Resuscitate a TP-Link WDR3600

Hello :wave:

I just got this wdr3600 on my desk which had a sticker on it "bootloader defect"?.

Just soldered some pin headers and connected via serial to it:

U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

Doesn't look to bad - a boot loader is actually present and works by the looks of it.

Next step was to interrupt the "Autobooting" and ask for help

U-Boot 1.1.4 (Sep  9 2013 - 14:28:41)

U-boot DB120


DRAM:  128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

PCIe Reset OK!!!!!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
 wasp  reset mask:c03300 
WASP  ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
db12x> help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
db12x>

Spotted tftpboot right away and gave it a shot:

db12x> tftpboot
*** Warning: no boot file name; using '6F01A8C0.img'
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename '6F01A8C0.img'.
Load address: 0x81000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ############################
done
Bytes transferred = 8126464 (7c0000 hex)

I used the file openwrt-21.02.3-ath79-generic-tplink_tl-wdr3600-v1-squashfs-factory.bin and renamed it to 6F01A8C0.img that the router ate it.

Next step boot it:

db12x> bootm
## Booting image at 81000000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 Sat Apr 16 12:59:34 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link TL-WDR3600 v1
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 122180K/131072K available (5259K kernel code, 192K rwdata, 688K rodata, 1212K init, 205K bss, 8892K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from 0x80661a28 with crng_init=0
[    0.000000] CPU clock: 560.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[    0.000009] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[    0.008314] Calibrating delay loop... 278.78 BogoMIPS (lpj=557568)
[    0.050864] pid_max: default: 32768 minimum: 301
[    0.055960] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.063758] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.077162] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.087578] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.094937] pinctrl core: initialized pinctrl subsystem
[    0.103186] NET: Registered protocol family 16
[    0.137910] clocksource: Switched to clocksource MIPS
[    0.144340] thermal_sys: Registered thermal governor 'step_wise'
[    0.144718] NET: Registered protocol family 2
[    0.155990] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.164545] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.173518] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.181691] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.189209] TCP: Hash tables configured (established 1024 bind 1024)
[    0.196106] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.203123] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.210844] NET: Registered protocol family 1
[    0.215547] PCI: CLS 0 bytes, default 32
[    0.223797] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.238270] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.244517] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.269375] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.281454] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.288522] gpio-export gpio-export: 4 gpio(s) exported
[    0.294936] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.304331] printk: console [ttyS0] disabled
[    0.308982] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[    0.318184] printk: console [ttyS0] enabled
[    0.318184] printk: console [ttyS0] enabled
[    0.327093] printk: bootconsole [early0] disabled
[    0.327093] printk: bootconsole [early0] disabled
[    0.359888] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    0.364906] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.371367] Creating 3 MTD partitions on "spi0.0":
[    0.376260] 0x000000000000-0x000000020000 : "u-boot"
[    0.382412] 0x000000020000-0x0000007f0000 : "firmware"
[    0.390703] 0x0000007f0000-0x000000800000 : "art"
[    0.734903] switch0: Atheros AR8327 rev. 4 switch registered on mdio.0
[    1.129904] random: fast init done
[    1.320049] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[    1.331255] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[    1.338009] i2c /dev entries driver
[    1.344412] NET: Registered protocol family 10
[    1.354912] Segment Routing with IPv6
[    1.358827] NET: Registered protocol family 17
[    1.363441] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.376600] 8021q: 802.1Q VLAN Support v1.8
[    1.381880] PCI host bridge /ahb/pcie-controller@180c0000 ranges:
[    1.388147]  MEM 0x0000000010000000..0x0000000013ffffff
[    1.393466]   IO 0x0000000000000000..0x0000000000000000
[    1.398969] PCI host bridge to bus 0000:00
[    1.403170] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    1.410156] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.415826] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.422720] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.430808] pci 0000:00:00.0: [168c:0033] type 00 class 0x028000
[    1.436971] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit]
[    1.443916] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.450802] pci 0000:00:00.0: supports D1
[    1.454886] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.462127] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.468885] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit]
[    1.476338] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref]
[    1.485758] hctosys: unable to open rtc device (rtc0)
[    1.492054] /dev/root: Can't open blockdev
[    1.496280] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.503888] Please append a correct "root=" boot option; here are the available partitions:
[    1.512373] 1f00             128 mtdblock0 
[    1.512377]  (driver?)
[    1.519027] 1f01            8000 mtdblock1 
[    1.519030]  (driver?)
[    1.525671] 1f02              64 mtdblock2 
[    1.525673]  (driver?)
[    1.532312] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.540691] Rebooting in 1 seconds..

