TP-Link TL-WDR3600

Dual Band (concurrent) and Gigabit Ethernet. Advertised as 600 Mbps it is Dual-Stream (2x2) on the 2.4 Ghz Band and Dual-Stream (2x2) on the 5 Ghz Band. This wiki entry is fairly brief, but most things in the TP-Link TL-WDR4300 wiki entry apply here.

Supported Versions

Version/Model Release Date OpenWrt Version Supported Model Specific Notes
1.1 2012/07 Attitude Adjustment 12.09 works fine (since trunk r33219) Similar to TP-Link TL-WDR4300
1.2 Attitude Adjustment 12.09 seems to work LEDs blue
1.3 Attitude Adjustment 12.09 + wifi patch, or trunk (r39392), LEDs blue
1.4 July 2013 Attitude Adjustment 12.09 + wifi patch , or trunk (r39392) LEDs now green, not blue
1.5 December 2013 Attitude Adjustment 12.09 + wifi patch , or trunk (r39392) LEDs now green, not blue

The latest firmware available is the release build Attitude Adjustment 12.09 or the release candidate (rc3) build Barrier Breaker, with working ethernet and dual-band wireless (disabled by default). Barrier Breaker has several wifi fixes and other major improvements and is strongly recommended. Proper support of the latest hardware revisions requires Barrier Breaker as well.

If your wireless cannot be enabled when using wide channel modes, this may be due to the friendly neighbor "feature" that prohibits operation of such a mode and you may have to use the standard modes before wireless can be enabled. For some people radio0 works only when radio2 is also enabled.

Info

Architecture: MIPS MIPS 74Kc
Vendor: Qualcomm Atheros
Bootloader: U-Boot
System-On-Chip: AR9344 (MIPS)
CPU/Speed 560 MHz
Flash-Chip: Spansion FL064KIF docs
Flash size: 8192 KiB
RAM: 128 MiB
Wireless No1: Atheros AR9340 2.4GHz 802.11bgn
Wireless No2: Atheros AR9582 5GHz 802.11an
Switch: Atheros AR8327N Gigabit Switch
USB: Yes 2 x 2.0 (GL850G chip - 4 port's capable)

Switch Ports (for VLANs)

Port Switch port
CPU 0
Internet (WAN) 1
LAN 1 2
LAN 2 3
LAN 3 4
LAN 4 5
unknown 6

The switch driver refuses to configure a port with tagged and non-tagged VLANs. It is possible to tag multiple VLANs on the same ports:

root@OpenWrt:/# swconfig
swconfig dev <dev> [port <port>|vlan <vlan>] (help|set <key> <value>|get <key>|load <config>|show)

root@OpenWrt:/# swconfig dev switch0 help
switch0: eth0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128
     --switch
        Attribute 1 (int): enable_vlan (Enable VLAN mode)
        Attribute 2 (none): reset_mibs (Reset all MIB counters)
        Attribute 3 (none): apply (Activate changes in the hardware)
        Attribute 4 (none): reset (Reset the switch)
     --vlan
        Attribute 1 (int): vid (VLAN ID (0-4094))
        Attribute 2 (ports): ports (VLAN port mapping)
     --port
        Attribute 1 (none): reset_mib (Reset single port MIB counters)
        Attribute 2 (string): mib (Get port's MIB counters)
        Attribute 3 (int): pvid (Primary VLAN ID)
        Attribute 4 (string): link (Get port link information)
OpenWRT switch configuration Eth0.1 = LAN et Eth0.2 = WAN
root@OpenWrt:/# swconfig dev switch0 vlan 1 show
VLAN 1:
        vid: 1
        ports: 0t 2 3 4 5
root@OpenWrt:/# swconfig dev switch0 vlan 2 show
VLAN 2:
        vid: 2
        ports: 0t 1
Tag of port 5 on VLANs 1 and 2 successful:
root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4 5t"
root@OpenWrt:/# swconfig dev switch0 vlan 1 show
VLAN 1:
        vid: 1
        ports: 0t 2 3 4 5t
root@OpenWrt:/# swconfig dev switch0 vlan 2 show
VLAN 2:
        vid: 2
        ports: 0t 1

