Id' say get what is locally available.  Planex hasn't released GPL source download, they aren't perfect.  It just depends how important the 8MB of flash and USB port is to you.  The planex has vent holes on both flat sides, so you could lay it on one side... It seems slightly larger but I don't have them both in the same room to be certain.

TP-Link U-boot is difficult to work with.  It gives you only one second to type in "tp" to intercept it, it has been modified in nonproductive ways.  I don't think either one allow flashing over http like the Trendnet/D-Link do.  If you had to recover flash, you would probably need to solder in serial and reflash from u-boot on either one.

The TP-Link and Planex share identical antenna sizes, connectors and ar9103 3x3 chip.  That's part of why I emphasized that if it's an option for you, the 8MB flash and USB port is pretty attractive on the Planex.

Both the TP-Link and Planex can be flashed from their web GUI now without needing to add a serial port.  As long as you don't get a bad flash or screw up your access to the router.  Then a serial port would be required.

Nobody has detailed a MMC/SDHC mod for the AP81 yet... that would be nice with the smaller 4MB flash we are finding on most units.

Oops. I got my WR941ND today and immediately built and flashed openwrt-trunk (r14745) image bin/openwrt-ar71xx-tl-wr941ndv2-squashfs.uni. Maybe I was a little too eager. Now I cannot even ping it (at 192.168.1.1).

I guess it's back to the soldering iron now... Good thing I ordered one of those too.

I haven't flashed mine yet. juhosg has one (he is doing the development), wonder what happened?

make sure you work out how you are going to bridge those surface mount pads.  It is too small to solder that one spot.  I used liquid copper and a toothpick.  You may want to read up on "AMD Pencil Trick"

Hi,

Weird, it is working for me.

...
handover: boot [early0] -> real [ttyS0]
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
Atheros AR71xx SPI Controller driver version 0.2.2
m25p80 spi0.0: m25p32 (4096 Kbytes)
Searching for RedBoot partition table in spi0.0 at offset 0x3e0000
Searching for RedBoot partition table in spi0.0 at offset 0x3f0000
No RedBoot partition table detected in spi0.0
Creating 5 MTD partitions on "spi0.0":
0x00000000-0x00020000 : "u-boot"
0x00020000-0x00140000 : "kernel"
0x00140000-0x003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=390000, len=60000
0x00390000-0x003f0000 : "rootfs_data"
0x003f0000-0x00400000 : "art"
0x00020000-0x003f0000 : "firmware"
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP vegas registered
NET: Registered protocol family 17
Distributed Switch Architecture driver version 0.1
eth0: detected a Marvell 88E6060 switch
dsa slave smi: probed
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Please be patient, while OpenWrt loads ...
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
jffs2 not ready yet; using ramdisk
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
- init -

Please press Enter to activate this console. eth0: link up (100Mbps/Full duplex)
eth0: link down
eth0: link up (100Mbps/Full duplex)
device lan1 entered promiscuous mode
device eth0 entered promiscuous mode
lan1: link up, 100 Mb/s, full duplex, flow control disabled
br-lan: topology change detected, propagating
br-lan: port 1(lan1) entering forwarding state
device lan2 entered promiscuous mode
device lan3 entered promiscuous mode
device lan4 entered promiscuous mode
br-lan: port 1(lan1) entering disabled state
br-lan: topology change detected, propagating
br-lan: port 1(lan1) entering forwarding state
cfg80211: Using static regulatory domain info
cfg80211: Regulatory domain: US
        (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
        (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
        (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
        (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
phy0: Atheros AR9100 MAC/BB Rev:0, AR2133 RF Rev:a1, mem=0xb80c0000, irq=2
cfg80211: Calling CRDA for country: US
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (512 buckets, 2048 max)
Registered led device: tl-wr941nd:green:system
Registered led device: tl-wr941nd:red:qss
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs



BusyBox v1.11.3 (2009-02-23 16:20:30 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r14746) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#

Some ideas:
Broken flashing process?
Different board version?
Did you try the WAN port accidentally?

Can you send your image to me?

That was a good decision.

-Gabor

It's a different board version. Mine says v2.2. I will upload some pictures tomorrow.

