Skip to content

TPLink TL WDR3600

Jump to bottom
Adrian Chadd edited this page Mar 29, 2015 · 18 revisions

These are just notes for the TP-Link TL-WDR3600 (Ver 1.5).

Hardware

  • AR9344, 560MHz
  • 128MB RAM
  • 8MB flash
  • 2x2 11ng 2GHz SoC wifi
  • 2x2 11na 5GHz AR9580 wifi
  • 2x USB 2.0 ports
  • 5 port gigabit ethernet switch (AR8327N)

Building

  • Make sure /tftpboot exists and is writable by you
  • checkout freebsd-wifi-build somewhere
  • checkout freebsd-head somewhere
$ cd /path/to/freebsd
$ /path/to/freebsd-wifi-build/bin/build tl-wdr3600

It'll spit out a factory image in /tftpboot/ that you flash.

Flashing

  • Erase the flash:
db12x> erase 0x9f020000 +7b0000

First 0x2 last 0x7c sector size 0x10000                                                                                                                                                                                                  124
Erased 123 sectors
  • TFTP the factory image over
db12x> setenv ipaddr <your ip>
db12x> setenv serverip <tftp server ip>
db12x> tftpboot 0x80050000 tl-wdr3600.factory.img
  • Copy it into flash
db12x> cp.b 0x80050000 0x9f020000 0x7b0000

Copy to Flash... write addr: 9f020000
done
  • Reset:
db12x> reset

Issues

  • [FIXED in FreeBSD-HEAD r280800.] ath0/ath1 MAC addresses are not set at boot - you must override them with valid MAC addresses before they're usable. So get the MAC address from arge0, then in /etc/cfg/rc.conf, put something like this (as well as the rest of the configuration for ath0/ath1 from the example configuration file):
netif_ath0_macaddr="<some MAC>"
netif_ath1_macaddr="<some MAC>"

Until it's done automatically, you need to just subtract 2 from the arge0 MAC for ath0, and 1 from the arge0 MAC for ath1.

OpenWRT details

Serial port

It's the same as the TL-WR1043nd (and 1043nd v2) - it's in a different spot on the board, but the pinouts are the same.

Bootloader messages

U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
db12x> ?     
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
db12x> go
Unknown command 'go' - try 'help'
db12x> printenv 
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x08:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize;cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}db12x${bc}-jffs2&&erase 0x9f050000 +0x630000;cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize;cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 686/65532 bytes
db12x>

Building an image

  • Check out FreeBSD-HEAD
  • Run:
$ /path/to/freebsd-wifi-build/build/bin/build tl-wr3600
  • The image is in /tftpboot/tl-wdr3600.factory.bin

Default login details

  • All the ethernet ports should work - it's on 192.168.1.20/24, user 'user' and 'root' have no passwords. You can telnet in as the user 'user'.
Clone this wiki locally