TP-Link TL-WR741ND

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version (18.06 or later) onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device will end after 2019.
19.07 will be the last official build for 4/32 devices. After 19.07, no further OpenWrt images will be built for 4/32 devices. See OpenWrt on 4/32 devices what you can do now.

TL-WR741ND is a lowcost (15€/25$) b/g/n wireless router, capable of running OpenWrt.

Keeping the overview For clarity and ease of use we should consider trimming below list. I have rebooted the hardware list which should help clearing the duplicates. For example, judging from the details available at WikiDevi, the v1.6 and v1.9 seem already identical. The fact OpenWrt images only cover major updates (ie v1, v2, v4) should be a further indicator. – Bernini 2015-01-06

Model Version Launch Date OpenWrt Supported Since Model Specific Notes
v1.x - Backfire 10.03.1 v1.9 has a different flash chip compared to other v1.x models, see SVN r23712 and related ticket.
v2 - Backfire 10.03.1 Tested with r29614, working correctly.
v2.1 - Test at your own risk trunk (r27195) notes
v2.3 - Test at your own risk trunk (r28601) Tested Backfire revision 28601
v2.4 - Attitude Adjustment 12.09 Rounded chassis (box branded WR740N). Also works without issues with CC 15.05.1 release
v3 2011-08 ? WikiDevi only knows a v3.1, no v3. Confirms OpenWrt support though.
v3.1 (CN) - ? This forum thread suggests support, but user hacked a v1 OpenWrt image to test.
v4 2011-09 Attitude Adjustment 12.09 AR9331 chipset.
v4.20 2012-04 Attitude Adjustment 12.09 Working as of trunk r31273, note 4.20 is newer than 4.3.
v4.3 - Attitude Adjustment 12.09 Working as of trunk r31249, hardware reports “TP-LINK TL-WR741ND v4”.
v5.0 -  Test at your own risk trunk (r46238) See: SVN r46236 and changeset 46238 for trunk. ; Barrier Breaker 14.07 install - howto
ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
TL-WR741ND1, 1.8Atheros AR7240400432Atheros AR92xxb/g/n-5--Mod
TL-WR741ND1.4, 1.5, 1.9, 3Atheros AR7240350432Atheros AR92xx (onboard)b/g/n-5--Mod
TL-WR741NDv5Atheros AR9331400432Atheros AR9331b/g/n-5---
TL-WR741NDv2Atheros AR7240 rev 2350432¿b/g/n-5---
TL-WR741NDv4.xAtheros AR9331400432Atheros AR9331b/g/n-5---
Ver CPU RAM Flash Network Wireless USB Serial JTag Wikidevi FCC
1.6 Atheros AR7240 @ 350 MHz 32 MB 4 MB 1 WAN + 4x LAN (100 Mbit) AR9285 [bgn 1×1:1] mod only 1.1 Yes No Link FCC ID TE7WR741NX
1.9 Atheros AR7240 @ 350 MHz 32 MB 4 MB 1 WAN + 4x LAN (100 Mbit) AR9285 [bgn 1×1:1] mod only 1.1 Yes No Link
2.4 Atheros AR7240 @ 350 MHz 32 MB 4 MB 1 WAN + 4x LAN (100 Mbit) AR9285 [bgn 1×1:1] mod only 1.1 Yes No Link FCC ID TE7WR741NDV2
3.1 Atheros AR7240 @ 350 MHz ? 4 MB 1 WAN + 4x LAN (100 Mbit) AR9285 [bgn 1×1:1] ? Yes No Link Presumedly FCC ID TE7WR741NDV2 as well
4.3 Atheros AR9331 @ 400 MHz 32 MB 4 MB 1 WAN + 4x LAN (100 Mbit) AR9331 [bgn 1×1:1] mod 2.0 Yes No Link FCC ID TE7WR741NDV4
5 Atheros AR9331 @ 400 MHz 32 MB 4 MB 1 WAN + 4x LAN (100 Mbit) AR9331 [bgn 1×1:1] ? Yes No ? FCC ID TE7WR741NXV5

Version 4.x and above utilise the AR9331 chipset (Confirmed on UK v4.3 model). Chinese models may differ - TP-Link appear to have started using vxWorks and reducing the flash to 2MB and RAM to 16MB on some of their newer versions for the Chinese market.

