Welcome to TP-LINK Tech Support Forum
+ Reply to Thread
Results 1 to 2 of 2
  1. #1

    How to recovery firmware via console port when your device has down? For EAP120/220/320 only

    Dear all forum members,

    Recently we have received feedback that some users got their devices down during firmware upgrading, thus here we got some methods for you all to recovery it.
    While unfortunately, this method is only available for EAP120/220/320, since only the three models are equipped with console port, kindly noted.
    Sorry for this inconvenient and please kindly share your understanding if this method is not suitable to you.

    We have already upload the image file and guide document, then you can download them freely in the following link according to your actual model:




    If you are faced with any difficulties during these operations, feel free to follow up in this post.
    Finally, will you all success !

    TP-Link Technical Support Team
    Last edited by Rain_TP-Link; 09-13-2017 at 10:45.

  2. #2
    Members R1D2 is on a distinguished road
    Join Date
    Dec 2015
    Great, thank you!

    To recover the firmware for an EAP110 (and probably the EAP220/320, too), you could use pretty much the same procedure, but have to enable the console port first. Here it is how it works on EAP110 (note that it will void your warranty I guess):

    1. Remove the 4 rubber pads and the screws on the bottom.

    Name:  IMG_7001.JPG
Views: 0
Size:  35.6 KB

    2. Carefully lift of the top from the bottom case. Take care to not break the four strap joints - one on each side - so better use a tool for unmounting (if you don't have such a tool at hand, use a guitar pick or similar). Start with the front side (where the LED sits) and proceed to back side last. See second picture below for the position of the strap joints:

    Name:  IMG_7005.JPG
Views: 0
Size:  37.7 KB Name:  IMG_7008.JPG
Views: 0
Size:  32.5 KB

    3. On the PCB board the J3 header is the console. Leftmost pin is Vcc (3,3V), next one is GND, second-right is RxD, rightmost is TxD. Either connect your 3.3 volts serial-to-USB adapter to the holes directly or solder in a pin header.

    Name:  IMG_7011.JPG
Views: 0
Size:  160.8 KB

    4. The TxD/RxD pins are not functional (yet). On the back side of the PCB locate R105 near J3. Although labeled R for resistor, there is actually none. Kind of a "hardware password" I guess. Short-circuit both solder joints of R105 (first picture below). This will enable the TxD (transmitting) line of the serial console. Use a SMD soldering tip to short-circuit the solder joins if you have one (I could even get one from Weller for my 35-year old Weller soldering station for a few bucks). Or, if you are in a hurry, use a short strip of an electric tape such as from 3M, which is conductive on both sides (second picture).

    Name:  IMG_7017.JPG
Views: 0
Size:  136.1 KB Name:  IMG_7015.JPG
Views: 0
Size:  96.4 KB

    5. Locate R101 on the front side of the PCB (red circle on picture below). Same game, short-circuit the solder joints. This will enable the RxD (receiving) line of the serial console. The orange circle shows a pin header soldered into J3.

    Name:  IMG_7018.JPG
Views: 0
Size:  177.9 KB

    6. Serial console is enabled now. Connect a serial-to-USB adapter, make sure it's 3.3 volt levels, not standard RS232C levels!

    Name:  IMG_7022.JPG
Views: 0
Size:  103.2 KB

    7. Connect to the serial adapter using your favorite terminal emulation. UNIX/Linux guys most often use cu(1), you will find it on your UNIX-based MacBook, too. Speed is 115200, 8bits, no parity. Then boot the EAP110:

    $ cu -s 115200 -l /dev/tty.usbserial-B10c724g
    U-Boot 1.1.4--LSDK-10.2-00082-4 (Dec  3 2014 - 17:30:11)
    board953x - Honey Bee 2.0DRAM:  
    Honey Bee 2.0
    ath_ddr_initial_config(195): (16bit) ddr2 init
    tap = 0x00000003
    Tap (low, high) = (0x6, 0x37)
    Tap values = (0x1e, 0x1e, 0x1e, 0x1e)
    64 MB
    Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
    flash size 8MB, sector count = 128
    Hello U-Boot, nice to see you.

    Abort the boot by pressing the any key (the big large one in front row of your keyboard ).

    eth1 up
    eth0, eth1
    Setting 0x181162c0 to 0x50a1a100
    Hit any key to stop autoboot:  0 <anykey>
    Print U-Boot's environment to see the command aliases for loading and flashing the firmware:

    ath> printenv
    bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),2240k(rootfs),1408k(uImage),64k(mib0),64k(ART)
    bootcmd=bootelf 0x9f040000
    lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
    lf=tftp 0x80060000 ${dir}board953x${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
    lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
    Environment size: 689/65532 bytes
    Command lu is for TFTP loading and flashing the bootloader, command lf most certainly for loading/flashing the rootfs and command lk for loading/flashing the kernel.

    Prepare those files on an TFTP server, define its address in environment variable serverip and a free IP in same subnet for the EAP's ipaddr. To get the required firmware files, either connect to a spare EAP110 using ssh and pull them out of the mtd partitions or extract them from a firmware file. Or maybe, TP-Link could kindly provide them, too.

    Partition layout is:

    7 cmdlinepart partitions found on MTD device ath-nor0
    Creating 7 MTD partitions on "ath-nor0":
    0x000000000000-0x000000020000 : "u-boot"
    0x000000020000-0x000000030000 : "pation-table"
    0x000000030000-0x000000040000 : "product-info"
    0x000000040000-0x0000001c0000 : "kernel"
    0x0000001c0000-0x0000007c0000 : "rootfs"
    0x0000007c0000-0x0000007f0000 : "config"
    0x0000007f0000-0x000000800000 : "ART"

    Happy de-bricking!
    Last edited by R1D2; 09-13-2017 at 19:42.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Copyright 1996-2017 TP-LINK Technologies Co., Ltd. All rights reserved.