OpenWrt Forum Archive

Hello everyone !

A friend of mine gave me the above mentioned AP as he managed to brick it somehow and the thing won't boot anymore. Nevertheless, I want to make this my hobby project and try to get OpenWrt on it.

I've got a USB to Serial adapter: http://www.amazon.com/NooElec-Adapter-H … 009GXEF8A/ and was wondering if someone managed to get something from this device's bootloader and was willing to share his experience.

As described here: http://wiki.openwrt.org/toh/tp-link/tl-wa901nd there should be a way to do it, but I'm not sure that my tools would be enough.

I am able to hook up the adapter to my Fedora box just fine:

[ 1599.466052] usb 3-1: new full-speed USB device number 2 using xhci_hcd
[ 1599.477594] usb 3-1: New USB device found, idVendor=067b, idProduct=2303
[ 1599.477601] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1599.477605] usb 3-1: Product: USB-Serial Controller
[ 1599.477618] usb 3-1: Manufacturer: Prolific Technology Inc.
[ 1599.503697] usbcore: registered new interface driver pl2303
[ 1599.503722] usbserial: USB Serial support registered for pl2303
[ 1599.503743] pl2303 3-1:1.0: pl2303 converter detected
[ 1599.505120] usb 3-1: pl2303 converter now attached to ttyUSB0
[ 1646.881668] usb 3-1: USB disconnect, device number 2
[ 1646.881923] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0
[ 1646.881951] pl2303 3-1:1.0: device disconnected

I'll go with either cutecom or minicom, whichever comes in first.

Anyway, I'm hoping to get out of this one without any pin solding but I'm up for anything

The PCB is out of its box and ready for intervention. One thing I noticed is that the AP makes a funny noise while its PWR, SYS and WLAN leds remain on and after 3s, the LAN and QSS leds are flashing while the others are off. This happens in a loop while the little noise can be heard.

I'd be grateful if anyone could let me know if I still have a chance with it or not.

Thank you !

LE: thanks to an the amazing spirit of 'community help' of user nebbia88 (thank you again, couldn't have done it without you !), with his help, I managed to get this nice AP working again.

Here are the things I used:

- laptop with FC 19
- minicom (picocom can be used as well if you want to do it via tftpboot, see below)
- PL2302 USB to TTL (amazon link is above)
- obviously, the firmware that you want to use. I used: openwrt-ar71xx-generic-tl-wa901nd-v2-squashfs-factory.bin Please rename it to something much shorter like 'firm.bin'.
- a TFTP server (couldn't use it in my case, but maybe you're luckier)
- time and steady hands

So, after you unboxed the adapter, you go ahead and connect the cables to the adapter as follows:

1. GND - gray
2. RX - brown
3. TX - blue

On the AP's PCB, as you keep it with the antenna plugs oposite from you, from bottom to top:

1. RX - brown
2. TX - blue
3. GND - gray

Obviously, the color choice is all yours; my example is to help you match the pins correctly. Basically, you just need to cross-connect the TX with the RX, (TX - transmit, RX - read), so the adapter can read what the AP says and the other way around. Makes sense, right ?

This adapter has three LEDs on it. Red ( will be powered on at all time), a tiny yellow/orange one next to the red one, and a blue LED. Yellow/orange and blue will flash synchronously with the AP restarting itself as it's in a loop (see top of the post).

Soldering the pins is not necessary if you have great patience and steady hands, but it is the easy and recommended way.

Once you have the pins connected (see this clip on Youtube on how it should look like: http://www.youtube.com/watch?v=S_mfc6rtNPs), you can proceed on your computer.

As this post covers the proces being done on a Linux box, connect the adapter to your USB port and see the dmesg output like in the top of the post.

minicom -s

Go to the 'Serial port setup'. Pless 'A' key and change to '/dev/ttyUSB0'. Make sure 'Bps/Par/Bits' reads '115200 8N1'.
Press 'ESC' key and then do a 'Save settings as dfl'. You'll find your way pretty easy in this GUI.
Press 'ESC' once again from the menu to be returned to the terminal itself. You'll see 'Offline' in the bottom-right corner.

Power on the AP (for the sake of confusion here, please make sure tha your AP IS connected to its power unit) and immediately go back to the minicom terminal and start typing "tpltpltpltpltpltpltpl" (read Tango-Percy-Louise) as fast as you can, multiple times per second even - this was the most fun part

Once you get the promp (after you see ar7100>), you can start typing the following:

ar7100> loady

Now press CTRL+A then Z, and at the menu, choose 'Send files' by pressing the 'S' key. Choose 'ymodem' and just browse to the firmware you want to flash.
..wait for the transfer to complete... then proceed with:

ar7100> erase 0xbf020000 +0x3c0000
ar7100> cp.b 0x81000000 0xbf020000 0x3c0000
ar7100> reset

