Adding Device Support TP-Link WR941HP

For Developers
1

Hi, I have a WR941HP and I am in the beginning of collecting information on how to add support to this device.

WR941HP its the same device, with the same chipset, as the WR941ND v6. The main difference is the RAM and Flash size. (8MB/64MB instead of 4MB/32MB).

In theory it should not be difficult to add support, because, the legwork has already been done with the WR941ND v6.

The problem would be how to preserve the ART partition (on the wiki page there are some warnings about erasing the ART partition on WR941ND v6).

Any comments and hints are welcome!

Thanks!

2 Likes
2

Work with ath79, as ar71xx is deprecated. (I find DTS a lot easier to deal with than the older "mach" format as well.)

Several links I found useful on DTS usage at the renamed https://openwrt.org/docs/guide-developer/defining-firmware-partitions

Knowing where the ART partition is relative to other available space would be needed to provide guidance with that aspect. If you can avoid moving it, that is the best.

3

Pretty much the first thing to do when dealing with a new device, is backing up as much as you can - in particular bootloader, bootloader environment and ART. Once you have backed up ART, the risk of losing it is close to non-existent, as you can just restore it.

3 Likes
4

Hi, I had collected some important information of my spare WR941HP v2 via UART serial console. Hope these will help anyone who want to port Openwrt to this device, since I have little knowledge about this (still trying to get my initramfs image to boot ...)

To open the case, remove 4 Philips screws (2 naked, 2 hidden behind the bottom rubber feets), then pry from the back side, near the ethernet ports. This should be the easiest side to start. Then continue to pry it clockwise. (Thanks to this guide)

IMG_20200206_101019
IMG_20200206_1010191231×789 437 KB

Front side: https://i.imgur.com/xeyDgN3.jpg, the CPU label says TP9343-AL3A

Serial port

image
image690×649 262 KB

OEM Boot log:


U-Boot 1.1.4-gd1efe418-dirty (Dec 22 2017 - 16:59:33)

ap151 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 281k for U-Boot at: 83fb8000
Reserving 192k for malloc() at: 83f88000
Reserving 44 Bytes for Board Info at: 83f87fd4
Reserving 36 Bytes for Global Data at: 83f87fb0
Reserving 128k for boot params() at: 83f67fb0
Stack Pointer at: 83f67f98
Now running in RAM - U-Boot at: 83fb8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
Autobooting in 1 seconds
## Booting image at 9f6d0000 ...
   Verifying Checksum at 0x9f6d0040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 3.3.8 (jji315@ubuntu) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Fri Dec 22 17:12:43 CST 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA956X rev 0
[    0.000000] Clocks: CPU:750.000MHz, DDR:400.000MHz, AHB:250.000MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=WR941HP console=ttyS0,115200 mtdparts=spi0.0:64k(u-boot)ro,6912k(rootfs),1088k(kernel),64k(mib0),64k(art),8000k@0x10000(firmware) rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61192k/65536k available (2367k kernel code, 4344k reserved, 589k data, 184k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:83
[    0.000000] Calibrating delay loop... 373.55 BogoMIPS (lpj=1867776)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] Performance counters: mips/74K PMU enabled, 4 32-bit counters available to each CPU, irq 13
[    0.080000] NET: Registered protocol family 16
[    0.080000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
[  0.090000] MIPS: machine is TP-LINK TL WR941HP
[    0.090000] ar724x-pci ar724x-pci.0: PCIe link is down
[    0.100000] registering PCI controller with io_map_base unset
[    0.100000] ar71xx: invalid MDIO id 1
[    0.510000] bio: create slab <bio-0> at 0
[    0.520000] PCI host bridge to bus 0000:00
[    0.520000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.530000] pci_bus 0000:00: root bus resource [io  0x0001]
[    0.530000] Switching to clocksource MIPS
[    0.540000] NET: Registered protocol family 2
[    0.540000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.550000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.560000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.560000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.570000] TCP reno registered
[    0.570000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.580000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.600000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.600000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.620000] msgmni has been set to 119
[    0.620000] io scheduler noop registered
[    0.620000] io scheduler deadline registered (default)
[    0.630000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.650000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.660000] console [ttyS0] enabled, bootconsole disabled
[    0.660000] console [ttyS0] enabled, bootconsole disabled
[    0.680000] m25p80 spi0.0: found gd25q64, expected m25p80
[    0.680000] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[    0.690000] 6 cmdlinepart partitions found on MTD device spi0.0
[    0.690000] Creating 6 MTD partitions on "spi0.0":
[    0.700000] 0x000000000000-0x000000010000 : "u-boot"
[    0.700000] 0x000000010000-0x0000006d0000 : "rootfs"
[    0.710000] mtd: partition "rootfs" set to be root filesystem
[    0.720000] mtd: partition "rootfs_data" created automatically, ofs=6A0000, len=30000
[    0.720000] 0x0000006a0000-0x0000006d0000 : "rootfs_data"
[    0.730000] 0x0000006d0000-0x0000007e0000 : "kernel"
[    0.740000] 0x0000007e0000-0x0000007f0000 : "mib0"
[    0.740000] 0x0000007f0000-0x000000800000 : "art"
[    0.750000] 0x000000010000-0x0000007e0000 : "firmware"
[    0.760000] flash_chrdev : flash_chrdev_init
[    0.790000] ag71xx_mdio: probed
[    0.920000] ag71xx_mdio: probed
[    0.920000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.480000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:00 [uid=004dd042, driver=Generic PHY]
[    1.490000] eth1: Atheros AG71xx at 0xba000000, irq 5
[    2.050000] eth1: Found an AR934X built-in switch
[    3.080000] GRE over IPv4 demultiplexor driver
[    3.080000] TCP cubic registered
[    3.090000] Bridge firewalling registered
[    3.090000] Ebtables v2.0 registered
[    3.090000] 8021q: 802.1Q VLAN Support v1.8
[    3.100000] ### of_selftest(): No testcase data in device tree; not running tests
[    3.110000] VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
[    3.120000] Freeing unused kernel memory: 184k freed
- preinit -
- regular preinit -
jffs2 not ready yet; using ramdisk
- init -

