Differences

This shows you the differences between two versions of the page.

toh:tp-link:tl-wdr3600 [2013/01/30 19:25]
allan.wegan Better photo, +PCB bottom, +chip details
toh:tp-link:tl-wdr3600 [2014/07/02 08:44] (current)
fbis251 Use real URL instead of Adf.ly link for TL-WDR3600-V1-stripped.zip
Line 1: Line 1:
======TP-Link TL-WDR3600====== ======TP-Link TL-WDR3600======
Dual Band (concurrent) and Gigabit Ethernet. Dual Band (concurrent) and Gigabit Ethernet.
-Advertised as 600 Mbps it is Dual-Stream (2x2) on the 2.4 Ghz Band and Dual-Stream (2x2) on the 5 Ghz Band.+Advertised as 600 Mbps it is Dual-Stream (2x2) on the 2.4 Ghz Band and Dual-Stream (2x2) on the 5 Ghz Band. This wiki entry is fairly brief, but most things in the [[.:TL-WDR4300|TP-Link TL-WDR4300]] wiki entry apply here.
===== Supported Versions ===== ===== Supported Versions =====
^ Version/Model ^Release Date ^ OpenWrt Version Supported ^ Model Specific Notes ^ ^ Version/Model ^Release Date ^ OpenWrt Version Supported ^ Model Specific Notes ^
-| 1.1 | 2012/07| trunk [[https://dev.openwrt.org/changeset/33219|r33219]] | Similar to [[.:TL-WDR4300|TP-Link TL-WDR4300]] |+| 1.1 | 2012/07| Attitude Adjustment 12.09 works fine (since trunk [[https://dev.openwrt.org/changeset/33219|r33219]]) | Similar to [[.:TL-WDR4300|TP-Link TL-WDR4300]]
 +| 1.2 | | Attitude Adjustment 12.09 seems to work | LEDs blue| 
 +| 1.3 | | Attitude Adjustment 12.09 + wifi patch, or trunk ([[https://dev.openwrt.org/changeset/39392|r39392]]), | LEDs blue| 
 +| 1.4 | July 2013 | Attitude Adjustment 12.09 + wifi patch , or trunk ([[https://dev.openwrt.org/changeset/39392|r39392]])| LEDs now green, not blue| 
 +| 1.5 | December 2013 | Attitude Adjustment 12.09 + wifi patch , or trunk ([[https://dev.openwrt.org/changeset/39392|r39392]])| LEDs now green, not blue|
-==== Info ====+The latest firmware available is the release build [[http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/|Attitude Adjustment 12.09]] or the trunk build [[http://downloads.openwrt.org/snapshots/trunk/ar71xx/|Barrier Breaker]], with working ethernet and dual-band wireless (disabled by default). If your wireless cannot be enabled when using wide channel modes, this may be due to the friendly neighbour "feature" that prohibits operation of such a mode and you may have to use the standard modes before wireless can be enabled. For some people radio0 works only when radio2 is also enabled.   
 + 
 +===== Info =====
| **[[wp>Instruction set|Architecture]]:**    | [[wp>MIPS architecture|MIPS]] MIPS 74Kc | | **[[wp>Instruction set|Architecture]]:**    | [[wp>MIPS architecture|MIPS]] MIPS 74Kc |
| **Vendor:**          | [[wp>Qualcomm Atheros]] | | **Vendor:**          | [[wp>Qualcomm Atheros]] |
Line 16: Line 22:
| **Flash size:**      | 8192 KiB | | **Flash size:**      | 8192 KiB |
| **RAM:**            | 128 MiB  | | **RAM:**            | 128 MiB  |
-| **Wireless:**        | Atheros AR9340 2.4GHz 802.11bgn | Atheros AR9582 5GHz 802.11an | +| **Wireless No1:**        | Atheros AR9340 2.4GHz 802.11bgn
-| **Ethernet:**        | Atheros AR8327N Gigabit Switch | +| **Wireless No2:**        | Atheros AR9582 5GHz 802.11an | 
-| **USB:**            | Yes 2 x 2.0     |+| **[[doc:hardware:Switch]]:**        | Atheros AR8327N Gigabit Switch | 
 +| **USB:**            | Yes 2 x 2.0 (GL850G chip - 4 port's capable) |
-==== Switch Ports (for VLANs) ====+===== Switch Ports (for VLANs) =====
^ Port ^ Switch port ^ ^ Port ^ Switch port ^
Line 31: Line 38:
| unknown | 6 | | unknown | 6 |
-==== Photos ====+The switch driver refuses to configure a port with tagged and non-tagged VLANs. 
 +It is possible to tag multiple VLANs on the same ports: 
 +<code> 
 +root@OpenWrt:/# swconfig 
 +swconfig dev <dev> [port <port>|vlan <vlan>] (help|set <key> <value>|get <key>|load <config>|show) 
 + 
 +root@OpenWrt:/# swconfig dev switch0 help 
 +switch0: eth0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128 
 +    --switch 
 +        Attribute 1 (int): enable_vlan (Enable VLAN mode) 
 +        Attribute 2 (none): reset_mibs (Reset all MIB counters) 
 +        Attribute 3 (none): apply (Activate changes in the hardware) 
 +        Attribute 4 (none): reset (Reset the switch) 
 +    --vlan 
 +        Attribute 1 (int): vid (VLAN ID (0-4094)) 
 +        Attribute 2 (ports): ports (VLAN port mapping) 
 +    --port 
 +        Attribute 1 (none): reset_mib (Reset single port MIB counters) 
 +        Attribute 2 (string): mib (Get port's MIB counters) 
 +        Attribute 3 (int): pvid (Primary VLAN ID) 
 +        Attribute 4 (string): link (Get port link information) 
 +</code> 
 +OpenWRT switch configuration Eth0.1 = LAN et Eth0.2 = WAN 
 +<code> 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 show 
 +VLAN 1: 
 +        vid: 1 
 +        ports: 0t 2 3 4 5 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 show 
 +VLAN 2: 
 +        vid: 2 
 +        ports: 0t 1 
 +</code> 
 +Tag of port 5 on VLANs 1 and 2 successful: 
 +<code> 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4 5t" 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 show 
 +VLAN 1: 
 +        vid: 1 
 +        ports: 0t 2 3 4 5t 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 show 
 +VLAN 2: 
 +        vid: 2 
 +        ports: 0t 1 
 + 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 5t" 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 show 
 +VLAN 1: 
 +        vid: 1 
 +        ports: 0t 2 3 4 5t 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 show 
 +VLAN 2: 
 +        vid: 2 
 +        ports: 0t 1 5t 
 +</code> 
 +Tag port 4 in VLAN 1, and untag port 4 in VLAN 2: __**Error, port 4 is removed from VLAN 1**__ 
 +<code> 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 set ports "0t 2 3 4t 5t" 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 show 
 +VLAN 1: 
 +        vid: 1 
 +        ports: 0t 2 3 4t 5t 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 show 
 +VLAN 2: 
 +        vid: 2 
 +        ports: 0t 1 5t 
 + 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 set ports "0t 1 4 5t" 
 +root@OpenWrt:/# swconfig dev switch0 vlan 1 show 
 +VLAN 1: 
 +        vid: 1 
 +        ports: 0t 2 3 5t 
 +root@OpenWrt:/# swconfig dev switch0 vlan 2 show 
 +VLAN 2: 
 +        vid: 2 
 +        ports: 0t 1 4 5t 
 +root@OpenWrt:/# 
 +</code> 
 + 
 + 
 + 
 + 
 +=====Back to stock firmware===== 
 +-> [[doc:howto:generic.uninstall]] 
 + 
 +{{page>meta:infobox:dangerous&noheader&nofooter&noeditbtn}} 
 + 
 +With the TL-WR3600 router, there is a catch: the stock firmware is obtained from the OEM: http://www.tplink.com/en/support/download/?model=TL-WDR3600 
 + 
 +  * in case the file name of this firmware file does not contain the word **//"boot"//** in it, you can simply revert back to original firmware 
 +  * in case the file name of this firmware file does contain the word **//"boot"//** in it, you need to cut off parts of the image file //before// flashing it: 
 + 
 + 
 +An example of an image file with the word "boot" in it is ''wdr3600v1_en_3_13_34_up_boot(130909).bin''. 
 + 
 +Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware: 
 +<code> 
 +dd if=orig.bin of=tplink.bin skip=257 bs=512 
 +</code> 
 + 
 +You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well): 
 + 
 +Via the safer method using sysupgrade: 
 +<code> 
 +sysupgrade /tmp/tplink.bin 
 +</code> 
 + 
 +Or alternatively you can use the mtd method: 
 +<code> 
 +mtd -r write /tmp/tplink.bin firmware 
 +</code> 
 + 
 + 
 +OEM TP-Link firmware for the TL-WDR3600 with the **//boot part removed//** to revert to the original OEM firmware: 
 +  * TL-WDR3600 **//V1//** [[https://doc-00-90-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/c36h9lrqa3uje80ocfen4eukk7m18l36/1404280800000/12847632745586542482/*/0B-pEMb4uQtg8d2Q3OUEwbUxOVmM?h=16653014193614665626&e=download|TL-WDR3600-V1-stripped.zip]] 
 + 
 +==== Useful Information about Stock Firmware ==== 
 + 
 +Updated versions of stock firmware have [[https://forum.openwrt.org/viewtopic.php?id=46371|Firmware Recovery Mode]]. Recommend upgrading latest stock firmware before flashing to OpenWrt for the first time so you can utilise this if necessary. 
 + 
 +===== Flash Layout ===== 
 + 
 +| 0x000000000000-0x000000020000 | "u-boot" | /dev/mtdblock0 | 
 +| 0x000000020000-0x000000120000 | "kernel" | /dev/mtdblock1 | 
 +| 0x000000120000-0x0000007f0000 | "rootfs" | /dev/mtdblock2 | 
 +| 0x000000600000-0x0000007f0000 | "rootfs_data" | /dev/mtdblock3 | 
 +| 0x0000007f0000-0x000000800000 | "art" | /dev/mtdblock4 | 
 +| 0x000000020000-0x0000007f0000 | "firmware" | /dev/mtdblock5 | 
 + 
 +===== Serie U-Boot ===== 
 + 
 +WDR3600 v1.3 Start Log original U-Boot 1.1.4 (Jan 29 2013 - 16:09:44) 
 +<code> 
 +U-Boot 1.1.4 (Jan 29 2013 - 16:09:44) 
 + 
 +U-boot DB120 
 + 
 + 
 +DRAM:  128 MB 
 +id read 0x100000ff 
 +flash size 8MB, sector count = 128 
 +Flash:  8 MB 
 +Using default environment 
 + 
 +PCIe Reset OK!!!!!! 
 +In:    serial 
 +Out:  serial 
 +Err:  serial 
 +Net:  ag934x_enet_initialize... 
 +No valid address in Flash. Using fixed address 
 + wasp  reset mask:c03300  
 +WASP  ----> S17 PHY * 
 +: cfg1 0x7 cfg2 0x7114 
 +eth0: ba:be:fa:ce:08:41 
 +athrs17_reg_init: complete 
 +eth0 up 
 +eth0 
 +Autobooting in 1 seconds 
 +</code> 
 + 
 +Very quickly type **tpl** when the message **Autobooting in 1 seconds** appears 
 + 
 +WDR3600 v1.3 U-boot  help : 
 + 
 +<code> 
 +db12x> help 
 + 
 +?      - alias for 'help' 
 +bootm  - boot application image from memory 
 +cp      - memory copy 
 +erase  - erase FLASH memory 
 +help    - print online help 
 +md      - memory display 
 +mm      - memory modify (auto-incrementing) 
 +mtest  - simple RAM test 
 +mw      - memory write (fill) 
 +nm      - memory modify (constant address) 
 +ping - send ICMP ECHO_REQUEST to network host 
 +printenv- print environment variables 
 +progmac - Set ethernet MAC addresses 
 +reset  - Perform RESET of the CPU 
 +setenv  - set environment variables 
 +tftpboot- boot image via network using TFTP protocol 
 +version - print monitor version 
 +</code> 
 + 
 +WDR3600 v1.3  U-boot printenv  
 +<code> 
 +db12x> printenv 
 + 
 +bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART) 
 +bootcmd=bootm 0x9f020000 
 +bootdelay=1 
 +baudrate=115200 
 +ethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41 
 +ipaddr=192.168.1.111 
 +serverip=192.168.1.100 
 +dir= 
 +lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize 
 +lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize 
 +lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize 
 +stdin=serial 
 +stdout=serial 
 +stderr=serial 
 +ethact=eth0 
 + 
 +Environment size: 686/65532 bytes 
 +</code> 
 + 
 +Restoration of original firmware (without modifying U-Boot). 
 +**The firmware must be 8,126,464** octets which correspond to a firmware without U-Boot. 
 +Today, firmwares TP-Link : wdr3600v1_en_3_13_23_up(120820), wdr3600v1_en_3_13_26_up(130129) and 
 +wdr3600v1_en_3_13_31_up(130320) come without U-Boot. 
 +The version used in the example is wdr3600v1_en_3_13_31_up(130320) on the WDR3600 v1.3 
 + 
 +<code> 
 +db12x> setenv ipaddr 192.168.0.144 
 + 
 +db12x> setenv serverip 192.168.0.11 
 + 
 +db12x> tftp 0x80060000 wdr3600v1_en_3_13_31_up(130320).bin 
 + 
 +dup 1 speed 1000 
 +Using eth0 device 
 +TFTP from server 192.168.0.11; our IP address is 192.168.0.144 
 +Filename 'wdr3600v1_en_3_13_31_up(130320).bin'. 
 +Load address: 0x80060000 
 +Loading: *################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ################################################################# 
 + ############################ 
 +done 
 +Bytes transferred = 8126464 (7c0000 hex) 
 +</code> 
 + 
 +ATTENTION Only continue if the last line reads **8126464 (7c0000 hex)** 
 + 
 +<code> 
 +db12x> erase 0x9f020000 +7c0000 
 + 
 + 
 +First 0x2 last 0x7d sector size 0x10000 
 + 
 +Erased 124 sectors 
 +db12x> cp.b 0x80060000 0x9f020000 0x7c0000 
 + 
 +Copy to Flash... write addr: 9f020000 
 +done 
 +db12x> reset 
 +</code> 
 + 
 +The router reboots 
 + 
 +<code> 
 + 
 +U-Boot 1.1.4 (Jan 29 2013 - 16:09:44) 
 + 
 +U-boot DB120 
 + 
 + 
 +DRAM:  128 MB 
 +id read 0x100000ff 
 +flash size 8MB, sector count = 128 
 +Flash:  8 MB 
 +Using default environment 
 + 
 +PCIe Reset OK!!!!!! 
 +In:    serial 
 +Out:  serial 
 +Err:  serial 
 +Net:  ag934x_enet_initialize... 
 +No valid address in Flash. Using fixed address 
 + wasp  reset mask:c03300  
 +WASP  ----> S17 PHY * 
 +: cfg1 0x7 cfg2 0x7114 
 +eth0: ba:be:fa:ce:08:41 
 +athrs17_reg_init: complete 
 +eth0 up 
 +eth0 
 +Autobooting in 1 seconds 
 +## Booting image at 9f020000 ... 
 +  Uncompressing Kernel Image ... OK 
 + 
 +Starting kernel ... 
 + 
 +</code> 
 + 
 +WDR3600 TP-Link Original Firmware Password 
 +<code> 
 +TL-WDR3600 login: root 
 +Password: ??? 
 +Login incorrect 
 +</code> 
 +shadow hash password file : root:$1$GTN.gpri$DlSyKvZKMR9A9Uj9e9wR3/:15502:0:99999:7::: 
 + 
 +===== Bootloader Mods ===== 
 +  - you could read about [[doc:techref:bootloader]] in general and about [[doc:techref:bootloader:uboot|Das U-Boot]] in particular. 
 + 
 +==== U-Boot 1.1.4 modification for routers ==== 
 +Forum member [[https://forum.openwrt.org/profile.php?id=72549|pepe2k]] made a modification of **U-Boot 1.1.4** for **Qualcomm Atheros** SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official [[https://github.com/pepe2k/u-boot_mod|GitHub repository]]. 
 + 
 +This modification started from [[http://code.google.com/p/wr703n-uboot-with-web-failsafe/|wr703n-uboot-with-web-failsafe]] project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.). 
 + 
 +More information: 
 + 
 +  * Official repository on GitHub: [[https://github.com/pepe2k/u-boot_mod|U-Boot 1.1.4 modification for routers]] 
 +  * Discussion about this project on [[https://forum.openwrt.org/viewtopic.php?id=43237|OpenWrt forum]] 
 +  * An article (in Polish) about one of the first version of this project on [[http://www.tech-blog.pl/2013/03/29/zmodyfikowany-u-boot-dla-routerow-tp-link-z-atheros-ar9331-z-trybem-aktualizacji-oprogramowania-przez-www-i-konsola-sieciowa-netconsole/|www.tech-blog.pl]] 
 + 
 + 
 +===== Hardware ===== 
 +==== GPIO ==== 
 +-> [[doc:hardware:port.GPIO]] 
 + 
 +Partially based on -> [[toh:tp-link:tl-wdr4300]] 
 + 
 +Tested with hw version 1.5, BB r41181 
 + 
 +^        ^              ^            ^  Voltage level at GPIO in output-mode  ^^  gpioX/value in input-mode when GPIO is: ^^^ 
 +^  GPIO  ^  Common Name  ^  PCB Name  ^  gpioX/value=1  ^ gpioX/value=0        ^  Floating  ^  Pulled to GND  ^  Pulled to Vcc  ^ 
 +|    16 | WPS Button  |            |                |                      |            |                |                  | 
 +|    17 | WiFi Switch  |            |                |                      |            |                |                  | 
 + 
 +=== Read button without hotplug === 
 + 
 +<code>rmmod gpio_button_hotplug 
 +echo "16" > /sys/class/gpio/export 
 +echo "17" > /sys/class/gpio/export 
 +echo "in" > /sys/class/gpio/gpio16/direction 
 +echo "in" > /sys/class/gpio/gpio17/direction</code> 
 + 
 +<code>cat /sys/class/gpio/gpio16/value 
 +cat /sys/class/gpio/gpio17/value</code> 
 + 
 +===== Hardware Modifications ===== 
 + 
 + 
 +==== USB Modification ==== 
 + 
 +The task was to make ext-root without using the default ports. 
 + 
 +It turns out that the GL850G chipset used by the TP-Link in WDR3600/4300/4900 models can handle up to four ports. 
 + 
 +{{:media:gl850g.png|}} 
 + 
 +Analysing the router's PCB it appears that pins 8(D-), 9(D+), 11(D-) and 12(D+) are unused.   
 +Aditionaly each factory USB port has separate power section. 
 + 
 +GND is at the TP7 pin point. +5 V was taken directly from the MOSFET. 
 + 
 +{{:media:tplinkwrd3600-usbmod-small.jpg|}} 
 +{{:media:tplinkwrd3600-usbmod1-small.jpg|}} 
 + 
 +===== Photos =====
{{:media:tp-link.tl-wdr3600.-.board.top.side.-.lofi.jpg}} {{:media:tp-link.tl-wdr3600.-.board.top.side.-.lofi.jpg}}
{{:media:tp-link.tl-wdr3600.-.board.bottom.side.-.lofi.jpg}} {{:media:tp-link.tl-wdr3600.-.board.bottom.side.-.lofi.jpg}}

Back to top

toh/tp-link/tl-wdr3600.1359570311.txt.bz2 · Last modified: 2013/01/30 19:25 by allan.wegan