Install OpenWrt (generic explanation)

This section details what is required to install and upgrade OpenWrt. First we link to software that you should download before you start reading the instructions on how to install.

This section deals with how you install OpenWrt from a device freshly opened. Plus the steps required such as reset to factory defaults if the device has already been configured

Note: Reset router to factory defaults if it has been previously configured.

Note: Newer TP-Link retail firmwares (confirmed on v2.4 devices, but definitely not on v2.0) include a crude mechanism to prevent you uploading unsuitable firmware. It does this by checking the filename, so you may need to rename the *-factory.bin file to the name of a TP-Link retail firmware file. e.g. wr741nv1_en_3_12_4_up(100910).bin (not necessary with firmware V4_120320)

  • Browse to your router at or test with TP-LINK Simulator first. (Version 4.20 uses out of the box.)
  • Login with user name: admin password: admin
  • Use left navigation panel and go to System Tools
  • Important! Navigate to - Factory Defaults and click on Restore if it has been previously configured.
    • Confirm the pop-up dialog.
  • Then navigate to - Firmware Upgrade
  • Upload previously chosen -factory.bin file to router
  • Click on Upgrade button and wait for it to reboot
  • Important! Do NOT turn off the power during upgrade
  • Wait about 120 seconds to start up, see SYS LED activity.
  • If the router's IP ( doesn't repond to ping, try clear ARP cache on your machine
    arp -d
  • Don't clear your browser cache! Please report here what you installed, if do work anyway and which Untested link let you get in. Successful ones have Untested removed. This only happen once, so your input is important. Alternate links that theoretically should work
Gargoyle Know to fail
LuCI Untested
X-Wrt Untested
  • Important! Clear your browser cache if you are sure some web interface is installed, but can't access to
  • Set a root password
    • Browse to if LuCI, X-Wrt or Gargoyle web interface is installed.
      • Only for Gargoyle login with defaults user name: root password: password
      • After password has been setup login with user name: root password: previusly entered
    • telnet
      • Type:
        passwd root
      • Enter your new password twice.
  • Once password has been setup Telnet is no longer available, use SSH instead to connect.
    • ssh root@
    • PuTTY SSH

Using the serial console, new firmware versions can be loaded via TFTP and flashed as follows. This assumes your TFTP server is reachable at You can change IP addresses with:

setenv ipaddr a.b.c.d
setenv serverip e.f.g.h

Type “tpl” to escape automatic boot when “autoboot” appear.

Calc Size of firmware:

-rw-r--r-- 1 root root   3350532 Nov  1 01:22 openwrt-ar71xx-tl-wr740n-v1-squashfs-sysupgrade.bin

Dec 3350532 to Hex 0x332004

TFTP loading and flashing is done by issuing:

tftpboot 0x80000000 openwrt-ar71xx-tl-wr740n-v1-squashfs-sysupgrade.bin
erase 0x9f020000 +0x332004 # 0x332004: size of the firmware (be aware that you may have a different size thus bricking your router)
cp.b 0x80000000 0x9f020000 0x332004 # 0x332004: size of the firmware (be aware that you may have a different size thus bricking your router)

If successful, the firmware can now be started with

bootm 0x9f020000

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

Web Upgrade Process

  • Browse to Upgrade URL for your Web interface package installed:
    • luci and luci-light LuCI Essentials
    • luci and luci-medium LuCI Administrative
    • webif X-Wrt
    • gargoyle Gargoyle
  • Upload *tl-wr741nd-v1-squashfs-sysupgrade.bin file
  • Confirm, check MD5 sum, confirm again.
  • Wait for reboot about 2 whole minutes.

Terminal Upgrade Process

  • Download or compile yourself a sysupgrade binary.
    • Alternatively download it inside OpenWrt with wget and skip to last step.
cd /tmp
mv openwrt-ar71xx-generic-tl-wr741nd-v1-squashfs-sysupgrade.bin tplink.bin
  • SCP it to /tmp on your router:
scp openwrt-ar71xx-generic-tl-wr741nd-v1-squashfs-sysupgrade.bin root@


PSCP.EXE -p openwrt-ar71xx-generic-tl-wr741nd-v1-squashfs-sysupgrade.bin root@
  • Type your root password when prompted and a slow upload will start.
  • Open PuTTY as SSH to and perform the following commands:
cd /tmp
mv openwrt-ar71xx-generic-tl-wr741nd-v1-squashfs-sysupgrade.bin tplink.bin
  • Flash via mtd
mtd -r write /tmp/tplink.bin firmware
  • Go to TP-Link download page, and choose correct router version (V1-V4).
  • For example, if you not already did. Make sure to get an image for the right hardware version. The example is for v4 hardware only.
  • Extract wr741nv4_en_3_17_0_up_boot(140410).bin from the archive downloaded.
  • SCP it to /tmp on your router:

Important!Remove the parenthesis and its content from the file name. i.e. file_to_load(1234).bin must be renamed to file_to_load.bin, this to avoid the “unrecognized ”(“ as command” during the mv steep below.

