TP-Link TL-WA850RE, TL-WA854RE, TL-WA860RE & TL-WA750RE

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

The TL-WA860RE, TL-WA854RE, TL-WA850RE and TL750RE were great because of their miniature size and wall-mounted design

  • TL-WA750RE is a 10/100 Ethernet b/g/n 150M (one on-board printed antenna)
  • TL-WA850RE is a 10/100 Ethernet b/g/n 300M (two on-board printed antennas)
  • TL-WA860RE is a 10/100 Ethernet b/g/n 300M (two external non-removable antennas and AC passthrough)

Supported Versions

Brand↓ ModelVersionCurrent ReleaseOEM InfoForum TopicTechnical Data
TP-LinkTL-WA750REv118.06.9https://www.tp-link.com/us/home-networking/range-extender/tl-wa750re/https://forum.openwrt.org/t/report-devices-here-with-18-06-0-provided-image-too-big-to-save-overlay/18161/72?u=tmomas, https://forum.openwrt.org/viewtopic.php?id=46859View/Edit data
TP-LinkTL-WA850REv118.06.9http://www.tp-link.com/en/download/TL-WA850RE_V1.htmlhttps://forum.openwrt.org/viewtopic.php?id=46859View/Edit data
TP-LinkTL-WA850REv218.06.9https://www.tp-link.com/en/products/details/TL-WA850RE.htmlhttps://forum.openwrt.org/t/report-devices-here-with-18-06-0-provided-image-too-big-to-save-overlay/18161/72?u=tmomasView/Edit data
TP-LinkTL-WA860REv1 (EU)18.06.9http://www.tp-link.com/en/products/details/cat-10_TL-WA860RE.htmlView/Edit data
Model Version Launch Date OpenWrt Version Supported Model Specific Notes
TL-WA750RE v1 2013-04 BB (r38719) AP123
Model Version Launch Date OpenWrt Version Supported Model Specific Notes
TL-WA850RE v1 2012-12 BB (r38719) AP123
TL-WA850RE v1.2 (UK) 2013-06 ? (tested with 15.05.1) ?
TL-WA850RE (EU v1.2) ???? tested 18.06.5 Works with original Openwrt tl-wa850re-v1 firmware.
TL-WA850RE (EU v1.25) ???? tested 18.06.8 Works with original Openwrt tl-wa850re-v1 firmware.
TL-WA850RE (EU v2) 2015 N/A Allegedly same hardware as TL-WR841ND v10 (Source)
TL-WA850RE v5 ? N/A 4/32MB, will not get OpenWrt support due to insufficient flash + RAM
OpenWrt forum topic
TL-WA850RE v6 ? N/A 4/32MB, will not get OpenWrt support due to insufficient flash + RAM
Model Version Launch Date OpenWrt Version Supported Model Specific Notes
TL-WA854RE v1 ? custom build 21.02 4/32MB, build like howto, same HW as TL_WA850 v1 but no LAN
Model Version Launch Date OpenWrt Version Supported Model Specific Notes
TL-WA860RE (EU v1) 2014-12 BB (r41598) AP123
TL-WA860RE (EU v1.1) ???? tested 18.06.5 Works with original Openwrt tl-wa860re-v1 firmware.
TL-WA860RE (EU v2) 2016-07 N/A AP143
TL-WA860RE (EU v4) 2017-05 N/A -
TL-WA860RE (EU v5) 2017-06 N/A -

Hardware Highlights

↓ ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
TL-WA750REv1Atheros AR9341500432Atheros AR9341b/g/n-1--
TL-WA850REv1Atheros AR9341535432Atheros AR9341b/g/n-1--
TL-WA850REv2Qualcomm Atheros QCA9533550432Atheros AR9341b/g/n-1--
TL-WA860REv1 (EU)Atheros AR9341535432Atheros AR9341b/g/n-1--