Any ideas on how I can identify the serial pins? I have a knife and fork, screwdriver, multimeter and a soldering iron.

1.7. Finding Serial Console

That looks much more like the traditional AP81 serial port pin-out than the older TP-Link revision.  pin 2 = RX, pin 3 = TX, pin 4 = Ground

I can't make out clearly in the photo the surface mount pads below the serial port, but they can be a big issue.  If any of those pads are missing connections and you can't get serial to work...  The trick I did:

1) use a very small flat blade screwdriver and wiggle it on top of the exposed pads
2) set terminal to 115200
3) press the router WPS button over and over, as it will cause a console message to be sent.  that way you don't have to keep turning the router off/on to get the boot message.

If output works while bridge the pads, then you gotta turn off the unit and figure out how to bridge permanently.

(Last edited by RoundSparrow on 5 Mar 2009, 15:23)

Thanx! But I'm just not cut out for this. I spent a few hours on it and I think I have a reasonable GUESS for the pin layout (see below) but I got nothing on serial.

LAN4       LAN3        LAN2         LAN1

           P1
           RX*    TX    GND   VCC

              B1   B2  B3  B4



LAN1-4 = LAN ports for board orientation.

P1 = Mark "P1" on board.

B1-4 = Tiny "bridges" to control connectivity I think.

RX* - Possible RX pin? Multimeter detects change when B1 or B2 is closed. With no "bridge" connected seems to go to nowhere. Resembles an RX pin when B2 is connected.
TX - Possible TX pin?
GND - Fairly certain this is ground. Good connectivity to RF-shield.
VCC - Fairly certain this is VCC. Constant 3.3V to GND.

Maybe it's bricked? How about that JTAG port...?

Ahh, I'm in over my head again... I have another one sitting on my desk. Gabor, want to give it a try?

-EWRONGBAUDRATE?

You sent two devices to me already, so only in that case if you won't find it.

Well one fundamental problem is we don't know the state of the router... we don't know how badly it is bricked.  Perhaps the serial being sent for such a brief period it is difficult to bridge the pads and do cold boot at same time. Almost like you need a foot pedal power switch to turn on the router while doing the temporary bridge connections.  This is what I had to do   I must have had to boot my TP-Link 100 times.

  Maybe you trying serial on the good working router you have - to figure out the serial - is the way to go? Just a suggestion.

I tried both 9600 and 115200. But you do have a point RoundSparrow, it is difficult to attach everything in time to catch the U-Boot output (especially if kernel boot fails completely so there are no printouts). How long do you think I have with U-Boot before it goes into kernel?

I'm just a little bit discuraged by all the uncertainty here. The thing could be completely bricked. I could be too slow. I could be wrong about TX/RX or even some other pin. There might be some other bridge i have to connect. And even if I get the serial to work I'm not sure I can fix the build anyway...

Do you see a big difference between the v2.0 and v2.2 layout? The v2.0 doesn't have the 4-pin serial in the same place does it? The place on the board where I'm soldering doesn't exist on the v2.0 or am I just confused? I will try some soldering on the fresh board tomorrow.

From the photo they clearly redid the serial port connection.  With the tricks they play with baud rate and missing connection (the open surface mount pads).  This is part of why I dislike the TP-Link, what is the purpose of this

I wasted like 6 hours on my first one of these, and I destroyed the tiny surface mount pad trying to solder the bridge.  But I learned my lesson, a 60 watt soldering iron was also a club of a tool to use on this   I've now got my quality soldering iron and know the layout.

I suggest the working one, it will simplify you.  At least if you can afford the time and risk.  As there seems a lot of interest in this particular router with the good worldwide distribution.

(Last edited by RoundSparrow on 6 Mar 2009, 05:31)

No luck.

Used your method RoundSparrow with 115200 baudrate and pressing the WPS button (labeled "QSS", right?) to try both the above pin guess and TX/RX-swapped. I tried connecting both B1 and B2 for both pin guesses, but no usable output. Will the WPS button always print a line to serial, no mater how fast I press it (within reason)?