Please press Enter to activate this console. [    7.010000] NET: Registered protocol family 17
[    7.080000] NET: Registered protocol family 1
[    7.230000] liblog: module license 'unspecified' taints kernel.
[    7.240000] Disabling lock debugging due to kernel taint
[    7.350000] ssdk_plat_init start
[    7.350000] chip_version:0x0
[    7.360000] chip_version:0x2
[    7.360000] Register QCA PHY driver
[    7.360000] qca-ssdk module init succeeded!
[    7.550000] NET: Registered protocol family 10
[    7.850000] PPP generic driver version 2.4.2
[    7.930000] tun: Universal TUN/TAP device driver, 1.6
[    7.940000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    7.980000] PPP MPPE Compression module registered
[    8.110000] L2TP core driver, V2.0
[    8.130000] L2TP netlink interface
[    8.190000] IPv6 over IPv4 tunneling driver
[    8.210000] GRE over IPv4 tunneling driver
[    8.230000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.390000] NET: Registered protocol family 24
[    8.410000] nf_conntrack version 0.5.0 (959 buckets, 3836 max)
[    8.510000] PPPoL2TP kernel driver, V2.0
[    8.530000] PPTP driver version 0.8.5
[    9.140000] nf_conntrack_rtsp v0.7 loading
[    9.150000] nf_nat_rtsp v0.7 loading
[    9.180000] Netfilter messages via NETLINK v0.30.
[    9.420000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.680000] ctnetlink v0.93: registering with nfnetlink.
-------------------------------------------------------------------------------------
reloadconfig() begin
reloadconfig() end
mergeconfigbycountry() begin
no country in productinfo
mergeconfigbycountry() do nothing end
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
reloadprofile() begin
reloadprofile() end
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
bad decrypt
2005103688:error:06065064:lib(6):func(101):reason(100):NA:0:
1998115912:error:29065064:lib(41):func(101):reason(100):NA:0:zlib error:data error
-------------------------------------------------------------------------------------
[   14.980000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   16.070000] ADDRCONF(NETDEV_UP): eth1: link is not ready
operatin_mode : disable_list = /etc/disable_list_router
operatin_mode :/etc/disable_list_router doesn't exist!
[   16.700000] eth1: link up (1000Mbps/Full duplex)
[   16.700000] create event, name=eth1, ifup=1
[   16.760000] ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
-->network:debug current work mode is router
[   17.280000] ADDRCONF(NETDEV_UP): eth0: link is not ready
operatin_module : disable_module = /etc/disable_module_router
operatin_module :/etc/disable_module_router doesn't exist!
[   26.990000] device eth1 entered promiscuous mode
[   27.020000] br-lan: port 1(eth1) entered forwarding state
[   27.020000] br-lan: port 1(eth1) entered forwarding state
[   29.020000] br-lan: port 1(eth1) entered forwarding state
GMT+08:00
[   36.590000] Lan Domain: tplinklogin.net
[   36.600000] Lan Domain: www.tplinklogin.net
[   39.240000] br-lan: port 1(eth1) entered disabled state
[   39.350000] eth1: link down
[   39.350000] create event, name=eth1, ifup=0
[   40.850000] eth1: link up (1000Mbps/Full duplex)
[   40.850000] create event, name=eth1, ifup=1
[   40.880000] br-lan: port 1(eth1) entered forwarding state
[   40.880000] br-lan: port 1(eth1) entered forwarding state
[   40.890000] ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   42.880000] br-lan: port 1(eth1) entered forwarding state
[diehard debug 00:00:18]: Diehard monitor check at router every 15 seconds
General shell run!
[diehard debug 00:00:19]: hostapd number error!!!
[   60.920000] ****Address of trace_timer :820425c0
[   61.100000] ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
[   61.180000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[   61.200000] ath_tx99: Version 2.0
[   61.200000] Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
[   61.350000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[   62.890000] __ath_attach: Set global_scn[0]
[   62.900000] Enterprise mode: 0x03bda000
[   62.900000] Restoring Cal data from DRAM
[   62.910000] Green-AP : Green-AP : Attached
[   62.910000]
[   62.920000] ath_get_caps[6197] rx chainmask mismatch actual 7 sc_chainmak 0
[   62.930000] ath_get_caps[6172] tx chainmask mismatch actual 7 sc_chainmak 0
[   62.950000] wifi0: Atheros 956X: mem=0xb8100000, irq=47
[   62.950000] ath_pci: 10.2.3.31.5 (Atheros/multi-bss)
restart autoNeg!
wifi_radio : dev = wifi0
[   65.570000] ath_set_country : isoName = US
[   65.570000] ath_set_country : ath_countrycode = 0x0
[   65.850000] VAP device ath0 created osifp: (83957b80) os_if: (8203c000)
[   65.910000] Set freq vap stop send + 8203c000
[   65.920000] Set freq vap stop send -8203c000
[   66.050000] Set wait done --8203c000
[   66.100000] WARNING: Fragmentation with HT mode NOT ALLOWED!!
[   66.130000] Set freq vap stop send + 8203c000
[   66.140000] Set freq vap stop send -8203c000
[   66.270000] Set wait done --8203c000
[   66.370000] Setting Max Stations:32
[   66.420000]
[   66.420000]  DES SSID SET=
[   66.430000]
[   66.430000]  DES SSID SET=TP-Link_74F8
config_HP : US high wifi0
config_HP : tp_high_ctldisable=0
config_HP : tp_default_ctldisable=0
config_HP : tp_default_powerlvl=high
hp_ctlpwscale=0, hp_ctldisable=0
[   67.830000] device ath0 entered promiscuous mode
[   68.160000]  ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
[   68.170000]  DEVICE IS DOWN ifname=ath0
[   68.170000]  DEVICE IS DOWN ifname=ath0
[   68.470000] br-lan: port 2(ath0) entered forwarding state
[   68.470000] br-lan: port 2(ath0) entered forwarding state
[   68.480000] 8021q: adding VLAN 0 to HW filter on device ath0
[   70.470000] br-lan: port 2(ath0) entered forwarding state



