The WR941ND comes in many different hardware revisions and it has a different case and 450Mbps-WiFi since v6.
This article covers the international version. The Chinese v6 and v7 are quite different in hardware. There is no v7 on the international market, yet and it will definitely not have the same hardware as the Chinese version.
(31. Aug 2015) Unfortunately the OpenWrt-image for v6 in Barrier Breaker was built for the Chinese version. A working patch for adding support to the current OpenWrt-trunk can be found here: http://patchwork.ozlabs.org/patch/504451/ and will hopefully be part of the Chaos Chalmer stable release.
Known clone of this device: Mercury MWR300T+.
| Ver || CPU || RAM || Flash || Network || Wireless || USB || Serial || JTag || Wiki || FCC
| v1 || Atheros AR9132 400MHz || 32MB || 8MB || 1 WAN + 4x LAN (100 Mbit) || AR9132 [bgn 3x3:2] + AR9103 [bgn 3x3:2] || No || Yes || N/A || Link || FCC ID TE7WR941NX
| v2 || Atheros AR9132 400MHz || 32MB || 4MB || 1 WAN + 4x LAN (100 Mbit) || AR9132 [bgn 3x3:2] + AR9103 [bgn 3x3:2] || No || Yes || N/A || Link ||
| v3 || Atheros AR9132 400MHz || 32MB || 4MB || 1 WAN + 4x LAN (100 Mbit) || AR9132 [bgn 3x3:2] + AR9103 [bgn 3x3:2] || No || Yes || N/A || Link ||
| v4 || Atheros AR7240 400MHz || 32MB || 4MB || 1 WAN + 4x LAN (100 Mbit) || || No || Yes || N/A || ||
| v5.x || Atheros AR9341 535MHz || 32MB || 4MB || 1 WAN + 4x LAN (100 Mbit) || AR9341 [bgn 2x2:2] || No || Yes || N/A ||Link || FCC ID TE7WR941NXV5
| v6 || Qualcomm TP9343 750MHz || 32MB || 4MB || 1 WAN + 4x LAN (100 Mbit) || QCA9561 [bgn 3x3:3] || No || Yes || N/A || ||
The above spec for v5.x is valid only if the FCC ID of your device is TE7WR941NXV5. If the FCC ID of your device is not TE7WR941NXV5 but the hardware version is v5.x, then the above spec doesn't apply to your device and you should proceed with caution.
| Ver || S/N || OpenWrt Version Supported || Model Specific Notes
| v1 || - || Backfire 10.03 || N/A
| v2 || - || Backfire 10.03 || Similar to v1
| v3.x || - || Backfire 10.03.1 || Similar to v2
| v3.8 || - || Attitude Adjustment 12.09 || Same as v3, BUT DIFFERENT FLASH CHIP, Backfire will BRICK! See forum post.
| v4 || - || Backfire 10.03 || Similar to TL-WR741ND.
| v5.0 || - || Attitude Adjustment 12.09 || Similar to TL-WR841ND v8, see forum post.
| v5.1 || - || Attitude Adjustment 12.09 || Similar to TL-WR841ND v8, see this forum post and this forum post.
| not v6 yet || - || Barrier Breaker 14.07 || WARNING IMAGE IS FAULTY! WILL BRICK YOUR ROUTER
WARNING (2013-08-04): ATTITUDE ADJUSTMENT 12.09 Final r36088 still works, but BARRIER BREAKER Bleeding Edge r37660 has a problem where it thinks the failsafe button is always pressed (on a v3.x) Unless if you know how to make a serial console and do TFTP, best to stay away from trunk for a while. Internet search hints this may be true for more TP-Link models.
Flashing via UBoot
A 3.3v TTL serial connection is required ! (Forum post)
Do not try this method unless you're really sure what you're doing.
Set your serial terminal at 115200 8n1.
Set your computer ip address as a static one of 192.168.1.254 netmask 255.255.255.0.
Install and configure a tftp server, put the firmware on it.
The Windows firewall may get in the way.
During UBOOT "1-second" message, quickly key sequence: tpl
to stop UBOOT from loading the kernel and go into uboot mode proper.
ar7100> setenv serverip 192.168.1.254; setenv ipaddr 192.168.1.1
ar7100> tftp 0x80800000 openwrt-ar71xx-tl-wr941nd-v3-squashfs.sysupgrade.bin
ar7100> erase.b 0xbf020000 +0x3c0000
ar7100> cp.b 0x80800000 0xbf020000 0x3c0000
Note #1: 0x3c0000 is the size of the firmware, be aware that you may have a different size thus bricking your router.