Installation

↓ ModelVersionCurrent ReleaseFirmware OpenWrt InstallFirmware OpenWrt UpgradeFirmware OEM Stock
TL-WA750REv118.06.9https://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa750re-v1-squashfs-factory.binhttps://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa750re-v1-squashfs-sysupgrade.binhttps://www.tp-link.com/us/support/download/tl-wa750re/#Firmware
TL-WA850REv118.06.9https://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa850re-v1-squashfs-factory.binhttps://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa850re-v1-squashfs-sysupgrade.binhttp://www.tp-link.com/en/download/TL-WA850RE_V1.html
TL-WA850REv218.06.9https://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa850re-v2-squashfs-factory.binhttps://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa850re-v2-squashfs-sysupgrade.binhttps://www.tp-link.com/en/download/TL-WA850RE_V2.html
TL-WA860REv1 (EU)18.06.9https://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa860re-v1-squashfs-factory.binhttps://downloads.openwrt.org/releases/18.06.9/targets/ar71xx/tiny/openwrt-18.06.9-ar71xx-tiny-tl-wa860re-v1-squashfs-sysupgrade.binhttp://www.tp-link.com/en/download/TL-WA860RE.html

OpenWrt firmware images of previous releases can be found under the ar71xx/generic tree:

→ Install OpenWrt (generic explanation)

Flashing OpwnWrt firmware is relatively straightforward. All you have to do is to access the GUI page (192.68.0.254) of the device via Ethernet or Wifi, navigate to 'System Tools' > 'Firmware Upgrade', upload your OpenWrt installation image and click 'Upgrade'.

Back to stock firmware

→ generic.uninstall

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

With the TL-WA850/750RE router, there is a catch: The stock firmware is obtained from the OEM: TL-WA750RE TL-WA850RE

  • In case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware
  • In case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it:

These days it is not necessary that the word boot is included in the name. If the original firmware doesn't revert to stock. Strip it and flash it again.

Flashing the wrong firmware will brick the device be prepared for it and don't commit unless you are.

An example of an image file with the word “boot” in it is wa850rev1_en_3_14_8_up_boot(140310).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware: 

dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade: 

sysupgrade /tmp/tplink.bin

Or you use the mtd method: 

mtd -r write /tmp/tplink.bin firmware

OEM TP-Link firmware for the TL-WA750/TL-WA850 with the boot part removed to revert to the original OEM firmware:

OEM TP-Link firmware for TL-WA850RE V2 original and stripped firmware:

Debricking

→ generic.debrick Some success with WA850-REv2 was made, follow this forum thread: https://forum.openwrt.org/t/tp-link-wa850re-v2-0-bricked/35515/37

Click to display ⇲

Click to hide ⇱

To quote tp-linkuser:

I have been able to restore it :smiley:, but with firmware openwrt 18.06.5 sysupgrade. I think that with stock firmware is also restorable.
NOTE: I can't save the config settings with openwrt, erase all turning off the device.


You have to bridge 2 points (try it first with Tx and test it, after Rx).
Note: you'll need usb to rs232 ttl converter module, pins working at 3.3V (TTL level voltage).

Setting ip pc to 192.168.1.10, run tftp server (tftpd32 4) on ethernet interface, download lastest firmware openwrt 18.06.5 sysupgrade version, rename to firm.bin (for easy use).
Note: data (firmware) is sent on ethernet interface, commands are sent on serial interface UART.
Note: openwrt 18.06.5 sysupgrade 2
md5: 9464728d3dbfe7a232766811e19db5d4
sha1: 2f7732e64088de06f19ddbcfc5ac2def6d4d12c8
sha256: 8b80f93c2c58ed01b487c55241d233ac4f57209a1996ccb67a386b2aa08d65e4

Setting baud rate to 115200 (PuTTY console), no flow control.
Note: I have stopped loop with typing tpl.
In my case setting to 128000 can see characters but not stop loop.I have stopped loop, setting baud rate to 115200 and only connecting Rx on device (repeater). Because if connect Tx too, i can see rare >characters, and cant use ctrl-v, which interfere with ctrl-v.
Conclusion I did it without seeing. :unamused: :pensive:

