Dual Band (concurrent) and Gigabit Ethernet. Advertised as 900 Mbps it has simultaneous Triple-Stream (3x3) radios on both 2.4GHz and 5 GHz Bands.
There are two very different revisions
mpcC85xx
800Mhz Freescale PPC P1014 CPU 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz), available world-wide ar71xx
720Mhz Qualcomm/Atheros SoC and 6 external antennas, available in PRC onlyManufacturer's website:
As of May 2014, TP-Link appear to be discontinuing the TL-WDR4900 in Great Britain.
Version/Model | S/N | Release Date | OpenWrt Version Supported | Model Specific Notes |
---|---|---|---|---|
v1.0 world-wide | - | 2013-01-22 | Barrier Breaker 14.07 | Freescale PPC w/2 Atheros radio chips 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz) |
v1.3 world-wide | - | 2013 | Barrier Breaker 14.07 or later | |
v2.0 PRC only | - | 2013-01-22 | Chaos Calmer 15.05.1 | 6 external antennas, available in PRC only. |
Version 1.x | Versions 2.x | |
---|---|---|
Instruction set: | PowerPC | MIPS |
Vendor: | Freescale Semiconductor | Qualcomm Atheros |
TP-Link prod.page: | N900 | |
Bootloader: | U-Boot 2010.12-svn15934 for PowerPC | U-Boot ? fork of mainline U-Boot version 1.1.4 (2005-12-17) for MIPS ? |
System-On-Chip: | Freescale MPC85xx | QCA9558-AT4A |
CPU/Speed | PPC P1014@800MHz | MIPS 74Kc Vers. 5.0 720 MHz |
Flash-Chip: | S25FL128S | Winbond W25Q64FVSIG |
Flash size: | 16384 KiB | 8192 KiB |
RAM-Chip: | H5TQ1G63DFR | H5PS5162GFR |
RAM size: | 128 MiB | 128 MiB |
Wireless1: | Chip: AR9381-AL1A w/ 3x3 MIMO for 2.4GHz | SoC: QCA9558-AT4A w/ 3x3 MIMO for 2.4Ghz |
Wireless2: | Chip: AR9580-AR1A w/ 3x3 MIMO for 5Ghz | Chip: AR9580-AR1A w/ 3x3 MIMO for 5Ghz |
Switch: | AR8327N-AL1A | AR8327N-BL1A |
USB: | 2 (USB 2.0) | 2 (USB 2.0) |
Serial: | Yes | Yes |
JTAG: | Yes | Yes |
Antennas]: | 3 external, 3 internal(2.4GHz) | 6 external |
Serial console is available on the JP2 (v1.x) or J1 (v2.0) connector - see PCB photos above.
DO NOT CONNECT VCC. Use only TX/RX/GND.
Baud Rate: 115200
Data Bits: 8
Parity: No
Stop Bits: 1
Factory firmware login credentials: (v1.x only)
* username: root
* password: 5up
Note:
be extremely careful when soldering a serial console on TP-Link TL-WDR4900 - the design of the PCB is not well suited for soldering and important paths/connections are near the soldering points. We have now 3 Routers which are dead, just because we used too much solder…
An OpenWrt factory image may be installed via the OEM firmware on both versions. See the generic installation guide for further information. Download the latest stable release of the following firmware images:
If you do not speak Chinese and are not familiar with the standard TP-Link firmware, please see the screen shots below for help.
After installation you will want to proceed with first login, basic configuration. You may also wish to install the web user interface LuCI, after which you can manage your router at http://192.168.1.1
This section applies to v1.x only! (version 2.0 method)
openwrt.bin
(to save some typing within the flash procedure).vl
" just after you see the line Autobooting in 1 seconds
(Spamming "vl
" around this point helps):
U-Boot 2010.12-svn15934 (Dec 11 2012 - 16:23:49) CPU: P1014, Version: 1.0, (0x80f10110) Core: E500, Version: 5.1, (0x80212151) Clock Configuration: CPU0:800 MHz, CCB:400 MHz, DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100 MHz L1: D-cache 32 kB enabled I-cache 32 kB enabled Board: P1014RDB SPI: ready DRAM: 128 MiB L2: 256 KB enabled Using default environment PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000 01:00.0 - 168c:abcd - Network controller PCIe1: Bus 00 - 01 PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000 03:00.0 - 168c:0033 - Network controller PCIe2: Bus 02 - 03 In: serial Out: serial Err: serial Net: initialization for Atheros AR8327/AR8328 AR8327/AR8328 v1.1 is found! eTSEC1 Autobooting in 1 seconds
In case you failed the right timing just reboot again until the prompt appears
=>
Type tftpboot
& press ENTER …
=> tftpboot Check for phy link status Speed: 1000, full duplex Using eTSEC1 device TFTP from server 192.168.0.104; our IP address is 192.168.0.136 Filename 'uImage'. Load address: 0x1000000 Loading: T T T T T T T T T T Retry count exceeded; starting again
uImage
" at TFTP server address 192.168.0.104
,
then, just change you local ip into 192.168.0.104
and start your TFTP server.
