The router is started (plug the power cord in)

U-Boot 1.1.4 (Mar 8 2010 - 10:28:58)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7100_enet_initialize...
No valid address in Flash. Using fixed address
bsingle_phy = 0
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds

Send tpl command to the router

ar7100> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(uboot-env),5120k(rootfs),1024k(uImage)
bootcmd=bootm 0xbf020000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.10
serverip=192.168.1.169
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 339/65532 bytes
ar7100> tftp

0xa0800000 openwrt-ar71xx-tl-wr941nd-v3-initramfs-uImage.bin

set link to 100M full by lqm.

dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.169; our IP address is 192.168.1.10
Filename 'openwrt-ar71xx-tl-wr941nd-v3-initramfs-uImage.bin'.
Load address: 0xa0800000
Loading: * T T T T T T T T T checksum bad

checksum bad
T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################################################
done
Bytes transferred = 2642702 (28530e hex)
ar7100> bootm

0xa0800000

## Booting image at a0800000 ...

Uncompressing Kernel Image ... OK
Starting kernel ...
Linux version 2.6.32.27 (bencoh@procyon) (gcc version 4.3.3 (GCC) ) #3 Sun Mar 4 17:37:54 CET 2012
bootconsole [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR9132 rev 2, CPU:400.000 MHz, AHB:100.000 MHz, DDR:400.000 MHz
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: rootfstype=squashfs,yaffs,jffs2 noinitrd console=ttyS0,115200 board=TL-WR941ND
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 27964k/32768k available (2062k kernel code, 4804k reserved, 404k data, 1552k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:56
Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is TP-LINK TL-WR941ND
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY) 2001-2006 Red Hat, Inc.
yaffs Mar 4 2012 02:46:30 Installing.
msgmni has been set to 54
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Atheros AR71xx SPI Controller driver version 0.2.4
m25p80 spi0.0: s25sl032a (4096 Kbytes)
Searching for RedBoot partition table in spi0.0 at offset 0x3e0000
Searching for RedBoot partition table in spi0.0 at offset 0x3f0000
No RedBoot partition table detected in spi0.0
spi0.0: no WRT160NL signature found
Creating 5 MTD partitions on "spi0.0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000003f0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "spi0.0"
0x0000003f0000-0x000000400000 : "art"
0x000000020000-0x0000003f0000 : "firmware"
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP westwood registered
NET: Registered protocol family 17
Distributed Switch Architecture driver version 0.1
ar7240_dsa: unsupported chip, ctrl=ffffffff
eth0[0]: detected a Marvell 88E6060 switch
dsa slave smi: probed
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 1552k freed
input: gpio-buttons as /devices/platform/gpio-buttons/input/input0
Button Hotplug driver version 0.3.1
eth0: link up (100Mbps/Full duplex)
- preinit Registered led device: tl-wr941nd:green:system
Registered led device: tl-wr941nd:red:qss
Registered led device: tl-wr941nd:green:qss
Registered led device: tl-wr941nd:green:wlan
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit eth0: link down
- init -

Please press Enter to activate this console. eth0: link up (100Mbps/Full duplex)
device lan1 entered promiscuous mode
device eth0 entered promiscuous mode
lan1: link up, 100 Mb/s, full duplex, flow control disabled
br-lan: port 1(lan1) entering forwarding state
device lan2 entered promiscuous mode
device lan3 entered promiscuous mode
device lan4 entered promiscuous mode
Compat-wireless backport release: compat-wireless-2011-11-29
Backport based on wireless-testing.git master-2011-12-01
cfg80211: Calling CRDA to update world regulatory domain
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: World regulatory domain updated:
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
ieee80211 phy0: Atheros AR9100 MAC/BB Rev:7 AR2133 RF Rev:a2 mem=0xb80c0000, irq=2
cfg80211: Calling CRDA for country: US
PPP generic driver version 2.4.2
cfg80211: Regulatory domain changed to country: US
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
nf_conntrack version 0.5.0 (461 buckets, 1844 max)
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver

Press Enter
BusyBox v1.15.3 (2012-03-04 02:40:41 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______
________
__
|
|.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
Backfire (10.03.1, r30752) -----------------------* 1/3 shot Kahlua In a shot glass, layer Kahlua
* 1/3 shot Bailey's on the bottom, then Bailey's,
* 1/3 shot Vodka then Vodka.

