Will TP-Link TL-WR941ND be supported?

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2, 3 ... 24, 25, 26  Next
Author Message
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Tue Oct 28, 2008 19:05    Post subject: Will TP-Link TL-WR941ND be supported? Reply with quote
The product links:

TL-WR941ND (out of China)
http://www.tp-link.com/products/product_des.asp?id=154

TL-WR941N (in China)
http://www.tp-link.com.cn/products/pro_des.asp?id=147

Hardware Specification of TL-WR941N:

CPU: Atheros AR9132 400MHz
Switch: Marvell 88E6060-RCJ1
Memory: HY5DU561622ETP-5 (16Mx16, 32M)
Flash: 25P64V6P (8M)
Radio: AR9001 (?)

Torn down pictures (TL-WR941N) can be seen in this link
http://network.pconline.com.cn/pingce/0803/1252528_5.html

I think TL-WR941ND is the same as TL-WR941N in hardware.

This router is as cheap as RMB 260 (US$ 39) here.
Sponsor
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17487
Location: Hesse/Germany

PostPosted: Tue Oct 28, 2008 21:51    Post subject: Reply with quote
is redboot running?
_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Wed Oct 29, 2008 6:41    Post subject: Reply with quote
Sash wrote:
is redboot running?


I don't know. I will buy one tomorrow and figure out how to add serial/usb/jtag on it.

It seems that ar9130 is bootable now (by openwrt):
https://dev.openwrt.org/changeset/12463
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17487
Location: Hesse/Germany

PostPosted: Wed Oct 29, 2008 10:59    Post subject: Reply with quote
the reference design is running with ddwrt too. but first we need to know which bootloader is running.
_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Thu Oct 30, 2008 18:10    Post subject: Reply with quote
I am using TL-WR914n now. I will test it a while before I void warrant.
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Sun Nov 02, 2008 0:43    Post subject: Reply with quote
Hardware information

CPU: Atheros AR9132-AC1E 400MHz
Switch: Marvell 88E6060-RCJ1
Memory: HY5DU561622FTP-5 (16Mbx16, 32MB)
Flash: SPANSION FL032A1F (4MB?)
Radio: AR9104 (According to 3x3 MIMO reference design)

PCB board rev is 1.0 but flash is changed to 4MB from old version which has 8MB flash.

Serial/JTAG/USB pin can be easily added.



Jtag: top left, J9
Serial: top left, P1
USB: top right, J10 (the case has a hole for USB socket)
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17487
Location: Hesse/Germany

PostPosted: Sun Nov 02, 2008 12:36    Post subject: Reply with quote
looks nice.

add serial and check the bootloader

btw flash is 4mb (32mbit)
http://www.alldatasheet.com/datasheet-pdf/pdf/164520/SPANSION/S25FL032A0LMAI000.html

_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!


Last edited by Sash on Sat Nov 22, 2008 8:17; edited 1 time in total
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Thu Nov 06, 2008 15:31    Post subject: Reply with quote
jtag, serial pins and usb receptacle are added. It took some time to find matching usb receptacle.

1. I am waiting for RS232<->TTL converter
2. USB voltage is 3.3v, not 5v

This link is about another TP-Link products, same 14-pin and 10-pin connector. It's said it is RS232.
http://group.zol.com.cn/1/44_4495.html

This weekend, my friend will bring a portable digital oscilloscope, then I can figure out serial type.
Menkatek
DD-WRT Novice


Joined: 11 Nov 2008
Posts: 44

PostPosted: Tue Nov 11, 2008 17:58    Post subject: Reply with quote
Keep this thread going! I'm in the market for an 802.11n router. Based on the forum here, the Wiki and local availability, it seems the WR941ND will be the only real option for me.

In any case, thanks to the DD-WRT makers and lark for your work. And I hope this thread will be updated. Smile
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Mon Nov 17, 2008 9:17    Post subject: Reply with quote
Menkatek wrote:
Keep this thread going! I'm in the market for an 802.11n router. Based on the forum here, the Wiki and local availability, it seems the WR941ND will be the only real option for me.

In any case, thanks to the DD-WRT makers and lark for your work. And I hope this thread will be updated. Smile


Thanks for you concern :)

I can't make serial work using tools at hand by now. I am waiting for my friend returning from business trip, then we will have another try in his factory (more tools).

Judging from downloads of TP-Link sites, my speculation is WR941N has 2 version, v1 (8M flash) is for comment by the media, and v2 (4M flash) is mass product version. So your chance of buying a 8M flash version is little. Also, USB support is in PCB and even in the case, but taken away in the end.

