TP-Link TL-WA801ND
Special note for versions v1-4 + v6; v5 is supported
Supported Versions
Only v5 is still supported.
v6 was never supported, hence not in the table below.
Hardware Highlights
Installation
Locked Firmware
Since v3 hardware, TP-Link has started shipping with the new locked TP-link firmware. Investigation into this locking mechanism is still in progress, but the device does support tftp flashing. To use this feature, press and hold the reset button while powering on. The device will use the ip address 192.168.0.86, and attempt to load a new firmware from a tftp server at 192.168.0.66. The v3 is looking for the file: wa801ndv3_tp_recovery.bin. Rename your openwrt-ar71xx-generic-tl-wa801nd-v3-squashfs-factory.bin file to wa801ndv3_tp_recovery.bin, confirmed working as of trunk r49037. However, this does not work with v4. Use the Workaround below instead.
Firmware Workaround
A workaround for the locked firmware has been found, based on Keyboardgnome's solution for the WR710n. The key is that a command can be injected by including it as part of the SSID. Several SSIDs are set which compile a script in the router's ram, and then a final command executes that script. After about 60 seconds, the web interface will be available again, and should accept an Openwrt image.
To use the workaround, set the device's SSID to each of the following lines, making sure to include the backticks. Set the ssid and click save between each line.
`echo "httpd -k"> /tmp/s` `echo "sleep 10">> /tmp/s` `echo "httpd -r&">> /tmp/s` `echo "sleep 10">> /tmp/s` `echo "httpd -k">> /tmp/s` `echo "sleep 10">> /tmp/s` `echo "httpd -f">> /tmp/s` `sh /tmp/s`
After the reboot sequence, the router may have fallen back to its default IP address : 192.168.0.254, with the default credentials (admin:admin)
Rename the downloaded firmware to firmware.bin
Log in to the web interface and go the the firmware upload page
Select the correct firmware file, and you're done : the system now accepts the openwrt image 
Unsorted
...Not Tested...
WA801ND v3 Hardware overview
Some weeks ago i’ve succesfully ported OpenWrt to the TP-Link TL WA801ND v3, that access point features 2×2 MIMO, detachable antennas, 32 MBytes of ram and 4 Mbytes of flash. It is based, like most new tp-link devices on a Qualcomm Atheros system on chip (QCA9533-BL3A) which integrates the MIPS core, ethernet switch and wifi hardware.
Accessing the WA801ND v3 serial port
Out of the box even if the serial header is present and has the typical TP-Link pinout, it won’t work, because some resistors are missing from the board, namely R105 and R107. TL-WA801ND v3 solder bridge required Solder bridge on R105 required to receive data from the serial port TL-WA801ND v3 solder bridge required Solder bridge on R107 to allow sending to serial port
The serial port settings are, as usual 115200 baud and to enter uboot prompt you have to quickly type “tpl” when it says that it is waiting 1 second.
Installing from the web interface
OpenWrt trunk builds can be installed using the original tp-link firmware from the web interface. In order to do that download openwrt trunk build for the device, under the directory ar71xx there should be in trunk a file named openwrt-ar71xx-generic-tl-wa801nd-v3-squashfs-factory.bin , download it and rename it to a.bin ( tested working, but maybe anything works ), and use it to upgrade the access point from the web interface. Once you uploaded the file, wait for the device to reboot, when it reboots currently , no leds will be lit. That’s because by default no led is assigned to anything, maybe i should do some patch to fix that in the future. To configure it connect with ssh to 192.168.1.1 ( DHCP should be enabled by default too ), or if you have built an image with luci, just navigate to http://192.168.1.1
source: http://linuxehacking.ovh/2016/02/13/installing-openwrt-on-tp-link-tl-wa801nd-v3/
Installing on v5
Pre-built images are available starting with release 19.07.
