Skip to content

TPLink TL WDR3600

Jump to bottom
Adrian Chadd edited this page May 11, 2020 · 18 revisions

Hardware

  • AR9344, 560MHz
  • 128MB RAM
  • 8MB flash
  • 2x2 11ng 2GHz SoC wifi
  • 2x2 11na 5GHz AR9580 wifi
  • 2x USB 2.0 ports
  • 5 port gigabit ethernet switch (AR8327N)
  • ~ 20dBm on 2GHz, ~14dBm on 5GHz (36-48), ~ 17dBm on 5GHz (149-165)

Building

  • Make sure /tftpboot exists and is writable by you
  • checkout freebsd-wifi-build somewhere
  • checkout freebsd-head somewhere
$ cd /path/to/freebsd
$ /path/to/freebsd-wifi-build/build/bin/build tl-wdr3600

It'll spit out a factory image in /tftpboot/ that you flash.

Flashing

Easy way: If you're still on stock firmware you can flash the firmware directly from the Web Interface.

Just point to the path of your "tl-wdr3600.factory.bin". The router will then reboot right into FreeBSD.

To get to the command prompt, very quickly enter tpl when the bootloader's one-second timeout.

  • Erase the flash:
db12x> erase 0x9f020000 +7b0000

First 0x2 last 0x7c sector size 0x10000                                                                                                                                                                                                  124
Erased 123 sectors
  • TFTP the factory image over
db12x> setenv ipaddr <your ip>
db12x> setenv serverip <tftp server ip>
db12x> tftpboot 0x80050000 tl-wdr3600.factory.bin
  • Copy it into flash
db12x> cp.b 0x80050000 0x9f020000 0x7b0000

Copy to Flash... write addr: 9f020000
done
  • Reset:
db12x> reset

Issues

  • [FIXED in FreeBSD-HEAD r280800.] ath0/ath1 MAC addresses are not set at boot - you must override them with valid MAC addresses before they're usable. So get the MAC address from arge0, then in /etc/cfg/rc.conf, put something like this (as well as the rest of the configuration for ath0/ath1 from the example configuration file):
netif_ath0_macaddr="<some MAC>"
netif_ath1_macaddr="<some MAC>"

Until it's done automatically, you need to just subtract 2 from the arge0 MAC for ath0, and 1 from the arge0 MAC for ath1.

OpenWRT details

Serial port

It's the same as the TL-WR1043nd (and 1043nd v2) - it's in a different spot on the board, but the pinouts are the same.

An image of the location and pin out: https://imgur.com/7GVJfcM

Bootloader messages

U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
db12x> ?     
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
db12x> go
Unknown command 'go' - try 'help'
db12x> printenv 
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 686/65532 bytes
db12x>

Building an image

  • Check out FreeBSD-HEAD
  • Run:
$ /path/to/freebsd-wifi-build/build/bin/build tl-wdr3600
  • The image is in /tftpboot/tl-wdr3600.factory.bin

Default login details

  • All the ethernet ports should work - it's on 192.168.1.20/24, user 'user' and 'root' have no passwords. You can telnet in as the user 'user'.

Recovery fallback

In case you've messed up your configuration, the TL-WDR3600 configuration as of ea5ac953bac1fef0ac804e0327b72dc9126c361b features a recovery fallback feature. Holding the WPS button during the boot process will cause the boot process to use the default rc.conf rather than the configuration generally saved on your cfg partition.

Clone this wiki locally