BusyBox v1.19.4 (2017-12-22 13:15:31 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Attitude Adjustment, unknown)
 ---------------------------------------------------------------
root@TL_WR941HP:/#

Uboot printenv

ath> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:32k(u-boot1),32k(u-boot2),3008k(rootfs),896k(uImage),64k(mib0),64k(ART)
bootcmd=bootm 0x9f6d0000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap151${bc}-jffs2&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f300000 +$filesize&&cp.b $fileaddr 0x9f300000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Partitions tables, a bit difference than normal wr94x devices:

root@TL_WR941HP:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot"
mtd1: 006c0000 00010000 "rootfs"
mtd2: 00030000 00010000 "rootfs_data"
mtd3: 00110000 00010000 "kernel"
mtd4: 00010000 00010000 "mib0"
mtd5: 00010000 00010000 "art"
mtd6: 007d0000 00010000 "firmware"

root@TL_WR941HP:/# cat /proc/partitions
major minor  #blocks  name

  31        0         64 mtdblock0
  31        1       6912 mtdblock1
  31        2        192 mtdblock2
  31        3       1088 mtdblock3
  31        4         64 mtdblock4
  31        5         64 mtdblock5
  31        6       8000 mtdblock6

Other information based on https://openwrt.org/docs/guide-developer/adding_new_device

root@TL_WR941HP:/# cat /proc/cpuinfo
system type             : Qualcomm Atheros QCA956X rev 0
machine                 : TP-LINK TL WR941HP
processor               : 0
cpu model               : MIPS 74Kc V5.0
BogoMIPS                : 373.55
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

root@TL_WR941HP:/# cat /proc/cmdline
 board=WR941HP console=ttyS0,115200 mtdparts=spi0.0:64k(u-boot)ro,6912k(rootfs),1088k(kernel),64k(mib0),64k(art),8000k@0x10000(firmware) rootfstype=squashfs,jffs2 noinitrd

root@TL_WR941HP:/# cat /proc/devices
Character devices:
  1 mem
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 13 input
 90 mtd
108 ppp
128 ptm
136 pts
239 flash_chrdev

Block devices:
259 blkext
 31 mtdblock


root@TL_WR941HP:/# ls /sys/devices/platform
ag71xx-mdio.0     alarmtimer        ehci-platform.0   qca956x_wmac
ag71xx-mdio.1     ar724x-pci.0      ehci-platform.1   serial8250
ag71xx.0          ath79-spi         gpio-keys-polled  serial8250.0
ag71xx.1          ath79-wdt         leds-gpio         uevent


root@TL_WR941HP:/# ifconfig -a
ath0      Link encap:Ethernet  HWaddr B0:4E:26:AB:74:F8
          inet6 addr: fe80::b24e:26ff:feab:74f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:35 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr B0:4E:26:AB:74:F8
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::b24e:26ff:feab:74f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:687 errors:0 dropped:0 overruns:0 frame:0
          TX packets:170 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:71700 (70.0 KiB)  TX bytes:13701 (13.3 KiB)

eth0      Link encap:Ethernet  HWaddr B0:4E:26:AB:74:F9
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:4

eth1      Link encap:Ethernet  HWaddr B0:4E:26:AB:74:F8
          inet6 addr: fe80::b24e:26ff:feab:74f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:898 errors:0 dropped:6 overruns:0 frame:0
          TX packets:183 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:111563 (108.9 KiB)  TX bytes:14787 (14.4 KiB)
          Interrupt:5