PSCP.EXE -scp wr741nv4_en_3_17_0_up_boot.bin root@


scp wr741nv4_en_3_17_0_up_boot.bin root@
  • Type your root password when prompted and a slow upload will start.
  • Open PuTTY as SSH to and perform the following commands:
cd /tmp
mv wr741nv4_en_3_17_0_up_boot(140410).bin tplink.bin

Warning!WARNING: Only perform the dd action below if your original firmware has the word “boot” in it, for example, wr741nv4_en_3_17_0_up_boot(140410).bin.

Important!Please do not dd your original firmware if it has no “boot” in its name, for example, wr741nv4_en_3_17_0_up(140410).bin, because if you do, you will brick your router! This was confirmed by supertom64

  • Cut first 0x20200 bytes from original firmware

Important!If you already mv the original .bin (previous steep) it now is named tplink.bin so the code below will trow the “file not found” error. Please make sure to SCP your binary again (as in step 4) before executing the next code lines.

cd /tmp
mv wr741nv4_en_3_17_0_up_boot(140410).bin orig.bin
dd if=orig.bin of=tplink.bin skip=257 bs=512
  • Flash via mtd
mtd -r write /tmp/tplink.bin firmware

Warning!WARNING: If you get the error “Writing from /tmp/tplink.bin to firmware … [e]Failed to erase block” after flashing via the mtd command, do not reboot or shutdown or you will brick your device! In tp-link site they say that if you have 110825 you should update to 111130 before upgrading to 120320, so it could be better to restore to 110914 and then upgrade “gradually” as they say.

Important! The latest TP-Link firmware for V1 revision (wr741nv4_en_3_12_11_up(120320).bin) doesn't have the word 'boot' in it. However, the 120320 firmware has also the bootloader (bigger file, 4063744 vs 3932160, it's 131584 bytes larger, equals to 0x20200 in hex, the amount you have to trim when flashing those files as described in wiki!) They used to add the word “boot” in the filename, now you have to pay attention to the file size.


Case and board:
v1 case v1 board


Case and board:
V2.0 Case V2.0 Board

Serial port is the two round joints just above the small surface mount chip in the centre. Take power from elsewhere.

v2.3 and v2.4

Case and board:
V2.3 and V2.4 Case V2.3 and V2.4 Board

nearly same case as v2.0
nearly same PCB as v2.0


Case (nearly the same case as v2.0) and board (Note the AR9331 chipset):
V4.x Board



Note: This will void your warranty!

These instructions will hopefully help you crack open your wr741nd without cracking it.

If you turn your wr741nd upside down you will see 4 rubber legs.

Under each of the 4 rubber legs is a screw.

Now unscrew the 4 screws.

Unscrew the aerial, and then the nut and washer.

Use a flat object such as the head of a flat screwdriver and gently try to pry open the top and bottom covers. Gently push upwards where the red arrows are and you can lift the top lid off.

To remove the LED cover, pull it out in the direction of the arrows.
It's on

Now it's off!

Remove the black strip and now you can lift the board out.

In OpenWrt system there are 18 GPIOs available. However gpio0, gpio1 are used by system to control LEDs and gpio11, gpio12 as input buttons. To be able control these IOs directly it is necessary to unload modules leds_gpio (gpio0,gpio1) and gpio_buttons (gpio11,gpio12). Next step is to export control files of each pin:

echo N > /sys/class/gpio/export

Where N is GPIO number. This will create directories with control files in /sys/class/gpio/gpioN

