I've got a wired (no radio) router that looks like a decent little device. Unfortunately, it's a TP-Link and the firmware is predictably pathetic. The SoC is a QCA (Atheros) 9533, which appears to be supported in Barrier Breaker. I'm trying to get a serial connection in order to reliably flash OpenWRT builds, but I'm failing miserably. With a multi-meter, I've managed to identify VCC and GND, which leaves two pins for Tx/Rx or Rx/Tx. I've tried both directions with no luck. I've read of other TP-Link devices needing pull-ups between Tx and VCC. Tried it on both potential headers, no luck.

Here's a photo with various headers and nearby surface mount points labeled with voltages. Pins 2 & 4 (from the left) are connected to the nearby pads (one side of R169 and C165; neither present). My hunch is that one or more of those missing components needs to be present for serial to work. I've tried a 4.5k and 10k resistor across the R169 gap, but still no joy.

Any ideas?

(Last edited by brnt on 28 Oct 2014, 04:40)

Try doing this: (jumper, solder bridge or 0ohm resistor)

(Last edited by dabyd64 on 28 Oct 2014, 02:00)

Thanks for the suggestion. Still doesn't work :-(

Any other ideas?

You have two lines to CPU, one going directly (left) and other somehow mess with R169 and R170. Try to draw this part of schematic, possibly one go to 3.3 and other to pin.

(Last edited by _DS_ on 28 Oct 2014, 09:15)

At idle Rx should be near 0V and Tx around 3V. I see that one is at 2.48, no doubt that that pin is Tx.
I your serial doesn't see anything, it may be because the voltage is too low for a 5V serial converter.
Try putting a 1K resistor in R163 and then other 1K resistor to Vcc (3.3V).
Theorically that will help a bit, a logical '1' will be 2.9V and a logical '0'  will be 1.65V. Very high for a 0 but it coukd work.

I tried the two 1k resistors and still no luck. At another suggestion, I tried a solder bridge across R169 without any noticeable change. Below is another photo of the PCB that shows the traces more clearly. You can see R157 is missing if you follow the trace from the leftmost pin (#1) toward the CPU. R169 would connect the trace between the CPU and pin #2. R170 would connect that same trace to GND. The adjacent pads between R169 and R170 are connected.

Other folks have suggested (based on voltage readings) that pin #1 should be Rx and #2 should be Tx. If that's the case R157 missing could effectively make the serial connection read-only. The missing combination of Rs 169 and 170 would disable serial output.

Thanks for the suggestions thus far. I'm happy to keep trying things as long as anyone else is willing to keep suggesting them :-)

Check lines near CPU, possibly R155-157. R169 should be 0 ohm.

Oh that should be the problem. Bridge r157 and r169.
So you can read but cannot write, right? I thought you could do nothing!

There is always a chance that the original firmware has no echo function trough the serial lines..

Most VxWorks based firmwares only spit out a little debug info during the bootloader, and after the kernel call you get nothing.

Have you tried asking for the gpl files for that board?

OK! I used to have no read and no write. I solder-bridged R169 and R157 and now I get some console output on initial post:

U-Boot 1.1.4--LSDK-9.5.3.16 (Build from LSDK-9.5.3.16 at Mar 26 2014 - 20:33:26)

board953x - Honey Bee 1.1DRAM:
sri
Honey Bee 1.1
ath_ddr_initial_config(200): (16bit) ddr1 init
tap = 0x00000002
Tap (low, high) = (0x5, 0x39)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
 4 MB

Typing 'tpl' at this screen doesn't give me a u-boot prompt or menu or do anything that I can tell.

However, if my serial adapter is connected during boot, the router doesn't boot. If I wait until it's booted and then connect my adapter to it, I get a prompt:

TP-LINK > ?
 disable              - Exit the privileged mode
 enable               - Enter the privileged mode
 exit                 - Exit the CLI (only for telnet)
 history              - Show command history
 ip                   - Ip configuration
 ip-mac               - Ip-mac binding configuration
 sys                  - System manager
 user                 - User configuration

Read and write both work at this prompt, but the only command that seems to do anything (besides '?') is enable, which prompts me for a password and then doesn't do anything more.

A few questions:

* Has anyone seen the serial-adapter-keeps-my-router-from-booting thing?
* Does anyone know if there's an established process for requesting GPLed code from TP-Link (as @carrapato suggested)?
* Any ideas for how to get to the u-boot prompt if the regular type 'tpl' within 1 sec doesn't work?

At this point, what I really want is to get to the u-boot menu/prompt. From there I can flash firmware (and bootloader) to my heart's content. All comments and suggestions appreciated.

Thanks to everybody for your help so far.

Edit: fixed a typo

(Last edited by brnt on 3 Nov 2014, 02:15)

VxWorks is not GPL, not Linux. I doubt the will release anything.

Tplink usually uses the user/password    "root/5up"

(Last edited by dabyd64 on 3 Nov 2014, 14:44)

Maybe not Vxworks, but Uboot certainly. (Is under GPL). never had to ask for it, tough.

My approach would be to get the TFTP way with an image to the closest supported Soc.

Indeed, i found that Tl-wr841nd version 8 has the same Soc, and is currently supported, so, here is the image:

http://downloads.openwrt.org/barrier_br … actory.bin

I recommend that you get familliar with the build-your-own-image thing, cause you have only 4Mb of flash in that thing, and you're gonna wanna remove those wifi drivers and open space for more usefull stuff, such as tcpdump, iptraf, or whatever.

But i really believe that this image should boot as-is, and off course give you errors such as no ART partition, wifi controller not found in pci bus, etc.

http://wiki.openwrt.org/toh/tp-link/tl-wr841nd   << may be interesting reading

As of now, images for v8 and v9 are exaclty the same(as it looks in bytecount), but may be interesting to test v9 image aswell.

http://downloads.openwrt.org/barrier_br … actory.bin

(Last edited by carrapato on 5 Nov 2014, 05:56)

I'm familiar with building my own firmware (including for the 841) and flashing it via various methods. I just hesitate to start that before I have uboot access. As I mentioned above, with this new router I get a uboot splash on initial startup, but nothing works at that stage of booting (i.e., no keyboard and no TFTP). I wonder if it's related to the router refusing to boot if my serial adapter is connected. Does anybody have an idea about either of those things?

You can leave only TX pin connected and check.

http://www.tp-link.com/en/support/gpl/

Here you can download GPL sources for tl-841 v8 and v9.

Altough firmware may not be very usefull, the U-boot sources will have to be valid for your processor.

You may be able to access U-boot recovery menu using this version.

(Last edited by carrapato on 5 Nov 2014, 10:17)

Read this, may be helpful https://forum.openwrt.org/viewtopic.php?id=47259
There they say to hit enter on u-Boot to enter the shell.

Awesome :-)

I only left the TX pin attached and, hitting enter repeatedly, plugged the router in. After a few seconds, I reconnected the RX pin and voila! Now I've got the u-boot prompt. Thanks for the help, guys. I'll get started by flashing U-boot to behave a little more friendly-like and then the firmware.

(Last edited by brnt on 20 Dec 2014, 23:35)

Hi brnt! We just bought an R470T+ (v4) as well and would like to flash OpenWRT onto it in order to get IPv6 support mostly. Have you had any success after your last post here? Or anyone else? Any pointers how to proceed from the point where one is in u-boot?