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-63-D0-00-47-00-00-00-00-00-00-00-00
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ip6tnl0   Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          NOARP  MTU:1452  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:960 errors:0 dropped:0 overruns:0 frame:0
          TX packets:960 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:58320 (56.9 KiB)  TX bytes:58320 (56.9 KiB)

sit0      Link encap:IPv6-in-IPv4
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wifi0     Link encap:UNSPEC  HWaddr B0-4E-26-AB-74-F8-00-47-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2096 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2034 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:539
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:47 Memory:b8100000-b8120000

root@TL_WR941HP:/# ls /sys/class/net
ath0     br-lan   eth0     eth1     gre0     ip6tnl0  lo       sit0     wifi0


root@TL_WR941HP:/# brctl show
bridge name     bridge id               STP enabled     interfaces
br-lan          7fff.b04e26ab74f8       no              ath0
                                                        eth1

root@TL_WR941HP:/# ls /sys/class/leds/
lan     re      status  wan1    wan2    wifi2g  wps
5

Can you also show the console output when you try to boot with openwrt? is there kernel messages that might show whats found/not found?

6

I've successfully booted my Openwrt initramfs. It trickier than I expected.

The uboot bootm command seem to only accept images with these two condition:

  1. Must have and uImage header. Uboot will verify checksum in the first 64 bytes (e.g. 0x81000040).
  2. The image type must be "Multi-File Image". The default mkimage parameters in openwrt's common-tp-link.mk is linux.

Those idea came when I tried to boot an sysupgrade image that have uImage header, but image type is MIPS Linux Kernel Image:

## Booting image at 81000000 ...
   Verifying Checksum at 0x81000040 ...OK
Wrong Image Type for bootm command

To confirm my hypothesis, I trimmed stock firmware down to only have the header and Multi-File Image:

xpduyson@DESKTOP-9RMCMKP:~/openwrt/bin/targets/ath79/generic$ binwalk /mnt/r/tplink_wr941HPv2_bootm.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0xAFF40B5C, created: 2017-12-22 09:13:19, image size: 1109236 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x1CD39EAD, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
72            0x48            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3215376 bytes

uBoot accept that image and booted:

ath> tftp 0x81000000 tplink_wr941HPv2_bootm.bin
Trying eth0
eth0 link down
FAIL
Trying eth1
Using eth1 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'tplink_wr941HPv2_bootm.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #########################
done
Bytes transferred = 1122475 (1120ab hex)
ath> bootm
## Booting image at 81000000 ...
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 3.3.8 (jji315@ubuntu) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Fri Dec 22 17:12:43 CST 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA956X rev 0
[    0.000000] Clocks: CPU:750.000MHz, DDR:400.000MHz, AHB:250.000MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=WR941HP console=ttyS0,115200 mtdparts=spi0.0:64k(u-boot)ro,6912k(rootfs),1088k(kernel),64k(mib0),64k(art),8000k@0x10000(firmware) rootfstype=squashfs,jffs2 noinitrd