Note #2: 0xbf020000 is the from addr, for your device version you can get it by issuing the command: "printenv bootcmd", not doing so will turn your router into a brick.
Revert to original firmware
You can download the original firmware from the TP-LINK support section and flash it without modification.
| Only perform the dd action below if your original firmware has the word "boot" in it, for example, "wr941nv4_en_3_9_17_up_boot(091118).bin". DO NOT dd your original firmware if it has no "boot" in its name, for example, "wr941nv4_en_3_11_5_up(100427).bin", because if you do, you will brick your router ! This was confirmed by supertom64 in wr1043nd.
| Cut first 0x20200 bytes from original firmware containing boot in the filename:
dd if=orig.bin of=tplink_boot.bin skip=257 bs=512
Flash via uboot or mtd, you cannot flash via WebGUI otherwise you will turn your router into brick.
First you need to get the firmware file onto your box. If you are able to connect to your OpenWrt console and you have your network configured properly, you can use wget or scp to copy the firmware binary into the /tmp folder.
To start flashing via mtd you have to call (wr.bin is the file containing the firmware you previously downloaded):
root@OpenWrt:/tmp# mtd -r write wr.bin firmware
Unlocking firmware ...
Writing from wr.bin to firmware ...
| Instruction set: MIPS
| Vendor: Atheros
| Bootloader: uboot
| System-On-Chip: AP81
| CPU Speed: 400 Mhz
| Flash-Chip: S25FL032P (HW Ver 3.6)
| Flash size: 4 MiB
| RAM: 32 MiB
| Wireless: Atheros AR9103 802.11n
| Ethernet: Switch part of SoC
| USB: No, but USB port header has been discovered on the board
| Serial: Yes
| JTAG: N/A
This photo was taken from a WR940N v1, but it seems to have the same PCB.
This photo was taken from a WR940N v3, but I confirmed that it has the same PCB.
Opening the case
Note: This will void your warranty! These instructions are not very good! (yet…)
There are two screws underneath the rubber feet at the back (were the RJ45 jacks are) of the device. Remove those.
Remove the front plastic piece.
Try to open the white plastic cover at the top only a little bit.
Unhinge the plastic cover at the front.
There is also an easy way to do it
Remove those two screws underneath the rubber feet at the back
Get your nails in the grooves underneath the router and lift the panel
Use your nails and slowly go around the case to Unhinge the plastic cover at the front
Main PCB (not V3.2)
serial pin ver: 5.1
Look at the PCB picture. Serial port is located were the 4 wires are soldered to the board. The left one (green) is soldered to the pad labeled "P1".
Pinout of the port is : |TX|RX|GND|VCC(3.3)| (direction as seen in PCB picture above; Pad "P1" is TX)
Before you can use the serial port you have to bridge R356. (A smd pad right underneath the serial port pad "P1").
It is not possible to directly connect the serial port to one of your computer (voltage mismatch). You have to use a converter (i.e. a Nokia CA-42 cable, serial to USB converter or something similar. An Arduino MEGA with a simple serial bridge also works).
On the ver3 board, there is a 4.7k pull-down resistor on the RX pin. To interface with 5V devices (such as the Arduino MEGA), use a 2k2 resistor in series with the RX pin (Arduino's TX pin). Arduino's RX pin can be connected directly with the router's TX pin.
Note the serial port on the right part of the board, approx. in the middle. Four pins next to the two large capacitors.
The serial port pinout is TX, RX, GND, NC. (in the picture from bottom to top)
Port settings are 115200, 8n1, no flow control.
Note: The console output may have garbage characters in it, as well as it will not take input. In this case pulling TX high with a 15K resistor from 3.3 volt resolves this
Once the OEM firmware has booted up completely, you can press return to activate the Linux login prompt.
The username/password combination to get a root Shell access is root:sohoadmin
Setting up VLAN is a bit different from other devices:
First, you have to edit /etc/rc.local (sample config for VLAN 100 and 200 on trunk port lan4):
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.
vconfig add lan4 100
vconfig add lan4 200
ifconfig lan4.100 up
ifconfig lan4.200 up
Then, you have to edit /etc/config/network and reboot the device (that /etc/rc.local is executed):
config interface vlan100
option ifname "lan1 lan2 lan3 lan4.100"
config interface vlan200
option ifname "lan4.200"
The device has 2 buttons:
Connect stuff to the USB port