User Tools
TP-Link TL-WDR4900
TP-Link TL-WDR4900 V2.x
Dual Band (concurrent) and Gigabit Ethernet. Advertised as 900 Mbps it has simultaneous Triple-Stream (3×3) radios on both 2.4GHz and 5 GHz Bands.
There are two very different revisions
• V1.x: target: mpcC85xx 800Mhz Freescale PPC P1014 CPU 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz), available world-wide
• V2.x: target: ar71xx 720Mhz Qualcomm/Atheros SoC and 6 external antennas, available in PRC only
Manufacturer's website:
• http://www.tp-link.com/en/products/details/?model=TL-WDR4900 (V1.x)
• http://www.tp-link.com.cn/product_double_292.html (V2.x)
• Price: AliExpress - about 100 USD
• Forum https://forum.openwrt.org/viewtopic.php?id=42062
Supported Versions
Version/Model
S/N
Release Date
OpenWrt Version Supported
Model Specific Notes
v1.0 world-wide - 2013-01-22 trunk r36051 Freescale PPC w/2 Atheros radio chips 3 internal antennas (2.4Ghz) and 3 external antennas (5Ghz) v1.3 world-wide - 2013 trunk http://downloads.openwrt.org/snapshots/trunk/mpc85xx/ v2.0 PRC only - 2013-01-22 trunk r39637 6 external antennas, available in PRC only. http://downloads.openwrt.org/snapshots/trunk/ar71xx/
Hardware
Info
Version 1.x
Versions 2.x
Instruction set: PowerPC MIPS Vendor: Freescale Semiconductor Qualcomm Atheros Bootloader: U-Boot 2010.12-svn15934 for PowerPC U-Boot ? fork of mainline U-Boot version 1.1.4 (2005-12-17) for MIPS ? System-On-Chip: Freescale MPC85xx QCA9558-AT4A CPU/Speed PPC P1014@800MHz MIPS 74Kc Vers. 5.0 720 MHz Flash-Chip: S25FL128S Winbond W25Q64FVSIG Flash size: 16384 KiB 8192 KiB RAM-Chip: H5TQ1G63DFR H5PS5162GFR RAM size: 128 MiB 128 MiB Wireless1: Chip: AR9381-AL1A w/ 3×3 MIMO for 2.4GHz SoC: QCA9558-AT4A w/ 3×3 MIMO for 2.4Ghz Wireless2: Chip: AR9580-AR1A w/ 3×3 MIMO for 5Ghz Chip: AR9580-AR1A w/ 3×3 MIMO for 5Ghz Switch: AR8327N-AL1A AR8327N-BL1A USB: 2 (USB 2.0) 2 (USB 2.0) Serial: Yes Yes JTAG: Yes Yes
Photos
Version 1.x
wdr4900v1 serial
wdr4900v1 bottom
Version 2.0
wdr4900v2 serial
Serial console
Serial console is available on the JP2 (v1.x) or J1 (v2.0) connector - see PCB photos above.
DO NOT CONNECT VCC. Use only TX/RX/GND.
Baud Rate: 115200 Data Bits: 8 Parity: No Stop Bits: 1
Factory firmware login credentials: (v1.x only) * username: root * password: 5up
Note: be extremely careful when soldering a serial console on TP-Link TL-WDR4900 - the design of the PCB is not well suited for soldering and important paths/connections are near the soldering points. We have now 3 Routers which are dead, just because we used too much solder…
Installation
OpenWRT may be installed via OEM firmware on both versions.
v1: openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-factory.bin
v2: openwrt-ar71xx-generic-tl-wdr4900-v2-squashfs-factory.bin
• If you do not speak chinese and are not familiar with the standard TP-Link firmware, please see the screen shots below for help.