root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 5t"
root@OpenWrt:/# swconfig dev switch0 vlan 1 show
VLAN 1:
        vid: 1
        ports: 0t 2 3 4 5t
root@OpenWrt:/# swconfig dev switch0 vlan 2 show
VLAN 2:
        vid: 2
        ports: 0t 1 5t
Tag port 4 in VLAN 1, and untag port 4 in VLAN 2: Error, port 4 is removed from VLAN 1
root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4t 5t"
root@OpenWrt:/# swconfig dev switch0 vlan 1 show
VLAN 1:
        vid: 1
        ports: 0t 2 3 4t 5t
root@OpenWrt:/# swconfig dev switch0 vlan 2 show
VLAN 2:
        vid: 2
        ports: 0t 1 5t

root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 4 5t"
root@OpenWrt:/# swconfig dev switch0 vlan 1 show
VLAN 1:
        vid: 1
        ports: 0t 2 3 5t
root@OpenWrt:/# swconfig dev switch0 vlan 2 show
VLAN 2:
        vid: 2
        ports: 0t 1 4 5t
root@OpenWrt:/#

TFTP auto recovery in revision 1.5

At least some revision 1.5 routers contains bootloader recovery TFTP client. To activate it press and hold WPS/Reset Button during powering on until WPS LED turns on. Connect computer to LAN1. Using TCPdump, you should see ARP requests from router having address 192.168.0.86 looking for address 192.168.0.66.

# tcpdump -ni eth0 arp
ARP, Request who-has 192.168.0.66 tell 192.168.0.86, length 46

Set up your computer to address 192.168.0.66, netmask /24 (255.255.255.0).

# ip addr add dev eth0 192.168.0.66/24

Using TCPdump, you should now see request for new firmware image:

# tcpdump -npi eth0 udp
IP 192.168.0.86.2195 > 192.168.0.66.69:  44 RRQ "wdr3600v1_tp_recovery.bin" octet timeout 5

Rename factory image to given name and put it into TFTP server root. → generic.flashing.tftp

:!: In case you are flashing back original firmware, make sure original firmware image name does not contain word bootback.to.stock.firmware.

# cp openwrt-ar71xx-generic-tl-wdr3600-v1-squashfs-factory.bin wdr3600v1_tp_recovery.bin
# atftpd --no-fork --daemon .

After downloading, the flashing starts immediatelly. After cca. 1 minute, the router reboots automatically.

Back to stock firmware

generic.uninstall

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

With the TL-WR3600 router, there is a catch: the stock firmware is obtained from the OEM: http://www.tplink.com/en/support/download/?model=TL-WDR3600

  • in case the file name of this firmware file does not contain the word "boot" in it, you can simply revert back to original firmware
  • in case the file name of this firmware file does contain the word "boot" in it, you need to cut off parts of the image file before flashing it:

An example of an image file with the word "boot" in it is wdr3600v1_en_3_13_34_up_boot(130909).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:

dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade:

sysupgrade /tmp/tplink.bin

Or alternatively you can use the mtd method:

mtd -r write /tmp/tplink.bin firmware

OEM TP-Link firmware for the TL-WDR3600 with the boot part removed to revert to the original OEM firmware:

Useful Information about Stock Firmware

Updated versions of stock firmware have Firmware Recovery Mode. Recommend upgrading latest stock firmware before flashing to OpenWrt for the first time so you can utilise this if necessary.