Version 2.4:
GPIO HIGH = 2.47 V, GPIO LOW = 0 V

name purpose SoC pin DESCRIPTION
gpio0 QSS LED 107 software controlled LEDs
gpio1 SYS LED 108
gpio2 SPI-SS0 75 multiplexed, connected to the SPI flash memory chip
gpio3 SPI-CLK 76
gpio4 SPI-MISO 77
gpio5 SPI-MOSI 78
gpio6 JTAG-TDI 81 multiplexed, R425 pulldown resistor
gpio7 JTAG-TDO 82 multiplexed, not connected
gpio8 JTAG-TMS 84 multiplexed, R426 pulldown resistor
gpio9 UART-RXD 86 multiplexed, serial IN, R612 pulldown resistor
gpio10 UART-TXD 87 multiplexed, serial OUT, direct to SoC
gpio11 Reset button 88 software controlled buttons
gpio12 QSS button 89
gpio13 LAN 1 LED 90 software controlled LEDs, can be hardware controlled if multiplexed
gpio14 LAN 2 LED 91
gpio15 LAN 3 LED 92
gpio16 LAN 4 LED 109
gpio17 WAN LED 110

Multiplexed pins cannot be software controlled. We can undo the multiplexing by writing some memory registers, allowing to recover the GPIO functionality.

Example, read the memory reg for GPIO mux (address 0x18040028)

devmem 0x18040028 32

this returns the value: 0x48002. The bit0 disables the JTAG pinmux, then we must write the value 0x48003

devmem 0x18040028 32 0x48003

Now we can control the GPIOs 6, 7 and 8 via software.

Version 4.21 (similar in 4.27)

name purpose
gpio0 WIFI LED
gpio1 QSS LED
gpio7 TP10
gpio11 Reset button
gpio13 WAN LED
gpio14 LAN 1 LED
gpio15 LAN 2 LED
gpio16 LAN 3 LED
gpio17 LAN 4 LED (0=on,1=off)
gpio26 QSS button
gpio27 SYS LED (0=on,1=off)

Other GPIOs are not working for me. I am able to export all of them, I even could change the direction, but when I write new value, it never changes.

Versions v4.x using AR9331, see reverse engineered pinout on ar9331_pinout or the official pinout.

Device works with Backfire 10.03.01 and latest trunk image and also with**Gargoyle** build, no flaws discovered.

Version 4.x has changed to use the AR9331 SoC, and is supported by the trunk version.
Probably the hardware of all v4.x versions is identical.

After installation of r31249 + LuCI, 604KB flash are free for additional packages.


  system type             : Atheros AR9330 rev 1
  machine                 : TP-LINK TL-WR741ND v4
  processor               : 0
  cpu model               : MIPS 24Kc V7.4
  BogoMIPS                : 265.42
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 16
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
  ASEs implemented        : mips16
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 0
  VCED exceptions         : not available
  VCEI exceptions         : not available
  • Router consumes between 0.5W and 1W, depending on the power supply voltage and load.
  • The power adapter is rated 9V @ 0.6A . The router can be powered from a battery.
  • V2 and V4.3 versions of the router contains an MP1482DS step down voltage regulator, with the voltage range from 4.75V to 18V. This are absolute maximum ratings, other components might not be able to withstand this voltage range. 5V to 15V should be a safe range (don't try this on other versions than V2 or V4.3 if you aren't sure).

There are two good blog posts, one for TP-LINK WR741ND V2.x, and TP-LINK WR741ND V4.x that explain steps needed.

An other good blog can be found here:

I would recommend you use Raspberry Pi for TFTP server.

And you need to connect to serial pins with USB to uart module, there are lots of cheap ones on eBay.

Here are commands you need to run once you have TFTP server running and serial console.

Turn on router, type tpl over serial terminal when the Autobooring in 1 second… message appears. You must be quick, or the router will continue bootlooping.

ar7240> setenv serverip <TFTP server IP>
ar7240> setenv ipaddr <Temp IP address on my network>
ar7240> tftpboot 0x80000000 openwrt-15.05-ar71xx-generic-tl-wr741nd-v2-squashfs-sysupgrade.bin
ar7240> erase 0x9f020000 +0x330004
ar7240> cp.b 0x80000000 0x9f020000 0x330004
ar7240> bootm 0x9f020000
ar7240> setenv serverip <TFTP server IP>
ar7240> setenv ipaddr <Temp IP address on my network>
ar7240> tftpboot 0x80000000 orig.bin
ar7240> erase 0x9f020000 +0x3c0000
ar7240> cp.b 0x80000000 0x9f020000 0x3c0000
ar7240> bootm 0x9f020000

Read about bootloader in general and about Das U-Boot in particular.