After installation you will want to proceed with first login, basic configuration. You may also wish to install the web user interface LuCI, after which you can manage your router at http://192.168.1.1
Helpful Screenshots for installing from Chinese stock firmware
Upgrading from Stock Firwmare - Step 1
Upgrading from Stock Firwmare - Step 2
VLAN
To get tagged and untagged traffic working on the same port a patch for the switch driver is needed. Refer to: https://dev.openwrt.org/ticket/12181#comment:73
De-brick or OEM installation
Using TFTP + Serial method
Pre-requisites
• a serial connection (e.g. TTL, RS232) from your machine to the router.
• a terminal program (e.g. minicom, screen) set for 115200 Baud, 8 data bits, no parity, 1 stop bit, no flow control.
◦ It is strongly recommended not to connect the 3.3V (or any) voltage line - use the router's own power supply instead.
• a factory OpenWrt firmware image into your TFTP server folder (see Installation above)
• a wired ethernet connection from your computer to one of the router's LAN ports.
◦ IP address on this connection should be statically set to 192.168.1.x/24.
• a TFTP server started on your local machine
◦ must be listening on the same link/IP address as the wired ethernet connection to the router
◦ v1.x models prefer the server address 192.168.1.66, v2.0 prefers 192.168.1.100
v1.x Flash Write Procedure
This section applies to v1.x only! (version 2.0 method)
1. Router should be unplugged (power off), your serial line connected, terminal open and TFTP server installed not yet running.
2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into openwrt.bin (to save some typing within the flash procedure).
3. First goal is to get the command prompt from the U-Boot bootloader on your router.
4. Plug in your router and be ready to type „vl“ just after you see the line Autobooting in 1 seconds (Spamming „vl“ around this point helps):
U-Boot 2010.12-svn15934 (Dec 11 2012 - 16:23:49)
CPU: P1014, Version: 1.0, (0x80f10110) Core: E500, Version: 5.1, (0x80212151) Clock Configuration:
CPU0:800 MHz,
CCB:400 MHz,
DDR:333.333 MHz (666.667 MT/s data rate) (Asynchronous), IFC:100 MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
Board: P1014RDB SPI: ready DRAM: 128 MiB L2: 256 KB enabled Using default environment
PCIe1: Root Complex of mini PCIe Slot, x1, regs @ 0xffe0a000
01:00.0 - 168c:abcd - Network controller
PCIe1: Bus 00 - 01 PCIe2: Root Complex of PCIe Slot, x1, regs @ 0xffe09000
03:00.0 - 168c:0033 - Network controller
PCIe2: Bus 02 - 03 In: serial Out: serial Err: serial Net: initialization for Atheros AR8327/AR8328 AR8327/AR8328 v1.1 is found! eTSEC1 Autobooting in 1 seconds
In case you failed the right timing just reboot again until the prompt appears ⇒
1. (optional) Now lets check what kind of parameters the u-boot loader expects (e.g file name of firmware, IP via TFTP & load address).
Type tftpboot & press ENTER … ⇒ tftpboot Check for phy link status Speed: 1000, full duplex Using eTSEC1 device TFTP from server 192.168.0.104; our IP address is 192.168.0.136 Filename 'uImage'. Load address: 0x1000000 Loading: T T T T T T T T T T Retry count exceeded; starting again
1. As you can see, uboot expects a firmware image file name „uImage“ at TFTP server address 192.168.1.104,
then, just change you local ip into 192.168.1.104 and start your TFTP server.
1. Start the uBoot's TFTP client to download the image from your local machine by typing: tftpboot 0x1000000 openwrt.bin + ENTER
⇒ tftpboot 0x1000000 openwrt.bin Check for phy link status Speed: 1000, full duplex Using eTSEC1 device TFTP from server 192.168.0.104; our IP address is 192.168.0.136 Filename 'openwrt.bin'. Load address: 0x1000000 Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###
done Bytes transferred = 16252928 (f80000 hex)
1. The last line needs to show a size of f80000 hex, otherwise your image is unsuitable.
2. To select the SPI flash memory type: sf probe 0
⇒ sf probe 0 SF: Detected S25FL128S_65k with page size 256, total 16 MiB 16384 KiB S25FL128S_64K at 0:0 is now current device
1. Now we need to erase parts of the flash memory to be able to copy your fresh loaded firmware into it,
just type in the prompt sf erase 0x60000 0xf80000: ⇒ sf erase 0x60000 0xf80000 SPI flash erase successful
1. Now just copy the image to the right place by typing sf write 0x1000000 0x60000 0xf80000
⇒ sf write 0x1000000 0x60000 0xf80000 SPI flash write successful
1. So, in case your image is the correct one, you should do just a single reboot to have a working TL-WRD4900 back on your desk.