tftpboot 0x1000000 openwrt.bin
+ ENTER
=> tftpboot 0x1000000 openwrt.bin Check for phy link status Speed: 1000, full duplex Using eTSEC1 device TFTP from server 192.168.0.104; our IP address is 192.168.0.136 Filename 'openwrt.bin'. Load address: 0x1000000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ### done Bytes transferred = 16252928 (f80000 hex)
=> sf probe 0 SF: Detected S25FL128S_65k with page size 256, total 16 MiB 16384 KiB S25FL128S_64K at 0:0 is now current device
just type in the prompt sf erase 0x60000 0xf80000
:
=> sf erase 0x60000 0xf80000 SPI flash erase successful
sf write 0x1000000 0x60000 0xf80000
=> sf write 0x1000000 0x60000 0xf80000 SPI flash write successful
Type reset
or just un-plug and re-plug the power of your router and watch the boot process.
=> reset
This section applies to v2.0 only! (version 1.x method)
Autobooting in 1 seconds
, quickly type "tpl
" to access the command line.tpl
" repeatedly from the moment you power on, I often start when I see the U-Boot bootloader header. ap135>
prompt, type the following commands:tftpboot 0x81000000 openwrt.bin
(where openwrt.bin is the name of your firmware image)erase 0x9f020000 +0x7c0000
cp.b 0x81000000 0x9f020000 0x7c0000
bootm 0x9f020000
If you want to de-brick/upgrade your router using TFTP without a serial cable follow these steps:
wdr4900v1_tp_recovery.bin
(as the router will search for this file).
TFTP server log may contain info about firmware image name that router requested. Something like:
Read request for file <wr841nv8_tp_recovery.bin> . Mode octet [21/11 09:45:27.574]
On the v1 units, the only way that I have been able to get the router into failsafe mode is to quickly and repeatedly press the WPS/Reset button starting before the front panel "star" LED started flashing. When that LED finally lit, it appeared to go directly into the rapid-flashing "failsafe" indication. If the WPS LED lights (rightmost, "yin-yang arrows"), it may be that you started clicking the button a little early in the boot sequence.
For what you can do in failsafe, go to the OpenWrt Failsafe Mode page.
Another user writes:
After all else failed, I found http://www.binaryfriend.ru/2012/10/how-to-hard-reset-openwrt-on-tp-link-1043nd. Extremely simple. Please see the original page for more info. Summary:
- Power the router up;
- After powering up track the SYS light when it starts to blink, when it does press and hold the QSS button till SYS lights starts to blink faster – router goes to recovery mode;
- Telnet to the router on 192.168.1.1 – no password needed (if your computer doesn’t gets IP address from DHCP assign it manually for i.e. 192.168.1.200 with netmask of 255.255.255.0);
- In telnet terminal type `mtd -r erase rootfs_data` to reset OpenWrt to it’s defaults.
You can revert to stock firmware by following these steps:
Note: You can only flash this firmware version because it has no BOOT in the filename. This image and OpenWrt images are the exact same size. Other images from TP-Link do have BOOT in the filename and these files are also more bytes than this one, then to create your own flashable image, follow the below method:
In order to create your own bootable file download firmware from TP-Link and execute the following command (change the if= filename in case you downloaded a different version):
You can then transfer the resulting file and flash this using the mtd method described elsewhere in this document.
Using the same switch port for both tagged and untagged traffic works on this router (used for instance in IP-TV). Previous versions of OpenWrt required a patch for the switch driver (see the related ticket). In 15.05 this is no longer needed; VLAN works out of the box.
Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 0 is the internal connection to the router itself.
Port | Switch port |
---|---|
CPU | 0 |
WAN | 1 |
LAN 1 | 2 |
LAN 2 | 3 |
LAN 3 | 4 |
LAN 4 | 5 |
(not used ?) | 6 |
Numbers 2-5 are Ethernet Ports 1-4 as labeled on the unit, number 1 is "Internet" (WAN) on the unit, 6 is the internal connection to the router itself, and 0 is another CPU, because this router has two.
Port | Switch port |
---|---|
Second CPU | 0 |
WAN | 1 |
LAN 1 | 2 |
LAN 2 | 3 |
LAN 3 | 4 |
LAN 4 | 5 |
CPU | 6 |
Hardware port mirroring is supported in v1/(v2?)
Here's an example of configuring port mirroring in /etc/config/network for mirroring port 1 to port 5 (You may need to restart the router for port mirroring changes to take effect):
config switch option name 'switch0' option reset '1' option enable_vlan '1' option enable_mirror_rx '1' option enable_mirror_tx '1' option mirror_source_port '1' option mirror_monitor_port '5'
In case you are interested to run a virtual test environment for your PPC based WDR4900 platform QEMU is a good helper. It cannot run the downloadable kernel image but at least a slightly modfied version. Here are the basic steps to get a initial setup up and runnung.
Install QEMU for your Linux distribution. It should be at least 2.1.2. The process was only tested with that version. Create a buildroot environment. If you do not want to read every single bit of information over there use these commands. We assume that we only want to build the stable Barrier Breaker version.
# cd ~ # mkdir buildroot # cd buildroot # git clone git://git.openwrt.org/14.07/openwrt.git # cd openwrt # ./scripts/feeds update -a # ./scripts/feeds install -a
Select your target platform
# make menuconfig Target System -> Freescale MPC85xx [*]
Save changes and leave setup. Create the default configuration for the platform
# make defconfig
Activate some essential buildroot configuration options.
# make menuconfig Target images -> ramdisk [*] Kernel modules -> filesystems -> kmod-fs-ext4 [*]
Save changes and leave setup. Now head over to kernel configuration and define critical settings that the kernel can run inside QEMU.
# make kernel_menuconfig Platform support -> Freescale machine type -> qemu generic platform [*] device drivers -> character devices -> serial drivers -> serial port on open plaform bus [ ]
If you miss one of the two your VM will not boot or have no accessible console. Have a look the open firmware serial bus must be disabled!. Additionally we should enable drivers to access QEMU disks and network cards
device drivers -> virtio drivers -> activate all menu items [*] device drivers -> block devices -> Virtio block driver [*] device drivers -> network device support -> virtio network driver [*]
Create the kernel image with
make -j 8
Finally we have a standalone kernel image with an initial root ramdisk included. So we could already start the VM. To get into better shape create a separate folder to hold the image and create a QCOW2 disk with a single ext4 filesystem that can be mounted inside the VM.
# cd ~ # mkdir vm # cd vm # cp ~/buildroot/openwrt/bin/mpc85xx/openwrt-mpc85xx-generic-zImage . # qemu-img create -f qcow2 hdd.qcow2 4G # su # modprobe nbd max_part=8 # qemu-nbd --connect=/dev/nbd0 ./hdd.qcow2 # fdisk /dev/nbd0 (... create partition ...) # mkfs.ext4 /dev/nbd0p1 # qemu-nbd --disconnect /dev/nbd0 # exit
This is what our VM folder should look like now:
ls -al ~/vm drwx------. 7 e500 e500 4096 24. Dez 10:02 . drwxr-xr-x. 6 e500 e500 4096 18. Dez 20:31 .. -rw-r--r--. 1 e500 e500 136839168 24. Dez 10:03 hdd.qcow2 -rw-r--r--. 1 e500 e500 4360017 24. Dez 09:46 openwrt-mpc85xx-generic-zImage
Now the VM is ready to start.
qemu-system-ppc -kernel ~/vm/openwrt-mpc85xx-generic-zImage \ -nographic -append "console=ttyS0" -m 1024 -M ppce500 \ -drive file=~/vm/hdd.qcow2,if=virtio