Don't try to update the firmware from the web interface, it'll brick your device. Anyway, to install it (or unbrick):
- rename the bin/.../xxx_recovery.bin to tp_recovery.bin
- put it in your tftp folder
- the router expects TFTP at 192.168.0.66
- power device on with reset button pressed until the rightmost led is lit (the lock) to enter TFTP recovery mode
Once it's installed, do a normal sysupgrade with the squashfs image you built, also found in bin dir of the sources
Bootlogs
OEM bootlog
OEM bootlog from tl-wa801nd-v1
U-Boot 1.1.4 (Dec 16 2009 - 17:52:07) AP93 (ar7240) U-boot DRAM: sri #### TAP VALUE 1 = 7, 2 = 8 32 MB id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address : cfg1 0xf cfg2 0x7014 eth0: 00:03:7f:09:0b:ad eth0 up No valid address in Flash. Using fixed address : cfg1 0xf cfg2 0x7214 eth1: 00:03:7f:09:0b:ad ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR7240(Python)... Linux version 2.6.15--LSDK-7.3.0.300 gcc version 3.4.4 #1 Mon Feb 14 14:32:06 CST 2011 flash_size passed from bootloader = 4 CPU revision is: 00019374 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Built 1 zonelists Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init mtdparts=ar7100-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(coM Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled PID hash table entries: 256 (order: 8, 4096 bytes) Using 200.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 30548k/32768k available (1368k kernel code, 2204k reserved, 291k data, 128k init, 0k highmem) Mount-cache hash table entries: 512 Checking for 'wait' instruction... available. NET: Registered protocol family 16 Returning IRQ 48 AR7240 GPIOC major 0 squashfs: version 3.3 (2007/10/31) Phillip Lougher squashfs: LZMA suppport for slax.org by jro Initializing Cryptographic API io scheduler noop registered io scheduler deadline registered Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize PPP generic driver version 2.4.2 PPPoX init, max protocols:3 NET: Registered protocol family 24 pppox protocol 0 register. max:3 cmdlinepart partition parsing not available Searching for RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD partitions on "ar7240-nor0": 0x00000000-0x00020000 : "boot" 0x00020000-0x00120000 : "kernel" 0x00120000-0x003e0000 : "rootfs" 0x003e0000-0x003f0000 : "config" 0x003f0000-0x00400000 : "art" ->Oops: flash id 0x10215 . NET: Registered protocol family 2 IP route cache hash table entries: 512 (order: -1, 2048 bytes) TCP established hash table entries: 2048 (order: 1, 8192 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered TCP bic registered NET: Registered protocol family 1 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 128k freed init started: BusyBox v1.01 (2010.04.08-11:57+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 ip_conntrack version 2.4 (256 buckets, 5120 max) - 244 bytes per conntrack insmod: cannot open module `/lib/modules/2.6.15/kernel/ip_nat.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_MASQUERADE.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_conntrack.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_iprange.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_mac.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_string.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/iptable_nat.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_time.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_TRIGGER.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ip_conntrack_pptp.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_TCPMSS.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_multiurl.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ip_conntrack_h323.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ipt_MARK.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/sch_htb.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/sch_prio.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/sch_sfq.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/cls_basic.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/cls_fw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/ts_kmp.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/flashid.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.15/kernel/harmony.ko': No such file or directory Now flash open! Now flash open! sys_mode=3 mac:8106c000 ag7240_macs[0]:00000000 ag7240_macs[1]:8106c000 2 sys_mode=3 mac:80310000 ag7240_macs[0]:80310000 ag7240_macs[1]:8106c000 1 sys_mode 3 PHY4 auto-negotiation enable Attention: PHY4 Class A setting in debug 5 register which is not described in DS phy_setup ethUnit:0 phyUnit:4 Port 4, Neg Success (none) mips #1 Mon Feb 14 14:32:06 CST 2011 (none) (none) login: ATHRS26: resetting s26 ATHRS26: s26 reset done sys_mode 3 PHY0 auto-negotiation enable Attention: PHY 0 Class A setting in debug 5 register which is not described in DS sys_mode 3 PHY1 auto-negotiation enable Attention: PHY 1 Class A setting in debug 5 register which is not described in DS sys_mode 3 PHY2 auto-negotiation enable Attention: PHY 2 Class A setting in debug 5 register which is not described in DS sys_mode 3 PHY3 auto-negotiation enable Attention: PHY 3 Class A setting in debug 5 register which is not described in DS phy_setup ethUnit:1 phyUnit:0 phy_setup ethUnit:1 phyUnit:1 phy_setup ethUnit:1 phyUnit:2 phy_setup ethUnit:1 phyUnit:3 Port 0, Neg Success Port 1, Neg Success Port 2, Neg Success Port 3, Neg Success device eth0 entered promiscuous mode Now flash open! phy_setup ethUnit:1 phyUnit:0 phy_setup ethUnit:1 phyUnit:1 phy_setup ethUnit:1 phyUnit:2 phy_setup ethUnit:1 phyUnit:3 Port 0, Neg Success Port 1, Neg Success Port 2, Neg Success Port 3, Neg Success ath_hal: module license 'Proprietary' taints kernel. ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) wlan: 0.8.4.2 (Atheros/multi-bss) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ++++ phy_up is 1, fdx is 1, speed is 1 AG7240: enet unit:1 phy:0 is up...Mii 100Mbps full duplex AG7240: enet unit 1 phy 0 mode 0x4c04 ath_pci: 0.9.4.5 (Atheros/multi-bss) wifi0: Atheros 9280: mem=0x10000000, irq=48 hw_base=0xb0000000 br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state wlan_me: Version 0.1 Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved wlan: mac acl policy registered TP_Flags:6**** The selected channel is 1 Country ie is US Country ie is US maxrate = 300000 Country ie is US br0: port 1(eth0) entering disabled state phy_setup ethUnit:1 phyUnit:0 phy_setup ethUnit:1 phyUnit:1 phy_setup ethUnit:1 phyUnit:2 phy_setup ethUnit:1 phyUnit:3 Port 0, Neg Success Port 1, Neg Success Port 2, Neg Success Port 3, Neg Success device ath0 entered promiscuous mode br0: port 2(ath0) entering learning state br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state br0: port 2(ath0) entering disabled state Country ie is US br0: port 2(ath0) entering learning state br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state phy_up is 1, fdx is 1, speed is 1 AG7240: enet unit:1 phy:0 is up...Mii 100Mbps full duplex AG7240: enet unit 1 phy 0 mode 0x4c04 br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state br0: port 2(ath0) entering disabled state Country ie is US br0: port 2(ath0) entering learning state br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state OPERMODE:0**** Inteference detected rx_clear=99, rx_frame=0, tx_frame=0 ath_bstuck_tasklet... Calling ath_internal reset