前面已经引出了wr703n的rx、tx、+5V、GND信号，通过USB转串口电路板连接至电脑，就可以看到串口输出信息了。
目前手上有一块OCRobot的MangoII板子，上面有一块FT232RL芯片，可以作为USB转TTL工具使用。
把MangoII的TX、RX、DTR处的跳帽拔了，TX接wr703n引出的RX（即TP_IN），RX接wr703n引出的TX（即TP_OUT），5V接wr703n引出的+5V，GND接wr073n引出的GND，将MangoII通过USB线连接到电脑，就可以给wr703n供电了。
使用其他的USB转串口板子也是一样的，比如PL2303、CP2102芯片的USB转TTL板子都可以，在taobao上搜有很多。
在电脑上打开串口工具，波特率设为115200，可以看到启动输出信息了：
U-Boot 1.1.4 (Mar 18 2013 - 17:36:20)
AP121 (ar9330) U-boot
DRAM: 32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
Booting image at 9f020000 …
Uncompressing Kernel Image … OK
Starting kernel …
Booting AR9330(Hornet)…
Linux version 2.6.31–LSDK-9.2.0.312 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #1 Mon Mar 18 17:42:19 CST 2013
flash_size passed from bootloader = 4
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29880k/32768k available (1883k kernel code, 2888k reserved, 521k data, 112k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop… 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0
Whoops! This kernel is for product wr703 v1.0!
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
msgmni has been set to 58
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
cmdlinepart partition parsing not available
set partition boot
set partition kernel
set partition rootfs
set partition config
set partition art
set partition
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7240-nor0
Creating 5 MTD partitions on “ar7240-nor0”:
0x000000000000-0x000000020000 : “boot”
0x000000020000-0x000000120000 : “kernel”
0x000000120000-0x0000003e0000 : “rootfs”
0x0000003e0000-0x0000003f0000 : “config”
0x0000003f0000-0x000000400000 : “art”
->Oops: flash id 0x1c3016 .
ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
Port Status 1c000004
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 112k freed
init started: BusyBox v1.01 (2013.03.18-09:49+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (512 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module /lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module/lib/modules/2.6.31/kernel/flashid.ko’: No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko’: No such file or directory
Now flash open!
(none) mips #1 Mon Mar 18 17:42:19 CST 2013 (none)
(none) login: Now flash open!
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
2
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 40
ATHR_GMAC: Max rx descriptor count : 96
ATHR_GMAC: Mac capability flags : 4D83
1
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 40
ATHR_GMAC: Max rx descriptor count : 252
ATHR_GMAC: Mac capability flags : 4403
athr_gmac_ring_alloc Allocated 640 at 0x81e82800
athr_gmac_ring_alloc Allocated 4032 at 0x81d63000
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY…mac 0
athr_gmac_ring_alloc Allocated 640 at 0x81e82400
athr_gmac_ring_alloc Allocated 1536 at 0x81f2e000
athr_gmac_mii_setup: MDC check failed
Setting Drop CRC Errors, Pause Frames and Length Error frames
ATHRS26: resetting s26
ATHRS26: s26 reset done
Setting PHY…mac 1
device eth0 entered promiscuous mode
Now flash open!
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
asf: module license ‘Proprietary’ taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss)
Boostrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x80c942c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80c942c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
DES SSID SET=TP-LINK_F9F34A
ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c0abc6c0 arg=81f6aac0
wlan_vap_delete : enter. vaphandle=0x81c80000
wlan_vap_delete : exit. vaphandle=0x81c80000
wlan_vap_create : enter. devhandle=0x80c942c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80c942c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
DES SSID SET=TP-LINK_F9F34A
ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
WARNING: Fragmentation with HT mode NOT ALLOWED!!
