldered between the apropriate GPIO line and Vcc (found at the spot labeled TP3V3, about 2 cm above the WiFi-shielding). The common ground can be obtained from the TP_GND spot (between P1 and the flash chip). Remember this bus runs at 3.3V level, when connecting I²C-devices.
To improve signal integrity (in this case namely a solid logic low level on GPIO5), you can replace R373 with a piece of wire and remove the LED D31. R373 seems to be the current limit resistor for the LED D31. Unfortunately the precompiled packages don't seem to work properly, so building from sources is most likely necessary. Therefore, make sure the apropriate part of your OpenWrt-config file looks like that:

#
# I2C support
#
CONFIG_PACKAGE_kmod-i2c-core=y
CONFIG_PACKAGE_kmod-i2c-algo-bit=y
# CONFIG_PACKAGE_kmod-i2c-algo-pca is not set
# CONFIG_PACKAGE_kmod-i2c-algo-pcf is not set
CONFIG_PACKAGE_kmod-i2c-gpio=y
CONFIG_PACKAGE_kmod-i2c-gpio-custom=y

Besides that, check in the kernel-config, that the support for I²C character device is selected. In the kernel config file the appropriate line should look like that:

CONFIG_I2C_CHARDEV=m

To load the kernel module, do a:

insmod i2c-gpio-custom bus0=0,5,20

In many cases, GPIO 5 will already be occupied by the leds-gpio kernel module - causing the above command to fail. In case you don't need the leds at all, you can just unload the leds-gpio kernel module, remove the package or disable it in the OpenWrt-configuration. As an alternative, you can just release the binding of the QSS-LED in sysfs - thus keeping the function of the other LEDs.

Though not really a modification of the internal hardware, the I²C Tiny-USB adapter allows you to extend your router with an I²C bus over USB. It is not as cheap as the I²C-GPIO mod, but will not risk your warranty. Remember this bus runs at 5V level, when connecting I²C-devices.

a custom image with ipv6 support: radvd, wide-dhcpv6, 3g stick support, made for RCS-RDS Fiberlink dual stack PPPoE service, but should be okay for static wan settings on other ISPs: http://www.ip6.ro/firmware/wr1043nd/

• Canyon CNP-WF514N3A description and internal photos here
• Proware PW-RN611D/MH5-WR1043ND probably another clone...