Since I was still connected to the box with minicom, after the boot sequence was done, I pressed the 'Enter' key and saw the OpenWrt MOTD and resetted the root password from that prompt. You can play around with it from here. Here are my configuration files for a fast setup with the AP getting its IP via DHCP and WiFi enabled:

[dvaida@scat Downloads]$ ssh root@10.0.1.29
root@10.0.1.29's password: 


BusyBox v1.19.4 (2014-01-29 05:40:54 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (Bleeding Edge, r39406)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
root@OpenWrt:~# cat /etc/config/
dhcp      dropbear  firewall  luci      network   system    ubootenv  ucitrack  uhttpd    wireless
root@OpenWrt:~# cat /etc/config/dhcp 

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'

config dhcp 'lan'
        option interface 'lan'
        option ignore '1'


config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

root@OpenWrt:~# cat /etc/config/dropbear 

config dropbear
        option PasswordAuth 'on'
        option Port '22'
        option Interface 'lan'

root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'


config interface 'lan'
        option ifname 'eth0'
        option type 'bridge'
        option _orig_ifname 'eth0 wlan0'
        option _orig_bridge 'true'
        option proto 'dhcp'


root@OpenWrt:~# cat /etc/config/
dhcp      dropbear  firewall  luci      network   system    ubootenv  ucitrack  uhttpd    wireless
root@OpenWrt:~# cat /etc/config/wireless 
config wifi-device  radio0
        option type     mac80211
        option channel  11
        option hwmode   11ng
        option path     'platform/ath9k'
        option htmode   HT20
        list ht_capab   SHORT-GI-40
        list ht_capab   DSSS_CCK-40
        # REMOVE THIS LINE TO ENABLE WIFI:
        option disabled 1

config wifi-iface
        option device   radio0
        option network  lan
        option mode     ap
        option ssid     OpenWrt
        option encryption none

root@OpenWrt:~#

Press CTRL+A then Q for exiting minicom.

You should now be able to access your box through SSH as described all across the forums / wiki.

Connect it to a DHCP-enabled network and then connect to it again via SSH and install luci as described in the wiki page.

Troubleshooting:

Quick tip to ensure you have a working adapter: connect only the cables to the RX and TX and connect the adapter to your computer. Open your terminal of choice, and make a short circuit between RX and TX by touching one another or putting a screwdriver on both. You should see something in your terminal.

My attempt using picocom:

[root@scat Downloads]# picocom -b 115200 -r -l /dev/ttyUSB0
picocom v1.7

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : yes
nolock is      : yes
send_cmd is    : sz -vv
receive_cmd is : rz -vv
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,

Terminal ready

�U-Boot 1.1.4 (Feb 24 2012 - 16:48:46)

AP81 (ar7100) U-boot
DRAM:  
sri
32 MB
id read 0x100000ff
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
bsingle_phy = 0
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds## Booting image at bf020000 ...
   Uncompressing Kernel Image ... Error: Bad gzipped data
GUNZIP ERROR - must RESET board to recover

Resetting...

My tftpboot attempt:

U-Boot 1.1.4 (Feb 24 2012 - 16:48:46)

AP81 (ar7100) U-boot
DRAM:  
sri
32 MB
id read 0x100000ff
flash size 4MB, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
bsingle_phy = 0
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 secondsar7100>     
ar7100> 
ar7100> 
ar7100> setenv ipaddr 10.0.1.30
ar7100> setenv serverip 10.0.1.28
ar7100> erase 0xbf020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000
  61
Erased 60 sectors
ar7100> tftpboot 0x81000000 me2.bin
set link to 100M full by lqm.
dup 1 speed 100
Using eth0 device
TFTP from server 10.0.1.28; our IP address is 10.0.1.30
Filename 'firm.bin'.
Load address: 0x81000000
Loading: T T T T T T 
Retry count exceeded; starting again
set link to 100M full by lqm.
Using eth0 device
TFTP from server 10.0.1.28; our IP address is 10.0.1.30
Filename 'firm.bin'.
Load address: 0x81000000
Loading: T T T T T T 
Retry count exceeded; starting again
set link to 100M full by lqm.

Useful resources:
http://blackfin.uclinux.org/doku.php?id … ding_files
http://www.kramex.info/?p=44
http://wiki.openwrt.org/toh/tp-link/tl- … erial.port
http://www.df.lth.se/~triad/krad/tftpserver.html
http://wiki.openwrt.org/_media/toh/tp-l … ial_if.jpg
http://stackoverflow.com/a/6719367
http://wiki.openwrt.org/doc/hardware/port.serial
http://wiki.openwrt.org/toh/tp-link/tl-wa901nd

Most of this post is information that nebbia88 so kindly oferred me and the rest are things that I've been reading here and there.

I had lots of fun and would definitely enjoy helping out someone else who needs help with this. I hope I didn't forget anything, if you have any questions, please let me know.

Thank you OpenWrt community !

(Last edited by danvaida on 8 Feb 2014, 12:33)