Based on that, I changed the image type from linux to multi in mkimage command in common-tp-link.mk :

define Build/uImageArcher
	mkimage -A $(LINUX_KARCH) \
		-O linux -T multi -C $(1) -a $(KERNEL_LOADADDR) \
		-e $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
		-n '$(call toupper,$(LINUX_KARCH)) OpenWrt Linux-$(LINUX_VERSION)' -d $@ $@.new
	@mv $@.new $@
endef

This is my device profile, need to overdrive KERNEL_INITRAMFS to include uImage header:

define Device/tplink_tl-wr941hp-v2
  $(Device/tplink-8mlzma)
  SOC := tp9343
  DEVICE_MODEL := TL-WR941HP
  DEVICE_VARIANT := v2
  TPLINK_BOARD_ID := TLWR941HPV2
  SUPPORTED_DEVICES += tl-wr941hp-v2
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImageArcher lzma
endef
TARGET_DEVICES += tplink_tl-wr941hp-v2

The Openwrt bootlog:

ath> bootm
## Booting image at 81000000 ...
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 4.19.101 (xpduyson@DESKTOP-9RMCMKP) (gcc version 8.3.0 (OpenWrt GCC 8.3.0 r12191-aca274091a)) #0 Thu Feb 6 10:36:15 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link TL-WR941HP v2
[    0.000000] SoC: Qualcomm Atheros TP9343 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from 0x804886c4 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 52020K/65536K available (3575K kernel code, 157K rwdata, 516K rodata, 8032K init, 199K bss, 13516K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 750.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5096694524 ns
[    0.000009] sched_clock: 32 bits at 375MHz, resolution 2ns, wraps every 5726622718ns
[    0.008247] Calibrating delay loop... 373.55 BogoMIPS (lpj=1867776)
[    0.074848] pid_max: default: 32768 minimum: 301
[    0.079926] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086903] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.098778] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.109201] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.115738] pinctrl core: initialized pinctrl subsystem
[    0.122423] NET: Registered protocol family 16
[    0.156091] clocksource: Switched to clocksource MIPS
[    0.162766] NET: Registered protocol family 2
[    0.168227] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes)
[    0.176398] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.183761] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.190489] TCP: Hash tables configured (established 1024 bind 1024)
[    0.197381] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.203563] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.210577] NET: Registered protocol family 1
[    0.423544] Crashlog allocated RAM at address 0x3f00000
[    0.430833] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.443323] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.449533] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.494216] io scheduler noop registered
[    0.498413] io scheduler deadline registered (default)
[    0.505905] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.513284] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.520867] console [ttyS0] disabled
[    0.524679] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.533835] console [ttyS0] enabled
[    0.533835] console [ttyS0] enabled
[    0.541402] bootconsole [early0] disabled
[    0.541402] bootconsole [early0] disabled
[    0.559733] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[    0.564555] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.571191] Creating 4 MTD partitions on "spi0.0":
[    0.576172] 0x000000000000-0x000000010000 : "u-boot"
[    0.582248] 0x000000010000-0x0000007e0000 : "firmware"
[    0.591606] 0x0000007e0000-0x0000007f0000 : "mib0"
[    0.597594] 0x0000007f0000-0x000000800000 : "art"
[    0.604574] libphy: Fixed MDIO Bus: probed
[    0.967185] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.646520] libphy: ag71xx_mdio: probed
[    1.651334] libphy: ar8xxx-mdio: probed
[    1.726495] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0
[    1.813672] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.823704] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii
[    1.833397] NET: Registered protocol family 10
[    1.844673] Segment Routing with IPv6
[    1.848658] NET: Registered protocol family 17
[    1.853328] 8021q: 802.1Q VLAN Support v1.8
[    2.199738] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    2.210617] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.283234] Freeing unused kernel memory: 8032K
[    2.287952] This architecture does not have kernel memory protection.
[    2.294603] Run /init as init process
[    2.314074] init: Console is alive
[    2.318082] init: - watchdog -
[    2.331918] random: fast init done
[    2.347231] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.357810] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.366641] init: - preinit -
[    2.593375] random: jshn: uninitialized urandom read (4 bytes read)
[    2.685913] random: jshn: uninitialized urandom read (4 bytes read)
[    2.823716] random: jshn: uninitialized urandom read (4 bytes read)
[    3.180311] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    3.186539] IPv6: ADDRCONF(NETDEV_UP): eth0.1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.257302] eth0: link up (1000Mbps/Full duplex)
[    4.263053] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.282325] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    7.375449] eth0: link down
[    7.400929] procd: - early -
[    7.404043] procd: - watchdog -
[    7.958417] procd: - watchdog -
[    7.962054] procd: - ubus -
[    7.972879] urandom_read: 5 callbacks suppressed
[    7.972888] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.015807] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.024119] procd: - init -
Please press Enter to activate this console.
[    8.540306] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.598523] Loading modules backported from Linux version v5.4-rc8-0-gaf42d3466bdc
[    8.606424] Backport generated by backports.git v5.4-rc8-1-0-g368e8c51
[    8.670484] xt_time: kernel timezone is -0000
[    8.834538] urngd: v1.0.2 started.
[    8.841142] PPP generic driver version 2.4.2
[    8.857249] NET: Registered protocol family 24
[    9.009707] ieee80211 phy0: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[    9.086616] kmodloader: done loading kernel modules from /etc/modules.d/*
[    9.133300] random: crng init done
[   38.868525] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   38.875831] eth0: link up (1000Mbps/Full duplex)
[   38.888405] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   38.926530] br-lan: port 1(eth0.1) entered blocking state
[   38.932116] br-lan: port 1(eth0.1) entered disabled state
[   38.938142] device eth0.1 entered promiscuous mode
[   38.943101] device eth0 entered promiscuous mode
[   38.979533] br-lan: port 1(eth0.1) entered blocking state
[   38.985128] br-lan: port 1(eth0.1) entered forwarding state
[   38.991186] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   39.078754] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   39.936939] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r12191-aca274091a
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
1 Like
7