--------------------------------------------------root@OpenWrt:/# cd

tmp
root@OpenWrt:/tmp# wget ftp://192.168.1.169:21/wr941nv3_en.bin
Connecting to 192.168.1.169:21 (192.168.1.169:21)
wr941nv3_en.bin
0% |
| 0 --:--:-- ETA
wr941nv3_en.bin 100% |*******************************| 3840k 00:00:00 ETA
root@OpenWrt:/tmp# mtd write wr941nv3_en.bin firmware
Unlocking firmware ...
Writing from wr941nv3_en.bin to firmware ... [
]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]
[w]
[e]

[w]

[e]

[w]

[e]

[w]
[e]
[w]
[e]
[w]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[e]
[w]
[e]
[w]
[e]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[e]
[e]

[w]
[w]

[w]

[w]

[e]

[w]

[e]

[w]

[e]

[w]

[e]

[w]

[e]

[w]

[e]

[w]

[e]

[w]

[e]

root@OpenWrt:/tmp# reboot
root@OpenWrt:/tmp# eth0: link down
br-lan: port 1(lan1) entering disabled state
device eth0 left promiscuous mode
device lan4 left promiscuous mode
br-lan: port 4(lan4) entering disabled state
device lan3 left promiscuous mode
br-lan: port 3(lan3) entering disabled state
device lan2 left promiscuous mode
br-lan: port 2(lan2) entering disabled state
device lan1 left promiscuous mode
br-lan: port 1(lan1) entering disabled state
lan1: link down
Restarting system.

U-Boot 1.1.4 (Mar 8 2010 - 10:28:58)

AP81 (ar7100) U-boot
DRAM:
sri
32 MB
id read 0x100000ff
flash size 4MB, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial

Net: ag7100_enet_initialize...
No valid address in Flash. Using fixed address
bsingle_phy = 0
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds## Booting image at bf020000 ...
Uncompressing Kernel Image ... OK
Starting kernel ...
Linux version 2.6.15--LSDK-6.1.1.40 (zhongjin@rd3linux.tplink) (gcc version 3.4.4) #1 Mon Jan 30 18:01:21 CST 2012
flash_size passed from bootloader = 4
CPU revision is: 00019374
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init mtdparts=ar7100nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30516k/32768k available (1407k kernel code, 2236k reserved, 300k data, 112k init, 0k highmem)

Mount-cache hash table entries: 512

Checking for 'wait' instruction... available.
NET: Registered protocol family 16
Jumpstart button pressed.
SCSI subsystem initialized
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #2 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPPoX init, max protocols:3
NET: Registered protocol family 24
pppox protocol 0 register. max:3
cmdlinepart partition parsing not available
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7100-nor0
Creating 5 MTD partitions on "ar7100-nor0":
0x00000000-0x00020000 : "boot"
0x00020000-0x00120000 : "kernel"
0x00120000-0x003e0000 : "rootfs"
0x003e0000-0x003f0000 : "config"

0x003f0000-0x00400000 : "art"
->Oops: flash id 0x10215 .
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7100wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 112k freed

init started: BusyBox v1.01 (2012.01.30-10:04+0000) multi-call binary

Algorithmics/MIPS FPU Emulator v1.5
This board use 2.6.15
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.4 (256 buckets, 5120 max) - 244 bytes per conntrack
ip_conntrack_pptp version 3.1 loaded
insmod: cannot open module `/lib/modules/2.6.15/kernel/flashid.ko': No such file or directory
pppox protocol 1 register. max:3
PPPoL2TP kernel driver, V0.17. fixed many bug. drop rcv pkts and xmit pkts while no buffer, use pass time HZ/4.only
drop ip pkt. no printk. xl2tpd 15 retries xmit. 08.20
PPTP driver version 0.8.3
pppox protocol 2 register. max:3

insmod: cannot open module `/lib/modules/2.6.15/kernel/harmony.ko': No such file or directory

insmod: cannot open module `/lib/modules/2.6.15/kernel/cdc-acm.ko': No such file or directory
Now flash open!
Now flash open!
Now flash open!
Now flash open!
Now flash open!
Erase from 0X3E0000 to 0X3ECC48:.
Program from 0X3E0000 to 0X3ECC48:
write successfully

(none) mips #1 Mon Jan 30 18:01:21 CST 2012 (none)

(none) login: manufatureName: TP-LINK --debug Now flash open!
by HouXB
Erase from 0X3E0000 to 0X3ECC48:.
Program from 0X3E0000 to 0X3ECC48:
write successfully
device eth0 entered promiscuous mode
Now flash open!
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
tp_domain: module license 'BSD' taints kernel.
ip_nat_pptp version 3.0 loaded
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved

ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 0.9.4.5 (Atheros/multi-bss)
Howl Revision ID 0xb9 <6>wifi0: Atheros AR9100 WiSoC: mem=0xb80c0000, irq=2
wlan_me: Version 0.1
Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
wlan: mac acl policy registered

TP_Flags:6****
The selected channel is 8
Country ie is US
Country ie is US
maxrate = 300000
Country ie is US
br0: port 1(eth0) entering disabled state
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state
Country ie is US
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state

br0: port 2(ath0) entering disabled state

TP_Flags:6****

TP_Flags:0****
Country ie is US
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
Inteference detected
rx_clear=100, rx_frame=0, tx_frame=0
ath_bstuck_tasklet... Calling ath_internal reset