I am totally confused by that. Maybe they are short of software engineers, and can't get software work.
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Mon Nov 17, 2008 9:47    Post subject: Reply with quote
Serial connector PCB routing

Pin Connection
1 Unknown (may be floating)
2 To CPU
3 To CPU
4 VCC (+3.3v)
5 Gnd

In this thread ( http://www.dd-wrt.com/phpBB2/viewtopic.php?t=32715 ), the Pin 2,3 both disconnected (without resistor and capacitor).

My device has pin 2 connected, pin 3 disconnected.

Sash, it seems that you have reference design at hand, can you give me information about R356, C377?
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Thu Nov 20, 2008 13:05    Post subject: Reply with quote
lark wrote:
Serial connector PCB routing

Pin Connection
1 Unknown (may be floating)
2 To CPU
3 To CPU
4 VCC (+3.3v)
5 Gnd


Now it works.

Pin Connection
2 RX
3 TX
4 VCC (+3.3v)
5 Gnd

If pin 2, 3 are disconnected, you can just short circuit R355 and R356, with C376, C377 open. The R/C filter can be omitted.

u-boot is at 9600-8N1, kernel is at 115200-8N1 (not linux).

============= snip ===============
U-Boot 1.1.4 (May 1 2008 - 19:25:20)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment

In: serial
Out: serial
Err: serial
Net: ag7100_enet_initialize...
Fetching MAC Address from 0x81fef230
eth0: 00:03:7f:e0:09:56
eth0 up
eth0
Autobooting in 1 seconds, press "tp" to stop
## Booting image at bf020000 ...
Uncompressing Kernel Image ...

============= snip ===============

Flash is 8M, this is interesting part: Spansion FL032A1F is 32Mbit (4Mbyte).

BTW: I waste a lot of time because my USB-Serial converter (PL2303) doesn't work with TTL converter under WinXP.
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Sat Nov 22, 2008 3:36    Post subject: Reply with quote
I destroyed my first WR941N's RX, nothing can be input, so I bought another one.

When using 115200-8N1

Quote:

(none) brath_hal: module UNatHoieee80ieieeeiecuath_netdev_stop: The stopping of the runie
TL-WR941N/TL-WR942N mips #39 Fri May 30 15:26:13 CST 2008 (none)
TL-WR941N/TL-WR942N login:
TL-WR941N/TL-WR942N mips #39 Fri May 30 15:26:13 CST 2008 (none)
TL-WR941N/TL-WR942N login: admin
Password:
Login incorrect
TL-WR941N/TL-WR942N login: admin
Password:
Login incorrect
TL-WR941N/TL-WR942N login: admin
Password:
Login incorrect
Jan 1 00:01:11 login[52]: invalid password for `UNKNOWN' on `ttyS0'


TL-WR941N/TL-WR942N mips #39 Fri May 30 15:26:13 CST 2008 (none)
TL-WR941N/TL-WR942N login: ath_netdev_stop: The stopping of the running
br0: port 1(ath0) entering disabled state
ieee80211_ioctl_setparam: CHH Calling ieee80211_open
--AP ar5416InitUserSettings ahp->ah_miscMode 0xc
ar5416Reset Setting CFG 0x10a
Country ie is CN
br0: port 1(ath0) entering learning state
br0: topology change detected, propagating
br0: port 1(ath
TL-WR941N/TL-WR942N mips #39 Fri May 30 15:26:13 CST 2008 (none)
TL-WR941N/TL-WR942N login:


So it is linux based.

But I can't get into u-boot promt and I can't break into the login. (admin:admin and many other combination can't work)
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Sat Nov 22, 2008 5:49    Post subject: Reply with quote
Change settings from web page

Quote:

Now flash open!
Erase from 0X3E0000 to 0X3E751C:.
Program from 0X3E0000 to 0X3E751C:
write successfully
Now flash open!
Erase from 0X3E0000 to 0X3E751C:.
Program from 0X3E0000 to 0X3E751C:
write successfully
umount: /var: Device or resource busy
umount: /tmp: Device or resource busy
The system is going down NOW !!
Sending SIGTERM to all processes.
ieee80211_ioctl_setparam: CHH Calling ieee80211_open
Country ie is CN
Sending SIGKILL to all processes.to
Please stand by while rebooting the system.
Restarting system.
.
iniip_cinsmNow
(none) ath_hal: module liwlatwlieeeatieieeede--ath_netdev_stop: The stopping of the rarieNow flash open!
Erase from 0X3E0000 to 0X3E751C:.
Program from 0X3E0000 to 0X3E751C:
write successfully
umount: /var: Device or resource busy
umount: /tmp: Device or resource busieee80211_ioctl_setparam: CHH Calling ieee80211_open
Country ie is CN
ar5416StopDmaReceive: dma failed to stop in 10ms
AR_CR=0x00000024
AR_DIAG_SW=0x40000020
Sending SIGKILL to all processes.
Please stand by while rebooting the system.
Restarting system.
.
iniip_cinsmNow
(none) brath_hal: module wlatwlieeeatieieeede--ath_netdev_stop: The stopping of the rarie
lark
DD-WRT Novice