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

Tested on v4.27 board with pepe2k U-Boot 1.1.4. Selected memory was Hynix HY5DU121622CTP-J, ripped from 256MB PC2700S-25330 module. Solder-and-play, no additional config needed.

Tested on v1.4 board. Selected flash was W25Q128FVSSIG. Backup ART partition, flash BREED uboot (using Arduino), solder, boot into uboot, flash ART, flash OpenWrt.

There are instructions for making PoE for WR741ND V2.x (not for 4.x!) on DDWRT Forum.

To access the serial console of the wr741nd, you need to solder a serial header to the labelled pins.
Or if you prefer, you can solder 4 wires to the pins on the back of the board.

This is the right pinout.

  • Comment1: To get the serial connection work reliably, I had to connect a 10k pullup resistor between the TX and the 3.3V pin. This is because the TX pin is connected to a voltage divider (2×5.6k) and a capacitor is put between the real pin and the TX connector.
  • Comment2: In my case (v1.5), I had to pull down the TX pin with a 1k resistor. Also, I had to use the power cable, not the 3.3V on my serial.
  • Comment3: In my case (ca42 cable), the tx pullup didn't work. I had to pull the rx pin (I don't know why)
  • Comment4: In my case (v4.22) because of the voltage divider on the RX line I had to pull up the RX-pin to 5V using a 2,2k resistor. A 1k resistor to 3,3V isn't enough. I used the 5V supply of the USB.

Now connect a serial device (dku-5, ca-42) and away you go! The right settings for accessing the wr741nd serial console are as follows.

Device: ttyATH0
Bits per second: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None*
(*Note: No flow control did not work for my version 1.3, I had to use RTS/CTS)

Hint: it is possible to have a serial connector outside your router without drilling holes through your nice case. The trick is threading the 4 serial cables through the vent on the side of the router before putting back all the parts and closing the case. Below is an example.

WR741ND ver. 2.x

For this new revision its TP4→Tx and TP5→Rx in the center of PCB. On Chipset AR7240 they are pins 86→Rx and 87→Tx. (source)

WR741ND ver. 4.x

The version 4 of the board uses the standard TP-Link pinout, however the TX pin is not connected to the CPU. In order to make the TX line working, the two points on the bottom side of the PCB must be connected with a small wire.

Version 4.20 needs the same wire for TX, even if the layout is a tiny bit different. The pin at the SOC is labeled TP18, the one at the serial connector is labeled TP28. Output level is 2.5V with good flanks (measured with digital oscilloscope). Input is via a 1k/3k voltage divider, which does not make the RX line 5V tolerant! Connection needs a 3.3V RS232 level shifter, or can be directly done with, e.g., the Bus Pirate. Pins on the connector in the photo are from the left TX-RX-GND-3V3, as expected.

tl-wr741nd-v4_serial-fix.jpg TL-WR740N v4.23 case back view pins layout and serial fix.

For those who can take the risk of DESTROYING YOUR ROUTER an insane usb mod for v4 devices is available here.

It is possible to attach a usb socket directly to AR7240. You need to solder directly to SoC pins and provide two 15k pulldowns on every line. D- is pin 73 and D+ is pin 74. USB power should come from somewhere else (e.g. an additional step-down 5V regulator connected to the main power source, LM2574 seems like a nice choice).

WR740/WR741 4.x USB mod

For WR741ND V4.x pins are not directly accessible so you need to use fine dremel tool get access to usb pins:

This is how it should be connected:

You can read detailed instructions on the forum.

You also need this minor kernel patch (verified against Attitude Adjustment 12.09):