Type reset or just un-plug and re-plug the power of your router and watch the boot process. ⇒ reset
v2.0 Flash Write Procedure
This section applies to v2.0 only! (version 1.x method)
1. Be sure the router is powered off (there's a handy power switch beside the power line).
2. Connect your serial and ethernet cables to your computer.
3. Open your terminal for the serial connection.
4. Power on the router
5. When you see Autobooting in 1 seconds, quickly type „tpl“ to access the command line.
◦ there is no harm at all typing „tpl“ repeatedly from the moment you power on, I often start when I see the U-Boot bootloader header. 
6. Start the TFTP server running on your computer.
7. At the ap135> prompt, type the following commands:
1. tftpboot 0x81000000 openwrt.bin (where openwrt.bin is the name of your firmware image)
2. erase 0x9f020000 +0x7c0000
3. cp.b 0x81000000 0x9f020000 0x7c0000
4. bootm 0x9f020000
8. Congratulations!
Reset Button Method (no serial cable needed)
If you want to de-brick/upgrade your router using TFTP without a serial cable follow these steps:
Pre-requisites
• Copy a working & full OpenWrt sysupgrade image into your TFTP server folder (e.g: http://downloads.openwrt.org/snapshots/trunk/mpc85xx/openwrt-mpc85xx-generic-tl-wdr4900-v1-squashfs-sysupgrade.bin) so it will be found under the path /wdr4900v1_tp_recovery.bin You can also use the image used for reverting to stock firmware if you prefer to do so, but it has to be placed under the same path.
• A TFTP server started on your local machine on LAN address 192.168.0.66/24.
• Connect your LAN-port to one of the routers LAN
Procedure
1. Router should be unplugged (power off) and TFTP server installed not yet running.
2. Copy your desired openwrt image for the TPlink-WDR4900 into your TFTP server folder and rename it into wdr4900v1_tp_recovery.bin (as the router will search for this file).
3. Make sure your card has address 192.168.0.66.
4. Start the tftp server and make sure it is listening on 192.168.0.66
5. Plug in your router and keep the WPS/Reset button pressed until the tftp server confirms the transfer is done
6. Wait for the router to reboot, the new image will then be loaded
Failsafe / reset
After all else failed, I found http://www.binaryfriend.ru/2012/10/how-to-hard-reset-openwrt-on-tp-link-1043nd. Extremely simple. Please see the original page for more info. Summary:
1. Power the router up;
2. After powering up track the SYS light when it starts to blink, when it does press and hold the QSS button till SYS lights starts to blink faster – router goes to recovery mode;
3. Telnet to the router on 192.168.1.1 – no password needed (if your computer doesn’t gets IP address from DHCP assign it manually for i.e. 192.168.1.200 with netmask of 255.255.255.0);
4. In telnet terminal type `mtd -r erase rootfs_data` to reset OpenWRT to it’s defaults.
Reverting to stock firmware
You can revert to stock firmware by following these steps:
• Download / copy with SCP or wget this firmware to the /tmp folder of the router: ftp://everbest.ftpserver.biz/Share/TP-Link/TL-WDR4900%20Firmware/wdr4900nv1_en_3_14_1_up(130304)_beta.bin
• Open a SSH session to the router, cd to /tmp
• Execute the following command: mtd -r write wdr4900nv1_en_3_14_1_up(130304)_beta.bin firmware
• Wait until the router reboots
