Trying LEDE/OpenWrt on AR9331 based Skylab SKW72 (AP121)


I recently ordered an AR9331 based device from skylab. The description claims that the module supports openwrt.

I do not have a eval board for this, and powering up the module - it creates an access point to which I can connect and login to the administration page. Here is a screenshot.


The module I have contains 16MB flash and 64MB RAM, or so the manufacturer claims. The label on the RAM confirms that it is 64MB. The label on the winbond flash is illegible, so I cannot confirm that value.

When I asked the manufacturer for an openwrt firmware I was pointed to download the image for TP-Link 710N. Specifically, this was the image that was shared with me.

Now TP-Link WR710N is only 4MB flash. The most I can get in WR710N series is 8MB (V2.1). One product which has 16MB of flash is GLInet AR150.

Here are some open questions:

  1. Which firmware should I try. TP-Link710N or AR150?
  2. Which variant should I try. Factory or Sysupgrade. It seems to me the stock firmware isn't openwrt, so I guess I have to try Factory.
  3. Since I don't have a physical LAN port on the module, how am I going to access the module after I flash the firmware. I think openwrt disables wifi by default. There seems to be UART pins exposed which I have access to, so I could presumably use that.
  4. Is there an easy instruction somewhere to turn the wifi on if I get this far?

This is a competitively priced module ($9-10) with AR9331, 16MB ROM, 64MB RAM, but barely little or nothing is available on the openwrt forums on this. I think if it can be made to work with the latest releases, then it might be a useful addition to the supported devices list.

Try this page:
and this page:,scm-url:1007.13338.98644.000000000000000

Thanks for the links and the information. Some thoughts:

  1. On the som9331 page, it says that the TP-LinkWR703N version of openwrt is confirmed to run on it. There are a few caveats:

  2. The device I have has 16MB flash, as opposed to TP-LinkWR703N's 4MB. Documentation here suggests it might be nontrivial to make buildenv changes to make 16MB supported 703N builds.

  3. It seems that GLInet 6416 is a successor to the 703N as mentioned in the openwrt pages. It also has 16MB RAM and has factory build images available. Would it be worth trying this?

  4. If the answer to (3) above is a yes, then the question is if I should try stock openwrt factory image for 6416, or download one from glinet. The latter will have the advantage of having the wifi enabled by default. However, I will have to check if this is a factory or a sysupgrade image. Is there a way?

Builds of OpenWrt for TP-Link devices generally detect the flash size at first boot and build the jffs to use all the space. It is not necessary to recompile at all.

Okay, so I am able to connect via serial from my laptop, and see these messages as below, when the router boots

Connecting to /dev/ttyUSB0, speed 115200
 Escape character: Ctrl-\ (ASCII 28, FS): enabled
Type the escape character followed by C to get back,
or followed by ? to see other options.

U-Boot 1.1.4 (Dec 23 2014 - 15:23:36)

AP121 (ar9331) U-boot

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 139k for U-Boot at: 83fdc000
Reserving 192k for malloc() at: 83fac000
Reserving 44 Bytes for Board Info at: 83fabfd4
Reserving 36 Bytes for Global Data at: 83fabfb0
Reserving 128k for boot params() at: 83f8bfb0
Stack Pointer at: 83f8bf98
Now running in RAM - U-Boot at: 83fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16777216, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x83ff3e38
Fetching MAC Address from 0x83ff3e38
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:11:4c:46
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:11:4c:47
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0 

The output of printenv is:

ar7240> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),14912k(rootfs),1024k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9fee0000

Environment size: 361/65532 bytes

If I do not interrupt boot, I get the following messages followed by gibberish...

## Booting image at 9fee0000 ...
skylab David debug: addr = 9fee0000 ;sizeof(image_header_t)=64 
skylab David debug: hdr->ih_magic = 27051956 
   Image Name:   Linux Kernel Image
   Created:      2016-01-12   2:15:08 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    782063 Bytes = 763.7 kB
   Load Address: 80002000
   Entry Point:  801a1b30
   Verifying Checksum at 0x9fee0040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 801a1b30) ...
## Giving linux memsize in bytes, 67108864

Starting kerner

So, does this mean the router might already be running some kind of openwrt? I know it means it is atleast running uboot :slight_smile:

Should I be able to use sysupgrade images with this? That would make things easier as there are already sysupgrade images I have that run on AP121 type board (of which this seems to be one).

I've tried uploading a firmware through the firmware update method on the router's web-ui, but it doesn't accept the firmware.

I cannot really do tftp over uboot as I don't have a working ethernet port on the router (just physical pins), so am a little stuck as to what to do now :slight_smile:

The garbled output is likely because the kernel sets a different baud rate after boot. Try different baud rates on your terminal.

The partitioning scheme is not the standard TP-Link. Do not try to flash WR703 firmware to that unit, it will not work.

Hmm, the board shows in the uboot messages that it is based on the AP121 design, so I guess I should use some compatible image (like domino core perhaps).

Another problem is that I don't have a RJ45 ethernet port on this module - so I am kind of stuck. Any thoughts on how can I transfer a firmware image on the board?

One thing that I tried is setting over an ethernet connection without magnetics and only capacitive coupling between this and a domino core, but the domino core doesn't seem to recognize this connection, so I guess it doesn't work. I will try another capacitive coupling configuration, as there are a few ways in which it can apparently be done...

I bought a GLInet 6416 from aliexpress for about $20, and flashed LEDE on it.

Which commands are included in u-boot? Use the command "help"...
If you have loadx, loady or loadb you could upload a image over serial to ram and flash it or run it directly from ram for testing...

On ubuntu/debian you need the package "lrzsz" and with "sx" you can transfer it over serial to your device...

On u-boot console you will type:
loadx 0x81000000 (RAM Address)

And on pc:
sx firmware.bin </dev/ttyUSB0 >/dev/ttyUSB0

Then on u-boot:
bootm 0x81000000

I only have used loadx for now, but loady should also work... but i beleve you will need for this "ckermit"

For the first test you should only use a initram image, check your detected partition layout and backup with this your mtd... Then if you are sure it will match your device, you could do a sysupgrade from withing the initram image and reboot to your flashed image...