The best I could get was some garbage when I use the guess above and wiggle a screwdriver on B1:

*** baud: 57600 ***
�����
*** baud: 38400 ***
��
���{
�
*** baud: 19200 ***
��
*** baud: 9600 ***
�
 
�`
       ���������������p�
*** baud: 4800 ***

�J����P
             �����0 ��h������P��
*** baud: 9600 ***

*** baud: 19200 ***

*** baud: 38400 ***

*** baud: 57600 ***

*** baud: 115200 ***

*** baud: 115200 ***
������
���D�4���� r��������~���gw������>��<�@�<�?��������� ~���

                                                                              �)8
��������p�������������������������������������������������������� 
                                                                              ����
:>�
����{
>
�����<���>��������/�8�v��@� þ øá 0@Sø 
ÿ@€ÿ      þ   ð     │ ⎻ð � │€ €ø €   üü  þü ø Cþ◆       ð þ  ÿ           ˆ  ì           ·ÿ ┼÷îþ>    ·     �       │ „ � €ø ü   €ü     
  ñ   @             €⎻◆  †              €  þ  ÿ      ÿ     €   ±      þüØ @    8    � � À    ⎻ ÿ8€ðÿ�        À        Ë ◆ðü ú þ > ßø│  
◆ ◆            €   ðS� �þ             €             €         ð 
                  ü           ý÷ À�  À                          �    ü þ þÀ     óø  .� �  ÿ   €ÿ 0<   � À     ðÑøÀ

It doesn't seem to have much to do with me pressing the button though, more a result of the wiggling screwdriver.

Wiggling on B2 seems to have no effect.

Any ideas?

Can you get a better photo of the serial port area and maybe even traces to the CPU from that serial port?  Can you study the traces and see which ones seem to actually have connections (it might help to get the photo first, then study the photo on computer).

Lark is the user who figured out the original serial of the TP-Link.  Maybe we should have him review what you tried (he has been on #OpenWRT-Devel IRC a few times).

Yes, my expreience is that after the system is booted - boot has settled own (45 seconds)... that each time you press QSS a short message (15 chars?) is sent to console.  The rate should be 115,200 at this point (after linux boots, past u-boot).

Just so we are clear, you are using a 3.3v serial port converter to the host, right? The output I see looks like the noise I get when just make noise doing wiggles..   I'd focus the testing strictly on host TX (pressing QSS) and at 115200.  Also suggest you reset your terminal software after too much garbage.  I use a prolific rs232 to USB adapter, it helps if I unplug it from the host and replug it after a couple attempts... then go right to 115200 and cold boot router.... sometimes the chip gets in some screwed up state (I was just installing and testing one last night on another router, had to do this when I see the output you show).   I personally use screen on Linux:  "screen /dev/ttyUSB0 115200"

(Last edited by RoundSparrow on 6 Mar 2009, 13:43)

Would be great if we could get some help from Lark.

I'm using a Meraki serial adaptor and a linux machine with picocom. I test it on a Meraki Mini (to see that it works) at 115200 baud and then move it over to the TP-LINK. I've also measured the VCC voltage on the Meraki Mini and it is the same as the TP-LINK, 3.3v. Should be ok, right?

EDIT: I have a high resolution image of most of the board that I can email if it helps (Flickr scales it down to some max size).

(Last edited by _bbb_ on 6 Mar 2009, 15:23)

Great picture!  let's review the basics, only connect  RX,TX,GND - no need to connect the power one (so only 3 wires).

The signal traces clearly go to pin #1 and pin #2
It looks to me the pad below pin#1 needs bridged (R356).  A resistor or something is installed on the trace to pin #2.  My experience says that your pin #1 and pin #2 will be TX or RX.  The GND should be easy to identify (Pin #3 or #4) with continuity test to the metal shield to your right (do this with power disconnected)

I think you are close.

I'm in China, and have a 2.3 version router.   I've been following this with interest (TPLink is one of the major vendors here in China router wise)

Does anyone have any interest in a photo of the internals? 
I haven't taken mine apart yet, but will do if people are interested.

I haven't even gotten around to flashing it yet - assuming I follow RoundSparrow's instructions here http://forum.openwrt.org/viewtopic.php?id=18858

Hopefully this isn't too OT for anyone.  Thx!