Index: target/linux/ar71xx/patches-3.3/990-WR741ND-usb.patch
--- target/linux/ar71xx/patches-3.3/990-WR741ND-usb.patch	(revision 0)
+++ target/linux/ar71xx/patches-3.3/990-WR741ND-usb.patch	(revision 0)
@@ -0,0 +1,10 @@
+--- a/arch/mips/ath79/Kconfig	2013-03-12 15:18:29.827389883 +0400
++++ b/arch/mips/ath79/Kconfig	2013-03-12 15:21:57.884753554 +0400
+@@ -506,6 +506,7 @@
+ 	select ATH79_DEV_AP9X_PCI if PCI
+ 	select ATH79_DEV_ETH
++	select ATH79_DEV_USB
+ 	select ATH79_DEV_LEDS_GPIO
+ 	select ATH79_DEV_M25P80
Index: target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr741nd.c
--- target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr741nd.c	(revision 36033)
+++ target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr741nd.c	(working copy)
@@ -16,6 +16,7 @@
 #include "dev-eth.h"
 #include "dev-gpio-buttons.h"
 #include "dev-leds-gpio.h"
+#include "dev-usb.h"
 #include "dev-m25p80.h"
 #include "machtypes.h"
@@ -97,6 +98,8 @@
 	u8 *mac = (u8 *) KSEG1ADDR(0x1f01fc00);
 	u8 *ee = (u8 *) KSEG1ADDR(0x1fff1000);
+	ath79_register_usb();
 	ath79_gpio_function_disable(AR724X_GPIO_FUNC_ETH_SWITCH_LED0_EN |

Here's how it works:

ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ar71xx-ohci ar71xx-ohci: Atheros AR71xx built-in OHCI controller
ar71xx-ohci ar71xx-ohci: new USB bus registered, assigned bus number 1
ar71xx-ohci ar71xx-ohci: irq 3, io mem 0x1b000000
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usb 1-1: new full speed USB device using ar71xx-ohci and address 2
usb 1-1: configuration #1 chosen from 2 choices
root@OpenWrt:/# cat /sys/kernel/debug/usb/devices 

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 2.06
S:  Manufacturer=Linux ohci_hcd
S:  Product=Atheros AR71xx built-in OHCI controller
S:  SerialNumber=ar71xx-ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=02(comm.) Sub=00 Prot=00 MxPS= 8 #Cfgs=  2
P:  Vendor=1457 ProdID=5122 Rev= 3.12
S:  Manufacturer=Linux 2.6.29-GTA02_a-t-gta01-tweaks-mokodev with 
S:  Product=RNDIS/Ethernet Gadget
C:  #Ifs= 2 Cfg#= 2 Atr=c0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=(none)
E:  Ad=83(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=(none)
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms

Also firmware for 741nd is working in 743nd

WR741 V1, V2 USB mod on trunk (Barrier Breaker)

Note: Modification for V4 is not needed. The files are already patched.

1. Setup you Buildroot (download the source, install the packages, make defconfig, make prereq, make menuconfig

2. Select the needed packages - kmod-usb-storage block-mount kmod-fs-ext4 e2fsprogs (you can add other kmod-fs modules for other file systems like NTFS and fat)

3. Run make (build the source).

4. Edit the following file (MUST BUILD FIRST!!!):

4.1 build_dir/target-mips_34kc_uClibc-


#include "dev-gpio-buttons.h"


#include "dev-usb.h"





4.2 build_dir/target-mips_34kc_uClibc-


select ATH79_DEV_USB


config ATH79_MACH_TL_WR741ND
      bool "TP-LINK TL-WR741ND support"
      select SOC_AR724X
      select ATH79_DEV_AP9X_PCI if PCI
      select ATH79_DEV_ETH
      select ATH79_DEV_GPIO_BUTTONS
      select ATH79_DEV_LEDS_GPIO
      select ATH79_DEV_M25P80

5. Make (compile) once again. Now usb support should work.

There is possibility to connect temperature sensor DS18S20/DS18B20 to QoS button or Reset button, read more on

You need some packages for w1 sensor

opkg update
opkg remove kmod-input-gpio-buttons
opkg install kmod-w1-gpio-custom
opkg install kmod-w1-slave-therm

remove gpio-buttons modul and load new modules

rmmod gpio-buttons    # this is needed, because modul is loaded from boot
insmod w1-gpio-custom bus0=0,12,0  # GPIO12 = QoS button
insmod w1-gpio
insmod w1_therm   

lsmod should be

lsmod | grep w1
  w1_gpio                  704  0 
  w1_gpio_custom           864  0 
  w1_therm                1808  0 
  wire                   13776  2 w1_gpio,w1_therm

If you connect sensor to reset button with parasite power

insmod w1-gpio-custom bus0=0,11,1 # GPIO11 = reset button

You can read temperature by

cat /sys/devices/w1_bus_master1/10-0008765432b0/w1_slave
# or
cat /sys/bus/w1/devices/10-0008765432b0/w1_slave