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
ieee80211_ioctl_siwmode: imr.ifm_active=918144, new mode=3, valid=1
br0: port 2(ath0) entering disabled state
DES SSID SET=TP-LINK_F9F34A
br0: port 2(ath0) entering forwarding state
可以看到flash各区的内容分布：
0x000000000000-0x000000020000 : “boot”
0x000000020000-0x000000120000 : “kernel”
0x000000120000-0x0000003e0000 : “rootfs”
0x0000003e0000-0x0000003f0000 : “config”
0x0000003f0000-0x000000400000 : “art”
还可以看到falsh id：
->Oops: flash id 0x1c3016
到这里，系统已经启动完毕，如果通过串口发送回车，可以看到出现了linux的login界面，网上说用户名root+密码5up可以登入，可惜没有成功。
下面我们要进入Uboot的命令行模式，在出现“Autobooting in 1 seconds”时，快速输入tpl回车。
这个模式下可以通过tftp下载文件，然后刷写flash。
hornet> ?
? - alias for ‘help’
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
hornet> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 362/65532 bytes
hornet> version
U-Boot 1.1.4 (Mar 18 2013 - 17:36:20)
通过md.b 0x9f000000 0x20000命令可以把uboot区以字节形式dump出来。
uboot、fw和art在flash中的位置如下：
4M的FLASH：flash地址从0x000000~0x3FFFFF
ttl访问flash的地址从0x9F000000~0x9F3FFFFF
8M的FLASH：flash地址从0x000000~0x7FFFFF
ttl访问flash的地址从0x9F000000~0x9F3FFFFF
下面开始刷openwrt固件，刷之前建议看一下http://wiki.openwrt.org/toh/tp-link/tl-wr703n
这块wr703n应该是v1.7的，版本3.14.5 Build 130318 Rel. 64321n，这个版本应该刷入OpenWrt的Attitude Adjustment分支固件：http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
进入系统工具-软件升级，选择刚才下载的固件openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin，等待刷成功。
刷完后在串口可以看到Uboot部分输出信息没变，kernel启动部分已经是新刷的OpenWrt内核信息了。
网上说要telnet进去修改一下root密码才能ssh登陆进去，我直接从串口输入回车就进入了root命令行界面，修改root密码更方便了。后面ssh登陆系统就跟操作普通linux系统一样了。
刷完这个固件，从web页面登陆进去就已经是luci界面了，不需要再刷openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin了。
倒腾了一天将wr703n配置成ap客户端+普通ap的混合模式：普通AP模式不用多说，AP客户端模式是指wr703n通过自己的无线连接家里的主无线路由进行上网，笔记本其他设备可以通过网线连接至wr703n的LAN/WAN口进行上网，相当于一块无线网卡。
直接贴配置，需要配的同学可以参考，wireless配置文件中的option wds ‘1’ 比较关键，不加上去就连不上。(在公司网络不加也可以连上，家里就不行，不同环境不一样，可以加上或去掉多试试)
network：
config interface ‘loopback’
option ifname ‘lo’
option proto ‘static’
option ipaddr ‘127.0.0.1’
option netmask ‘255.0.0.0’
config interface ‘lan’
option ifname ‘eth0’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘192.168.1.1’
option netmask ‘255.255.255.0’
config interface ‘wwan’
option proto ‘dhcp’
config interface ‘wlan’
option proto ‘static’
option ipaddr ‘192.168.2.1’
option netmask ‘255.255.255.0’
wireless：
config wifi-device ‘radio0’
option type ‘mac80211’
option channel ‘11’
option macaddr ‘1c:fa:68:f9:f3:4a’
option hwmode ‘11ng’
option htmode ‘HT20’
list ht_capab ‘SHORT-GI-20’
list ht_capab ‘SHORT-GI-40’
list ht_capab ‘RX-STBC1’
list ht_capab ‘DSSS_CCK-40’
option disabled ‘0’
option txpower ‘27’
option country ‘US’
config wifi-iface
option device ‘radio0’
option mode ‘ap’
option ssid ‘OpenWrt’
option encryption ‘none’
option wds ‘1’ #可不加
option network ‘wlan’
config wifi-iface
option network ‘wwan’
option ssid ‘fofo’