Openwrt support for this device as of today:

Works:

  • Wifi: works "out of the box", no need to change anything. Transmission power can goes up to 30 dBm (1000mW).
  • LEDs.
  • Buttons.
  • Ethernet:
    • Corrected MAC address.
    • Eth0 and eth1 are swapped, this happen due to ar71xx to ath79 port.
    • LAN ports are now in correct label order.

Brokens:

  • Ethernet:
    • Openwrt thinks the LAN port label number 4 is also a WAN port. When plugged in port no. 4, both LAN and WAN led light up, but that port still behave as an LAN port. The blue WAN port is not respond to anything. Here is my current 02_network and dts Ethernet part, if anyone know what I did wrong please let me know:
	tplink,tl-wr941hp-v2)
		ucidef_set_interface_wan "eth1"
		ucidef_add_switch "switch0" \
			"0@eth0" "1:lan:4" "2:lan:1" "3:lan:2" "4:lan:3"
		;;

&eth0 {
	status = "okay";

	phy-handle = <&swphy4>;

	mtd-mac-address = <&mib0 0x8>;
	mtd-mac-address-increment = <1>;
};

&eth1 {
	status = "okay";
	
	mtd-mac-address = <&mib0 0x8>;
};
  • Factory Image:
    • This device have a strange partition table. Mostly similar to TP-link Archer (need something called tplink-safeloader to build), but kernel sit at the bottom of firmware.
[    0.690000] Creating 6 MTD partitions on "spi0.0":
[    0.700000] 0x000000000000-0x000000010000 : "u-boot"
[    0.700000] 0x000000010000-0x0000006d0000 : "rootfs"
[    0.710000] mtd: partition "rootfs" set to be root filesystem
[    0.720000] mtd: partition "rootfs_data" created automatically, ofs=6A0000, len=30000
[    0.720000] 0x0000006a0000-0x0000006d0000 : "rootfs_data"
[    0.730000] 0x0000006d0000-0x0000007e0000 : "kernel"
[    0.740000] 0x0000007e0000-0x0000007f0000 : "mib0"
[    0.740000] 0x0000007f0000-0x000000800000 : "art"
[    0.750000] 0x000000010000-0x0000007e0000 : "firmware"

If i put the kernel back to the beginning, uboot chose the old stock kernel instead of openwrt's one (???). If I put it to the "correct" order, the kernel (os-image) have to be expanded since the default size is too small for modern kernel. Now it seem to replaced the stock kernel, but I'm stuck with Bad Magic number again ...