First of all: don't flash it yet! I flashed a v2.2 and it seems dead... Only board version that is (relatively) safe to flash is v2.0 AFAIK.

Would be very interesting to get a photo of the v2.3 board! If it is completely different again than we might even be wasting our time here (depending on how many v2.2:s there are).

I am fairly certain that Pin #3 = GND and Pin #4 = VCC. Signal goes to Pin #1 and Pin #2. Problem is I do not get any output from this setup, regardless of which pad I bridge and which pin I connect to TX/RX.

Possible sources of errors:

1) The Meraki Mini serial adaptor. One thing that bothers me is that the Mini has 3.3v on the RX pin. The WR941ND has 0v as I presume most other boards do.

2) The temproary pad briding with the wiggling screwdriver trick feels a bit unreliable. Is there some other trick? Should I pick one and bridge it permanently?

Larkw may be on IRC #OpenWrt-Devel channel this weekend, can you join? we are on now.

My thoughts on your serial adapter, do you have another brand/model of router to test it on?  For me, this boots my confidence that at least my host serial adapter is in order.

Lark studied your photos and says with confidence: P1 is RX, P2 is TX.  R356 is all you should need to bridge.

(Last edited by RoundSparrow on 7 Mar 2009, 18:30)

First of all thank you for the great work!

I have a revision 2.2 as well (Board revision 1.1). So i also bricked mine some days ago :-)

I can confirm this. I use a self soldered USB to TTL converter (FT232RL based).

I have two outputs:

Uboot (9600):

U-Boot 1.1.4 (May  1 2008 - 19:25:20)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds, press "tp" to stop
## Booting image at bf020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.28.7 (prisma@oimel) (gcc version 4.1.2) #1 Fri Feb 27 09:12:07 CET 2009
console [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9132 rev 1 (id:0xb5), CPU:400.000 MHz, AHB:100.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: rootfstype=squashfs,yaffs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29708k/32768k available (1818k kernel code, 3060k reserved, 332k data, 132k init, 0k highmem)
SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
Mount-cache hash table entries: 512
net_namespace: 480 bytes
NET: Registered protocol family 16
MIPS: machine is TP-LINK TL-WR941ND
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
yaffs Feb 27 2009 09:08:31 Installing.
msgmni has been set to 58
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver1 ports, IRQ sharing disabled

Kernel (115200):

eth0: Atheros AG71xx at 0xb9000000, irq 4
Atheros AR71xx SPI Controller driver version 0.2.2
m25p80 spi0.0: unrecognized JEDEC id 898912
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP vegas registered
NET: Registered protocol family 17
Distributed Switch Architecture driver version 0.1
eth0: detected a Marvell 88E6060 switch
dsa slave smi: probed
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Cannot open root device "<NULL>" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Maybe v2.2 (board 1.1) has a different flash chip (m25p80 spi0.0: unrecognized JEDEC id 898912)?
v2.2 has a Numonyx(INTEL) 320S33B chip...

BTW: I also had this strange output. That was when i used a self soldered COM TTL Adapter (MAX 323 based). I have no clue why this happend. some days later i bricked my serial port on my desktop :-(
So built an USB TTL Adapter based on this (modified for 3.3V)

(Last edited by prisma on 8 Mar 2009, 08:45)

Hi, i brought one wr941nd, its v2.0 and i have some questions
1. can i upgrade a existing openwrt instalation on wr941nd ?
2. can i revert back to original firmware ?
3. someone have tryed usb modules with openwrt and wr941nd ?
I don´t have a serial adapter and never worked with one so i being carefull.

Thanks for the great work !

That sounds like a very good reason! There should be hope for unbricking it then.

BTW: I'm still stuck on bridging the R356 pad. Soldering it is not easy and I can't find any of that liquid metal stuff.

Pencil.  http://www.motherboards.org/articles/guides/41_4.html

BTW, this and several other reasons (such as u-boot mods, shared Ethernet interface for LAN and WAN) are why I put TP-Link near bottom of recommended AP81 routers.  The good news is that they have excellent worldwide distribution... so worth the effort.

(Last edited by RoundSparrow on 8 Mar 2009, 13:35)