option encryption ‘psk2’
option device ‘radio0’
option mode ‘sta’
option bssid ‘00:21:29:74:33:EB’
option key ‘xxxxxxxx’
option wds ‘1’ #可不加
dhcp：
config dnsmasq
option domainneeded ‘1’
option boguspriv ‘1’
option filterwin2k ‘0’
option localise_queries ‘1’
option rebind_protection ‘1’
option rebind_localhost ‘1’
option local ‘/lan/‘
option domain ‘lan’
option expandhosts ‘1’
option nonegcache ‘0’
option authoritative ‘1’
option readethers ‘1’
option leasefile ‘/tmp/dhcp.leases’
option resolvfile ‘/tmp/resolv.conf.auto’
config dhcp ‘lan’
option interface ‘lan’
option ignore ‘1’
config dhcp ‘wan’
option interface ‘wan’
option ignore ‘1’
config dhcp ‘wlan’
option start ‘100’
option leasetime ‘12h’
option limit ‘150’
option interface ‘wlan’
firewall：
config defaults
option syn_flood ‘1’
option input ‘ACCEPT’
option output ‘ACCEPT’
option forward ‘REJECT’
config zone
option name ‘lan’
option input ‘ACCEPT’
option output ‘ACCEPT’
option forward ‘REJECT’
option network ‘lan wlan’
config zone
option name ‘wan’
option input ‘REJECT’
option output ‘ACCEPT’
option masq ‘1’
option mtu_fix ‘1’
option forward ‘ACCEPT’
option network ‘wan wwan’
config forwarding
option src ‘lan’
option dest ‘wan’
config rule
option name ‘Allow-DHCP-Renew’
option src ‘wan’
option proto ‘udp’
option dest_port ‘68’
option target ‘ACCEPT’
option family ‘ipv4’
config rule
option name ‘Allow-Ping’
option src ‘wan’
option proto ‘icmp’
option icmp_type ‘echo-request’
option family ‘ipv4’
option target ‘ACCEPT’
config rule
option name ‘Allow-DHCPv6’
option src ‘wan’
option proto ‘udp’
option src_ip ‘fe80::/10’
option src_port ‘547’
option dest_ip ‘fe80::/10’
option dest_port ‘546’
option family ‘ipv6’
option target ‘ACCEPT’
config rule
option name ‘Allow-ICMPv6-Input’
option src ‘wan’
option proto ‘icmp’
list icmp_type ‘echo-request’
list icmp_type ‘echo-reply’
list icmp_type ‘destination-unreachable’
list icmp_type ‘packet-too-big’
list icmp_type ‘time-exceeded’
list icmp_type ‘bad-header’
list icmp_type ‘unknown-header-type’
list icmp_type ‘router-solicitation’
list icmp_type ‘neighbour-solicitation’
list icmp_type ‘router-advertisement’
list icmp_type ‘neighbour-advertisement’
option limit ‘1000/sec’
option family ‘ipv6’
option target ‘ACCEPT’
config rule
option name ‘Allow-ICMPv6-Forward’
option src ‘wan’
option dest ‘*’
option proto ‘icmp’
list icmp_type ‘echo-request’
list icmp_type ‘echo-reply’
list icmp_type ‘destination-unreachable’
list icmp_type ‘packet-too-big’
list icmp_type ‘time-exceeded’
list icmp_type ‘bad-header’
list icmp_type ‘unknown-header-type’
option limit ‘1000/sec’
option family ‘ipv6’
option target ‘ACCEPT’
config include
option path ‘/etc/firewall.user’
至此可以正常上网了。
更新一下pkg：
opkg update
装上usb转串口驱动：
opkg intall kmod-usb-serial-ftdi
其他芯片的安装对应驱动模块，如kmod-usb-serial-pl2303
为后面ser2net做好准备。