2 Likes
8

Hi @xpduyson, well done! Do you had any progress so far?

9

Sorry for late reply!
Because the modern openwrt ath79 kernel cannot fit inside wr941hp's kernel partition, so it is impossible for me to continue.

1 Like
10

If you use the "TL-WR941HP v1" or "TL-WR941ND v6" u-boot, the kernel partition size problem is resolved. This can be extracted from the firmware downloaded from the official tp-link website. Remember to save the art partition for later recovery.

2 Likes
11

I got it for the "TL-WR941HP v1"!
1-Ethernets are working
2-The SPI has been fixed
3-Flash by browser normely
3-Upgrade by browser normely
4-Leds are working
5-Transmission power 1000mw works in US Country option

My GitHub:

../openwrt/tools/firmware-utils/src/tplink-safeloader.c

	/** Firmware layout for the TL-WR941HP v1 */
	{
		.id     = "TL-WR941HP-V1",
		.vendor = "",
		.support_list =
			"SupportList:\n"
			"{product_name:TL-WR941HP,product_ver:1.0.0,special_id:00000000}\n",
		.part_trail = 0x00,
		.soft_ver = NULL,

		/**
		   384KB were moved from file-system to os-image
		   in comparison to the stock image
		*/
		.partitions = {
			{"fs-uboot", 0x00000, 0x20000},
			{"firmware", 0x20000, 0x730000},
			{"default-mac", 0x750000, 0x00200},
			{"pin", 0x750200, 0x00200},
			{"product-info", 0x750400, 0x0fc00},
			{"soft-version", 0x760000, 0x0b000},
			{"support-list", 0x76b000, 0x04000},
			{"profile", 0x770000, 0x04000},
			{"default-config", 0x774000, 0x0b000},
			{"user-config", 0x780000, 0x40000},
			{"partition-table", 0x7c0000, 0x10000},
			{"log", 0x7d0000, 0x20000},
			{"radio", 0x7f0000, 0x10000},
			{NULL, 0, 0}
		},

		.first_sysupgrade_partition = "os-image",
		.last_sysupgrade_partition = "file-system",
	},

../openwrt/target/linux/ath79/image/generic-tp-link.mk

define Device/tplink_tl-wr941hp-v1
  $(Device/tplink-safeloader)
  SOC := tp9343
  DEVICE_MODEL := TL-WR941HP
  DEVICE_VARIANT := v1
  TPLINK_BOARD_ID := TL-WR941HP-V1
  IMAGE_SIZE := 7360k
  SUPPORTED_DEVICES += tplink,tl-wr941hp-v1
endef
TARGET_DEVICES += tplink_tl-wr941hp-v1

../openwrt/target/linux/ath79/generic/base-files/etc/board.d/02_network

	tplink,tl-wr941hp-v1)
		ucidef_set_interface_wan "eth1"
		ucidef_add_switch "switch0" \
			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
		;;

(fixed)
../openwrt/target/linux/ath79/generic/base-files/etc/board.d/01_leds

tplink,tl-wr941hp-v1)
	ucidef_set_led_netdev "wan-data" "WAN-ON" "blue:wan" "eth1" "tx rx"
	ucidef_set_led_netdev "wan" "WAN-OFF" "red:wan" "eth1" "link"
	ucidef_set_led_switch "lan" "LAN" "blue:lan" "switch0" "0x1e"
	;;

../openwrt/target/linux/ath79/dts/tp9343_tplink_tl-wr941hp-v1.dts

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "qca956x.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	//mod
	compatible = "tplink,tl-wr941hp-v1", "qca,tp9343";
	model = "TP-Link TL-WR941HP v1";

	//mod2
	aliases{
		label-mac-device = &wmac;
		led-boot = &led_system;
		led-failsafe = &led_system;
		led-running = &led_system;
		led-upgrade = &led_system;
	};
	leds {
		compatible = "gpio-leds";

		led_system: system {
			label = "blue:system";
			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
			default-state = "on";
		};

		qss {
			label = "blue:qss";
			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
		};

		wlan {
			label = "blue:wlan";
			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy0tpt";
		};

		wan_blue {
			label = "blue:wan";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
		};

		wan_red {
			label = "red:wan";
			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
		};

		lan {
			label = "blue:lan";
			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
		};

	};

	keys {
		compatible = "gpio-keys";

		wifi {
			label = "WiFi button";
			linux,code = <KEY_RFKILL>;
			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
		};

		reset {
			label = "Reset button";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
		};
	};