That looked much better than with the (old openwrt?) image loaded I got this device with - but still bootlooping :thinking:

Do these lines indicate a broken flash or something in that direction?

[    1.492054] /dev/root: Can't open blockdev
[    1.496280] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.503888] Please append a correct "root=" boot option; here are the available partitions:
[    1.512373] 1f00             128 mtdblock0 
[    1.512377]  (driver?)
[    1.519027] 1f01            8000 mtdblock1 
[    1.519030]  (driver?)
[    1.525671] 1f02              64 mtdblock2 
[    1.525673]  (driver?)
[    1.532312] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Some one who had this error in the past were able to fix it in software by the looks of it:
https://dev.archive.openwrt.org/ticket/18541

good job !
Did you try with an older build,like a 19.07 ?
It is probably not the same error at all but I have a WD MyNet N750 working perfectly fine in any 19.07 release and with file system errors when running 21.x or 22.x

1 Like

Not yet but soon... just downloaded some more images (two different targets exist for 19.07). If I'm not successful with openwrt I could still try to charge the stock tp-link firmware If I find it somewhere...

I now tried all this images here and they all fail:

openwrt-19.07.10-ar71xx-generic-tl-wdr3600-v1-squashfs-factory.bin

[    1.516467] hctosys: unable to open rtc device (rtc0)
[    1.522628] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.530275] Please append a correct "root=" boot option; here are the available partitions:
[    1.538774] 1f00             128 mtdblock0 
[    1.538779]  (driver?)
[    1.545413] 1f01            8000 mtdblock1 
[    1.545417]  (driver?)
[    1.552066] 1f02              64 mtdblock2 
[    1.552071]  (driver?)
[    1.558716] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.567984] Rebooting in 1 seconds..

openwrt-19.07.10-ath79-generic-tplink_tl-wdr3600-v1-squashfs-factory.bin

[    1.516539] hctosys: unable to open rtc device (rtc0)
[    1.522719] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.530364] Please append a correct "root=" boot option; here are the available partitions:
[    1.538862] 1f00             128 mtdblock0 
[    1.538868]  (driver?)
[    1.545500] 1f01            8000 mtdblock1 
[    1.545505]  (driver?)
[    1.552153] 1f02              64 mtdblock2 
[    1.552158]  (driver?)
[    1.558803] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

openwrt-22.03.0-rc6-ath79-generic-tplink_tl-wdr3600-v1-squashfs-factory.bin

[    1.662070] /dev/root: Can't open blockdev
[    1.666241] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.673887] Please append a correct "root=" boot option; here are the available partitions:
[    1.682380] 1f00             128 mtdblock0 
[    1.682385]  (driver?)
[    1.689014] 1f01            8000 mtdblock1 
[    1.689019]  (driver?)
[    1.695658] 1f02              64 mtdblock2 
[    1.695662]  (driver?)
[    1.702301] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.710689] Rebooting in 1 seconds..

When I try to load the stock image wdr3600v1_en_3_14_3_up_boot(150518) (from here: http://www.tp-link.com/res/down/soft/TL-WDR3600_V1_150518.zip)

I get the original error as it was present when I got the device:

## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

Any one any ideas left?

:thinking:

Fixed it!

Just missed two commands by the looks of it (as described here https://openwrt.org/toh/tp-link/tl-wdr4300_v1#de-brick_or_oem_installation_using_the_tftp_and_rs232_serial_method).

I tried bootm always directly after the tftpboot but it (like described in the WDR4300 docs linked) it works only if some flash is erased before and the image copied to the correct location :white_check_mark:

1 Like

tftpboot will work using the initramfs images - not the factory image.

Once booted into an initramfs you can then sysupgrade to install to flash.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.