Flash Layout

0x000000000000-0x000000020000 "u-boot" /dev/mtdblock0
0x000000020000-0x000000120000 "kernel" /dev/mtdblock1
0x000000120000-0x0000007f0000 "rootfs" /dev/mtdblock2
0x000000600000-0x0000007f0000 "rootfs_data" /dev/mtdblock3
0x0000007f0000-0x000000800000 "art" /dev/mtdblock4
0x000000020000-0x0000007f0000 "firmware" /dev/mtdblock5

Serie U-Boot

WDR3600 v1.3 Start Log original U-Boot 1.1.4 (Jan 29 2013 - 16:09:44)

U-Boot 1.1.4 (Jan 29 2013 - 16:09:44)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds

Very quickly type tpl when the message Autobooting in 1 seconds appears

WDR3600 v1.3 U-boot help :

db12x> help

?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version

WDR3600 v1.3 U-boot printenv

db12x> printenv

bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 686/65532 bytes

Restoration of original firmware (without modifying U-Boot). The firmware must be 8,126,464 octets which correspond to a firmware without U-Boot. Today, firmwares TP-Link : wdr3600v1_en_3_13_23_up(120820), wdr3600v1_en_3_13_26_up(130129) and wdr3600v1_en_3_13_31_up(130320) come without U-Boot. The version used in the example is wdr3600v1_en_3_13_31_up(130320) on the WDR3600 v1.3

db12x> setenv ipaddr 192.168.0.144

db12x> setenv serverip 192.168.0.11

db12x> tftp 0x80060000 wdr3600v1_en_3_13_31_up(130320).bin

dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.11; our IP address is 192.168.0.144
Filename 'wdr3600v1_en_3_13_31_up(130320).bin'.
Load address: 0x80060000
Loading: *#################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ############################
done
Bytes transferred = 8126464 (7c0000 hex)

ATTENTION Only continue if the last line reads 8126464 (7c0000 hex)

db12x> erase 0x9f020000 +7c0000


First 0x2 last 0x7d sector size 0x10000

Erased 124 sectors
db12x> cp.b 0x80060000 0x9f020000 0x7c0000

Copy to Flash... write addr: 9f020000
done
db12x> reset

The router reboots


U-Boot 1.1.4 (Jan 29 2013 - 16:09:44)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

WDR3600 TP-Link Original Firmware Password

TL-WDR3600 login: root
Password: ???
Login incorrect
shadow hash password file : root:$1$GTN.gpri$DlSyKvZKMR9A9Uj9e9wR3/:15502:0:99999:7:::

Bootloader Mods

  1. you could read about bootloader in general and about Das U-Boot in particular.

U-Boot 1.1.4 modification for routers

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

Hardware

GPIO

port.GPIO

Partially based on → tl-wdr4300

Tested with hw version 1.5, BB r41181

Voltage level at GPIO in output-mode gpioX/value in input-mode when GPIO is:
GPIO Common Name PCB Name gpioX/value=1 gpioX/value=0 Floating Pulled to GND Pulled to Vcc
16 WPS Button
17 WiFi Switch

Read button without hotplug

rmmod gpio_button_hotplug
echo "16" > /sys/class/gpio/export
echo "17" > /sys/class/gpio/export
echo "in" > /sys/class/gpio/gpio16/direction
echo "in" > /sys/class/gpio/gpio17/direction

cat /sys/class/gpio/gpio16/value
cat /sys/class/gpio/gpio17/value

Hardware Modifications

USB Modification

The task was to make ext-root without using the default ports.

It turns out that the GL850G chipset used by the TP-Link in WDR3600/4300/4900 models can handle up to four ports.

Analysing the router's PCB it appears that pins 8(D-), 9(D+), 11(D-) and 12(D+) are unused. Aditionaly each factory USB port has separate power section.

GND is at the TP7 pin point. +5 V was taken directly from the MOSFET.

Photos

TP-Link TL-WDR3600 - PCB top layer TP-Link TL-WDR3600 - PCB bottom layer TP-Link TL-WDR3600 - PCB top layer - WLAN detail TP-Link TL-WDR3600 - PCB top layer - CPU detail

Custom OpenWrt image with LuCi integrated

Tags

Back to top

toh/tp-link/tl-wdr3600.txt · Last modified: 2014/08/24 18:03 by cruvolo