Joined: 28 Oct 2008
Posts: 33

PostPosted: Sat Nov 22, 2008 7:29    Post subject: Reply with quote
Using firmware decrypt by Yuna (http://www.dd-wrt.com/phpBB2/viewtopic.php?t=32715), I can now login into it as user "ap71".

There is no telnetd or sshd, and serial always overrun.

Quote:

$ cat /proc/cmdline
console=ttyS0,115200 root=/dev/mtdblock2 bootfstype=squashfs init=/sbin/init mtdparts=ar7100-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M


Update: now root & Admin user (uid=0) 's password is cracked using john.

Quote:

# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00100000 00010000 "kernel"
mtd2: 002c0000 00010000 "rootfs"
mtd3: 00010000 00010000 "config"
mtd4: 00010000 00010000 "art"


I haven't get into u-boot yet.

Sash, will you give me some suggestion to go on?

Update: I get into u-boot by typing "tp". At first I failed to get in because the time is very limited (1 sec), so I think it's a special key :D

Quote:

Autobooting in 1 seconds, press "tp" to stop
ar7100> ?
autoscr - run script from memory
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
erase - erase FLASH memory
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version


I will spend some time poking around :D

Quote:

ar7100> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),5120k(ro
otfs),1024k(uImage)
bootcmd=bootm 0xbf020000
bootdelay=1
baudrate=9600
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.10
serverip=192.168.1.169
stdin=serial
stdout=serial
stderr=serial
ethact=eth0


bootargs doesn't match booted system, so it's ignored.
0xbf020000 is where kernel image resides. 0xbf000000 is flash base address.

Quote:

ar7100> md.b bf000000 40
bf000000: 10 00 00 ff 00 00 00 00 10 00 00 fd 00 00 00 00 ................
bf000010: 10 00 01 84 00 00 00 00 10 00 01 82 00 00 00 00 ................
bf000020: 10 00 01 80 00 00 00 00 10 00 01 7e 00 00 00 00 ...........~....
bf000030: 10 00 01 7c 00 00 00 00 10 00 01 7a 00 00 00 00 ...|.......z....
ar7100> md.b bf020000 40
bf020000: 01 00 00 00 54 50 2d 4c 49 4e 4b 20 54 65 63 68 ....TP-LINK Tech
bf020010: 6e 6f 6c 6f 67 69 65 73 00 00 00 00 76 65 72 2e nologies....ver.
bf020020: 20 31 2e 30 00 00 00 00 00 00 00 00 00 00 00 00 1.0............
bf020030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ar7100> md.b bf120000 40
bf120000: 73 71 73 68 00 00 00 e6 b7 fe e1 e0 06 dc ac 56 sqsh...........V
bf120010: 00 7e 55 3e 00 1f 2f d4 b7 fe f4 44 00 03 00 01 .~U>../....D....
bf120020: d0 04 00 11 e0 02 00 48 68 4a b3 00 00 00 00 00 .......HhJ......
bf120030: 00 1a da 00 02 00 00 00 00 00 14 fe fe 08 00 00 ................
ar7100> md.b bf3e0000 40
bf3e0000: 55 aa 03 03 00 00 1d 47 16 56 37 78 00 21 27 65 U......G.V7x.!'e
bf3e0010: be 14 00 00 00 21 27 65 be 15 00 21 27 65 be 16 .....!'e...!'e..
bf3e0020: 00 21 27 65 be 17 00 21 27 65 be 18 00 21 27 65 .!'e...!'e...!'e
bf3e0030: be 19 00 21 27 65 be 1a 00 21 27 65 be 1b 00 21 ...!'e...!'e...!
ar7100> md.b bf3f0000 40
bf3f0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
bf3f0010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
bf3f0020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
bf3f0030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................


Last edited by lark on Sat Nov 22, 2008 15:15; edited 1 time in total
Goto page 1, 2, 3 ... 24, 25, 26  Next Display posts from previous:    Page 1 of 26
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum