TP-Link TL-WDR4900

TP-Link TL-WDR4900 V2.x

Dual Band (concurrent) and Gigabit Ethernet. Advertised as 900 Mbps it has simultaneous Triple-Stream (3x3) radios on both 2.4GHz and 5 GHz Bands.

There are two very different revisions

  • V1.x: target: mpcC85xx 800Mhz Freescale PPC P1014 CPU 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz), available world-wide
  • V2.x: target: ar71xx 720Mhz Qualcomm/Atheros SoC and 6 external antennas, available in PRC only

Manufacturer's website:

As of May 2014, TP-Link appear to be discontinuing the TL-WDR4900 in Great Britain.

Supported Versions

Version/Model S/N Release Date OpenWrt Version Supported Model Specific Notes
v1.0 world-wide - 2013-01-22 trunk r36051 Freescale PPC w/2 Atheros radio chips 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz)
v1.3 world-wide - 2013 trunk http://downloads.openwrt.org/snapshots/trunk/mpc85xx/
v2.0 PRC only - 2013-01-22 trunk r39637 6 external antennas, available in PRC only. http://downloads.openwrt.org/snapshots/trunk/ar71xx/

Hardware

Info

Version 1.x Versions 2.x
Instruction set: PowerPC MIPS
Vendor: Freescale Semiconductor Qualcomm Atheros
Bootloader: U-Boot 2010.12-svn15934 for PowerPC U-Boot ? fork of mainline U-Boot version 1.1.4 (2005-12-17) for MIPS ?
System-On-Chip: Freescale MPC85xx QCA9558-AT4A
CPU/Speed PPC P1014@800MHz MIPS 74Kc Vers. 5.0 720 MHz
Flash-Chip: S25FL128S Winbond W25Q64FVSIG
Flash size: 16384 KiB 8192 KiB
RAM-Chip: H5TQ1G63DFR H5PS5162GFR
RAM size: 128 MiB 128 MiB
Wireless1: Chip: AR9381-AL1A w/ 3x3 MIMO for 2.4GHz SoC: QCA9558-AT4A w/ 3x3 MIMO for 2.4Ghz
Wireless2: Chip: AR9580-AR1A w/ 3x3 MIMO for 5Ghz Chip: AR9580-AR1A w/ 3x3 MIMO for 5Ghz
Switch: AR8327N-AL1A AR8327N-BL1A
USB: 2 (USB 2.0) 2 (USB 2.0)
Serial: Yes Yes
JTAG: Yes Yes

Photos

Version 1.x

wdr4900v1 serial

wdr4900v1 bottom

Version 2.0

wdr4900v2 serial

Serial console

Serial console is available on the JP2 (v1.x) or J1 (v2.0) connector - see PCB photos above.

DO NOT CONNECT VCC. Use only TX/RX/GND.

Baud Rate: 115200
Data Bits: 8
Parity: No
Stop Bits: 1

Factory firmware login credentials: (v1.x only)
* username: root
* password: 5up

Note: be extremely careful when soldering a serial console on TP-Link TL-WDR4900 - the design of the PCB is not well suited for soldering and important paths/connections are near the soldering points. We have now 3 Routers which are dead, just because we used too much solder…

Installation

OpenWRT may be installed via OEM firmware on both versions.

v1: openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-factory.bin

  • WARNING: At June, 2014, the last weeks Trunk has developed several bugs that cause Wifi unstability and/or disappearing, hangs and reboots.

v2: openwrt-ar71xx-generic-tl-wdr4900-v2-squashfs-factory.bin

  • If you do not speak chinese and are not familiar with the standard TP-Link firmware, please see the screen shots below for help.

After installation you will want to proceed with first login, basic configuration. You may also wish to install the web user interface LuCI, after which you can manage your router at http://192.168.1.1

Helpful Screenshots for installing from Chinese stock firmware

Upgrading from Stock Firwmare - Step 1

Upgrading from Stock Firwmare - Step 2

VLAN

To get tagged and untagged traffic working on the same port a patch for the switch driver is needed. Refer to: https://dev.openwrt.org/ticket/12181#comment:73

De-brick or OEM installation

Using TFTP + Serial method

Pre-requisites

  • a serial connection (e.g. TTL, RS232) from your machine to the router.
  • a terminal program (e.g. minicom, screen) set for 115200 Baud, 8 data bits, no parity, 1 stop bit, no flow control.
    • It is strongly recommended not to connect the 3.3V (or any) voltage line - use the router's own power supply instead.
  • a factory OpenWrt firmware image into your TFTP server folder (see Installation above)
  • a wired ethernet connection from your computer to one of the router's LAN ports.
    • IP address on this connection should be statically set to 192.168.1.x/24.
  • a TFTP server started on your local machine
    • must be listening on the same link/IP address as the wired ethernet connection to the router
    • v1.x models prefer the server address 192.168.0.66, v2.0 prefers 192.168.1.100

v1.x Flash Write Procedure

This section applies to v1.x only! (version 2.0 method)

  1. Router should be unplugged (power off), your serial line connected, terminal open and TFTP server installed not yet running.
  2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into openwrt.bin (to save some typing within the flash procedure).
  3. First goal is to get the command prompt from the U-Boot bootloader on your router.
  4. Plug in your router and be ready to type "vl" just after you see the line Autobooting in 1 seconds (Spamming "vl" around this point helps):

U-Boot 2010.12-svn15934 (Dec 11 2012 - 16:23:49)

CPU:   P1014, Version: 1.0, (0x80f10110)
Core:  E500, Version: 5.1, (0x80212151)
Clock Configuration:
       CPU0:800  MHz, 
       CCB:400  MHz,
       DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100  MHz
L1:    D-cache 32 kB enabled
       I-cache 32 kB enabled
Board: P1014RDB 
SPI:   ready
DRAM:  128 MiB
L2:    256 KB enabled
Using default environment

PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000
  01:00.0     - 168c:abcd - Network controller
PCIe1: Bus 00 - 01
PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000
  03:00.0     - 168c:0033 - Network controller
PCIe2: Bus 02 - 03
In:    serial
Out:   serial
Err:   serial
Net:   initialization for Atheros AR8327/AR8328
AR8327/AR8328 v1.1 is found!
eTSEC1
Autobooting in 1 seconds

In case you failed the right timing just reboot again until the prompt appears

=>

  1. (optional) Now lets check what kind of parameters the u-boot loader expects (e.g file name of firmware, IP via TFTP & load address).

Type tftpboot & press ENTER …

=> tftpboot
Check for phy link status
Speed: 1000, full duplex
Using eTSEC1 device
TFTP from server 192.168.0.104; our IP address is 192.168.0.136
Filename 'uImage'.
Load address: 0x1000000
Loading: T T T T T T T T T T 
Retry count exceeded; starting again

  1. As you can see, uboot expects a firmware image file name "uImage" at TFTP server address 192.168.1.104,

then, just change you local ip into 192.168.1.104 and start your TFTP server.

  1. Start the uBoot's TFTP client to download the image from your local machine by typing: tftpboot 0x1000000 openwrt.bin + ENTER

=> tftpboot 0x1000000 openwrt.bin
Check for phy link status
Speed: 1000, full duplex
Using eTSEC1 device
TFTP from server 192.168.0.104; our IP address is 192.168.0.136
Filename 'openwrt.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
done
Bytes transferred = 16252928 (f80000 hex)

  1. The last line needs to show a size of f80000 hex, otherwise your image is unsuitable.
  2. To select the SPI flash memory type: sf probe 0

=> sf probe 0
SF: Detected S25FL128S_65k with page size 256, total 16 MiB
16384 KiB S25FL128S_64K at 0:0 is now current device

  1. Now we need to erase parts of the flash memory to be able to copy your fresh loaded firmware into it,

just type in the prompt sf erase 0x60000 0xf80000:

=> sf erase 0x60000 0xf80000
SPI flash erase successful

  1. Now just copy the image to the right place by typing sf write 0x1000000 0x60000 0xf80000

=> sf write 0x1000000 0x60000 0xf80000
SPI flash write successful

  1. So, in case your image is the correct one, you should do just a single reboot to have a working TL-WRD4900 back on your desk.

Type reset or just un-plug and re-plug the power of your router and watch the boot process.

=> reset

v2.0 Flash Write Procedure

This section applies to v2.0 only! (version 1.x method)

  1. Be sure the router is powered off (there's a handy power switch beside the power line).
  2. Connect your serial and ethernet cables to your computer.
  3. Open your terminal for the serial connection.
  4. Power on the router
  5. When you see Autobooting in 1 seconds, quickly type "tpl" to access the command line.
    • there is no harm at all typing "tpl" repeatedly from the moment you power on, I often start when I see the U-Boot bootloader header. ;-)
  6. Start the TFTP server running on your computer.
  7. At the ap135> prompt, type the following commands:
    1. tftpboot 0x81000000 openwrt.bin (where openwrt.bin is the name of your firmware image)
    2. erase 0x9f020000 +0x7c0000
    3. cp.b 0x81000000 0x9f020000 0x7c0000
    4. bootm 0x9f020000
  8. Congratulations!

Reset Button Method (no serial cable needed)

If you want to de-brick/upgrade your router using TFTP without a serial cable follow these steps:

Pre-requisites

Procedure

  1. Router should be unplugged (power off) and TFTP server installed not yet running.
  2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into wdr4900v1_tp_recovery.bin (as the router will search for this file).
  3. Make sure your card has address 192.168.0.66.
  4. Start the tftp server and make sure it is listening on 192.168.0.66
  5. Plug in your router and keep the WPS/Reset button pressed until the tftp server confirms the transfer is done
  6. Wait for the router to reboot, the new image will then be loaded
  7. A pack ready for doing this, containing TFTPD32 server and the latest TP-Link firmware, can be found here: https://forum.openwrt.org/viewtopic.php?pid=236428#p236428
  8. Also there's a video of the process: http://www.youtube.com/watch?v=54PAS0gvW2k

Failsafe / reset

After all else failed, I found http://www.binaryfriend.ru/2012/10/how-to-hard-reset-openwrt-on-tp-link-1043nd. Extremely simple. Please see the original page for more info. Summary:

  1. Power the router up;
  2. After powering up track the SYS light when it starts to blink, when it does press and hold the QSS button till SYS lights starts to blink faster – router goes to recovery mode;
  3. Telnet to the router on 192.168.1.1 – no password needed (if your computer doesn’t gets IP address from DHCP assign it manually for i.e. 192.168.1.200 with netmask of 255.255.255.0);
  4. In telnet terminal type `mtd -r erase rootfs_data` to reset OpenWRT to it’s defaults.

Reverting to stock firmware

You can revert to stock firmware by following these steps:

Note: You can only flash this firmware version because it has no BOOT in the filename. This image and OpenWRT images are the exact same size. Other images from TP-Link do have BOOT in the filename and these files are also more bytes than this one.

Specific Configuration

==== Switch Ports (for VLANs) ==== WDR4900 v1?

Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 0 is the internal connection to the router itself.

Port Switch port
CPU 0
WAN 1
LAN 1 2
LAN 2 3
LAN 3 4
LAN 4 5
(not used ?) 6

==== Switch Ports (for VLANs) ==== WDR4900 v2

Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 6 is the internal connection to the router itself, and 0 is another CPU, because this router has two.

Port Switch port
Second CPU 0
WAN 1
LAN 1 2
LAN 2 3
LAN 3 4
LAN 4 5
CPU 6

==== Luci WDR4900v2 (Example Vlans tag for Movistar FTTH Spain)

tplink_wdr4900v2_switch_vlan_tagg.jpg

Other Information Resources

Back to top

toh/tp-link/tl-wdr4900.txt · Last modified: 2014/06/29 23:48 by dabyd64