TP-LINK TL-WR720N v2

TP-LINK TL-WR720N v2.x

FCC approval date: 30 December 2015
EAN: 6935364090739 (UPC DB, On eBay)
Country of manuf.: China

Type: wireless router

Power: 5 VDC, 0.6 A
Connector type: barrel

CPU1: Atheros AR9331
FLA1: 2 MiB2,097,152 B 16,384 Kib 2,048 KiB 16 Mib 0.00195 GiB  (GigaDevice GD25Q16CSIG)
RAM1: 16 MiB16,777,216 B 131,072 Kib 16,384 KiB 128 Mib 0.0156 GiB  (Zentel A3S28D40JTP-50)

Expansion IFs: USB 2.0 (solder pads), GPIO
Serial: yes, 4-pin header, J1, TP18, (115200,8,N,1)

WI1 chip1: Atheros AR9331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 1x1:1
WI1 antenna connector: soldered

ETH chip1: Atheros AR9331
Switch: Atheros AR9331
LAN speed: 100M
LAN ports: 2
WAN speed: 100M
WAN ports: 1

bgn

Stock FW OS: VxWorks 5.5.1

802dot11 OUI: 18:D6:C7 (3 E, 2 W)
Ethernet OUI: 18:D6:C7 (3 E, 2 W)

	CPU1 brand	WI1 chip1 brand	WI1 chip2 brand
TP-LINK TL-WR720N	Atheros	Atheros
TP-LINK TL-WR720N v2	Atheros	Atheros

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.

150Mbps Wireless N Router

Product page • Support page

"2050500519", "CA-F120" and "164602002" (11/2016)

is silkscreened on the board.

V2 has external fixed antenna (internal Inverted-F in V1).

TP-LINK TL-WR720N on OpenWrt wiki

See also TP-LINK TL-WR720N v3.0 (3G) and v4.0 (CN)

(completely different devices under the very same name,

see TP-LINK_TL-WR720N v1 page for more info)

Stock firmware

wr720nv2-ru-up.bin bootloader at 0x68d4, kernel at 0x40114

(LZMA 6E 00 00 80 00).

FS signature 4x owowowow, BE32 = 1?, BE32 file count, BE32?,

40 char name, BE32 len and ofs (LZMA 5A 00 00 80 00).

Serial

[ TX ] ( RX ) ( GND ) ( 3.3V )

You need to solder a jumper wire between TP18 and TP28 on the back

of the PCB for TX to work.

TX are logs from router to PC (-> RX on PC side), RX commands back

(3.3V to 2.5V resistor divider nearby <- TX).

V1 repair features PCB photos, boot log and unsuccessful flash chip /

firmware upgrade to one of MR3220. • same guy? • boot log

Bootloader confusingly indicates only 8 MiB of RAM (pDmaBuf=0x80637910, buffend = 80782514),

while VxWorks kernel later allocates full 16 MiB (pDmaBuf=0x80e1c560, buffend = 80f67164).

VxWorks-based WR702N and WR710N exhibit the same bug.

VxWorks

Tap Enter after the boot log to access VxWorks console. help or ? prints commands available.

Not very useful since almost everything is hardwired, but provides some insight into inner workings.

Full flash backup

Set up PC for fixed IP 192.168.1.100 with TFTP server, wired connection to LAN port is required.

Start terminal at 115200 baud, issue Ctrl+C to stop auto-boot after ~1 s, then

flash read 0 80100000 200000
tftp 192.168.1.100 put full.bin 80100000 200000

bootloader and kernel identical to wr720nv2-ru-up.bin without 0x94 bytes header
0x1c0000 - settings (backed up as encrypted config.bin)
0x1e0000 - LAN/Wireless MAC address (6 bytes), 0x1e0010 - WPS PIN (ASCII)
0x1f1000 - calibration area (0x440 bytes), most important part to back up!

Images

TL-WR720N rev 2.1 PCB
tag on bottom
possible expansion