During “Autobooting in 1 seconds” type tpl.
Note: open notepad, typing tpl, select it all, copy for use it into console (PuTTY) with click right or ctrl-v.

set where to find for file firm.bin
copy firm.bin from tftp to ram memory (0x80060000 address).
erase 0x380004 (3670020 Bytes) from flash memory (starting at 0x9f020000).
copy firm.bin stored in ram to flash memory (0x380004 Bytes).
boot from flash memory (0x9f020000 address).

setenv serverip 192.168.1.10

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x380004
cp.b 0x80060000 0x9f020000 0x380004
bootm 0x9f020000

Note: According 6 to printenv (TL-WA850re v2 - Too big uncompressed stream LZMA ERROR 1 6) or typing printenv for info.

Stock Stripped Firmware
Note: I think that with stock firmware is also restorable. :thinking:

tftpboot 0x80060000 firm.bin
erase 0x9f020000 +0x36f923
cp.b 0x80060000 0x9f020000 0x36f923
bootm 0x9f020000

Note: wa850re v2 stripped firmware stock 7,file size 3602723 bytes (0x36f923 in hexadecimal).
md5: dd3d2bbbc5a1706cfedb17142efd2050
sha1: 040def0d4cbb9a8522626a9db1d3a536d3d63b27

(https://openwrt.org/toh/tp-link/tl-wa850re 7)


Hardware

Info

Model TL-WA750RE TL-WA850RE TL-WA860RE
Version 1 1 1
Instruction set: MIPS32
Vendor: Qualcomm Atheros
bootloader: U-Boot 1.1.4
System-On-Chip: Atheros AR9341 rev 3 (MIPS 74Kc V4.12)
CPU/Frq 74Kc V4.12 500 Mhz
Target name
Flash-Chip: Spansion FL032PIF
Flash size: 4 MiB
RAM: 32 MiB
Wireless: Atheros AR9341 2.4ghz 802.11bgn
Wireless Power: Maximal power output is 20 dBm (100 mW)
802.11n: 1 x 1 : 1 2 x 2 : 2 2 x 2 : 2
Power: 100-240V AC 0.3A
Serial: Yes
JTAG: No

Serial

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Perspective before soldering

Serial port + TX/RX breaks

Serial connection parameters
for TL-WA860RE, TL-WA850RE and TL750RE 		115200, 8N1, No flow control

Wireless

  • TL-WA750RE AR9341 hybrid chip, single-band, 1×1:1 Mimo configuration
  • TL-WA850RE AR9341 hybrid chip, single-band, 2×2:2 Mimo configuration

Opening the case

DANGER: HIGH VOLTAGE inside!
Opening this device exposes
parts under high voltage (110/230 VAC)!

  • Risk of deadly electrical shock
  • Risk of irreversable damage to other components attached, e.g. your PC connected via serial

Make sure to keep your fingers, conductive tools and serial cables away from the high voltage at all times!

Capacitors can still retain dangerous voltages
after disconnection from mains!

Continue at your own risk!

Note: The case doesn't have any screws, but instead is ultrasonic welded together.

Flash Layout

Please read the article flash.layout for a better understanding. It contains a couple of explanations. Then let's have a view at flash layout of this particular device:

TP-Link WA850RE / WA860RE / WA750RE Flash Layout stock firmware
Layer0 spi0.0: 4096KiB
Layer1 mtd0 mtd1 mtd2 mtd3 mtd4
Size in KiB 128KiB 1024KiB 2816 KiB 64KiB 64KiB
Name u-boot kernel rootfs config art
mountpoint none none / none none
filesystem none none SquashFS none none

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.

Tags

How to add tags

, , , , , , , , , ,
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2022/12/19 07:20
  • by alexceltare2