I found that QSS button is BTN_1 and reset is BTN_0 (in openwrt 12.09 on HW version 4.25 I have “wps” and “reset”) See also (in Polish, sorry)

Wifi on/off toggle by QSS button

(Thanks to obsy) Wifi toggle by QSS button Simply create a new file called 01onoff in /etc/hotplug.d/button/

vi /etc/hotplug.d/button/01onoff

and copy these lines inside (remember to push 'i' for insert)


[ "$BUTTON" = "BTN_1" ] && [ "$ACTION" = "pressed" ] && {
 SW=$(uci get wireless.@wifi-device[0].disabled)
 [ $SW == '0' ] && uci set wireless.@wifi-device[0].disabled=1
 [ $SW == '0' ] || uci set wireless.@wifi-device[0].disabled=0

Save and exit

(esc :wq)

Reboot by QSS button

Borrowed from Gargoyle:

uci set system.reboot_button=button
uci set system.reboot_button.button=BTN_1
uci set system.reboot_button.action=released
uci set system.reboot_button.handler='logger reboot ; reboot ;'
uci set system.reboot_button.min=3
uci set system.reboot_button.max=90
uci commit system

Press and hold QSS button for at least 3 seconds and router will reboot on release.

Warning!WARNING: You may be unable to access even if you see fancy fast flashing of “SYS” LED due to a bug #6922

  • Unplug the router's power cord
  • Connect any router LAN port directly to your PC
  • Configure your PC with a static IP address:
  • Plug the power on to the router
  • Wait until the “SYS” LED starts flashing repeatedly
  • Press the “QSS” button (on the front of the router) – the “SYS” LED will now start flashing at a faster rate
  • Login to the router by using telnet to connect to the IP address – there will be an immediate unauthenticated login to a root shell
  • mount_root - will mount the normal root filesystem
  • firstboot - all settings will be reset
  • reboot -f - will reboot even without a mounted filesystem

Since this part is identical for all devices, see Basic configuration.

Since this is the same for all TP-LINK products, see TP-LINK firmware features.

To connect stuff to the USB port, please see Connect stuff to the USB port.

After many cycles of:

opkg update
opkg install ... 
opkg remove ...
opkg install ... 
opkg remove ...
opkg install ... 
opkg update
opkg install ... 

You will save precious flash space, preinstalling these packages and config files with ImageBuilder. The official download link is know to be broken so use ImageBuilder from lastest trunk instead.

Only your changed config files will be saved to /overlay/etc/ folder. So it's that what you exactly have to copy to /files/etc/ folder in your ImageBuilder root.

SCP will not work if you didn't passwd and if you don't want to do passwd before copy files: You can do passwd and avoid SCPing passwd file or simlink /overlay inside /www and download config files at

ln -s /overlay /www/overlay

FIXME List config files anyway…

Default Packages + Default Profile if what you get when downloading a image from trunk:

make info
Current Target: "ar71xx (Generic)"
Default Packages: base-files libc libgcc busybox dropbear mtd uci opkg udevtrigger
	hotplug2 dnsmasq iptables ppp ppp-mod-pppoe kmod-ipt-nathelper firewall
	kmod-leds-gpio kmod-input-core kmod-input-polldev kmod-input-gpio-buttons
	kmod-button-hotplug swconfig
Available Profiles:
	Default Profile (all drivers)
	Packages: kmod-ath9k kmod-usb-core kmod-usb-ohci kmod-usb2 swconfig
		vsc7385-ucode-ap83 vsc7385-ucode-pb44 vsc7395-ucode-ap83
		vsc7395-ucode-pb44 wpad-mini
	Packages: kmod-ath9k wpad-mini

If all stuff selected fit into your router, it will be in:

ls -la ./bin/ar71xx/

Take care of file time, if build fails the file you see is from a previous successful build.


make -j2 FILES="~/OpenWrt-ImageBuilder-ar71xx-for-Linux-x86_64/files"
PROFILE="TLWR741NDV1" PACKAGES="kmod-sched kmod-ipt-filter kmod-textsearch kmod-ipt-ipopt 
kmod-ipt-conntrack-extra kmod-ipt-imq tc iptables-mod-ipopt iptables-mod-filter 
iptables-mod-conntrack-extra iptables-mod-imq qos-scripts" image
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/01/08 14:08
  • by danitool