};
//ok
&uart {
	status = "okay";
};
//mod
&spi {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			uboot: partition@0 {
				label = "u-boot";
				reg = <0x000000 0x020000>;
				read-only;
			};

			partition@20000 {
				compatible = "tplink,firmware";
				label = "firmware";
				reg = <0x020000 0x730000>;
			};

			info: partition@750000 {
				label = "info";
				reg = <0x750000 0x010000>;
				read-only;
			};

			partition@760000 {
				label = "tplink";
				reg = <0x760000 0x090000>;
				read-only;
			};

			art: partition@7f0000 {
				label = "art";
				reg = <0x7f0000 0x010000>;
				read-only;
			};
		};
	};
};

&mdio1 {
	status = "okay";
	resets = <&rst 23>;
	reset-names = "mdio";
	builtin-switch;

	builtin_switch: switch0@1f {
		compatible = "qca,ar8229";
		reg = <0x1f>;
		resets = <&rst 8>;
		reset-names = "switch";
		phy-mode = "gmii";
		//remove this line is important
		//qca,phy4-mii-enable;
		qca,mib-poll-interval = <500>;

		mdio-bus {
			#address-cells = <1>;
			#size-cells = <0>;

			phy0: ethernet-phy@0 {
				reg = <0>;
				phy-mode = "mii";
			};

		};
	};
};
&uart {
	status = "okay";
};

&eth0 {
	status = "okay";

	phy-handle = <&phy0>;

	mtd-mac-address = <&info 0x8>;
	mtd-mac-address-increment = <1>;
};

&eth1 {
	status = "okay";
	mtd-mac-address = <&info 0x8>;
	mtd-mac-address-increment = <2>;
};

&wmac {
	status = "okay";

	mtd-cal-data = <&art 0x1000>;
	mtd-mac-address = <&info 0x8>;
};
3 Likes
12

I fixed the wireless transmission power for 1000mw. I only selected the US country and then work normely.
I have the solution for version 2, but I will only post it when I finish version 1.

Now only the leds are missing.

2 Likes
13

Please mind that you should always set the country to the country your router is in, not the country where you get the most wifi power out of your router.

14

Version 1 is ready. I gave up on version 2. My expectations flared to version 2.

2 Likes
15

Please don't give up on version 2 :pray:t3:

16

I can run version 2 by changing the bootloader using "ch341a programmer" and "AsProgrammer". But I can't change the bootloader via the web browser. If someone can create an image that changes the bootloader then it will be possible. Another alternative would be to reduce the size of the kernel by moving some packages to rootfs however I don't know if you can do this.

17

Thank you very much. Using the firmware on my tp-link wr941hp v1. It gained some more usage time, since I bought an Tenda ac23. Now the wr941hp is a relay from my Tenda, since the house is 25x20m and has two floors.

Could you put a step-by-step installation? I believe I did it right, because I sent "openwrt-ath79-generic-tplink_tl-wr941hp-v1-squashfs-factory.bin" to upload tplink, then I updated openwrt with "openwrt-ath79-generic-tplink_tl-wr941hp- v1-squashfs-sysupgrade.bin ". But there is still the file "openwrt-ath79-generic-tplink_tl-wr941hp-v1-initramfs-kernel.bin" that I don't know what it is for.

18

Hello, I have no idea how it would be done, but if you tell me I could do it. I have a v2 and want to put OpenWrt on it.

19

the initramfs file and sysupgrade can be ignored.
"Initramfs" is for testing without flashing.
And "sysupgrade" you will only use when you build a custom image yourself using the "image builder".
The installation procedure is the same as for most routers, without complications (but this only applies to tl-wr941hp v1). You probably did it the right way.

20

The procedure is not feasible for most people. There is also a risk of damaging the router. If you do not yet have the proper tools to perform the procedure, you will also incur costs, as you will have to purchase them.
Summary procedure:
1- Dessolding the SPI chip from the router's motherboard
2- Place it correctly in the "programmer ch341a" tool
3- Extract the image of the SPI chip using the software "AsProgrammer v1.4.1" (I assume you have already downloaded and installed everything correctly on the computer)
4- Modify the bootloader and image using the "HxD - Freeware Hex Editor" software, insert the "tl-wr941hp v1" bootloader and the compatible openwrt image (This is the most important part) ----> You must do a specific version 2 image, I have it but I didn't make it available because the procedure is very complicated.
5- Assuming that the image was modified correctly, write the image created on the Chip SPI using "ASProgrammer" and "ch341a".
6- Resolding the chip correctly on the router and it will be working.

Only with this summary you probably will not be able to, but if you confirm that you are really going to do it, I will post the entire procedure.