For those of you that don't feel confident enough to solder a serial header or need to recover a router quickly without having to buy any extras i've found a quick and easy way to do so.
I found holding the reset button in and powering on the router attempts to download a recovery firmware from a tftp server, i've written some simple steps to allow this.
1, Change your PC/Laptop ip address to 192.168.0.66
2, Connect you computer to one of the LAN ports on the router (WAN port won't work for this)
2, Setup a tftp server on your machine (I use solarwinds tftp server)
3, Put the desired firmware in your tftp folder and rename it to wdr3600v1_tp_recovery.bin
4, Start the tftp server
5, Hold down the WPS/Reset button on the router
6, Power on the router
7, After approximately 7 seconds release the reset button
8, The router will now download the firmware from your server and upgrade
Sit back and marvel at it's simplicity.
Here is the output seen via serial during this operation….
[code]U-Boot 1.1.4 (Sep 9 2013 – 14:28:41)
U-boot DB120
DRAM: 128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
PCIe Reset OK!!!!!!
In: serial
Out: serial
Err: serial
Net: ag934x_enet_initialize…
No valid address in Flash. Using fixed address
wasp reset mask:c03300
WASP —-> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'wdr3600v1_tp_recovery.bin'.
Load address: 0x80060000
Loading: T T T T T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################
done
Bytes transferred = 8126464 (7c0000 hex)
original_product_id = 36000001
original_product_ver = 01
recovery_product_id = 36000001
recovery_product_ver = 01
auto update firmware: product id verify sucess!
First 0x2 last 0x7d sector size 0x10000
125
Erased 124 sectors
Copy to Flash… write addr: 9f020000
done
U-Boot 1.1.4 (Sep 9 2013 – 14:28:41)
U-boot DB120
DRAM: 128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
PCIe Reset OK!!!!!!
In: serial
Out: serial
Err: serial
Net: ag934x_enet_initialize…
No valid address in Flash. Using fixed address
wasp reset mask:c03300
WASP —-> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … OK
Starting kernel …
Booting Atheros AR934x
Linux version 2.6.31–LSDK-9.2.0_U6.616 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #1 Wed Mar 20 15:14:56 CST 2013
Ram size passed from bootloader =128M
flash_size passed from bootloader = 8
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 450 ahb 225
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),1024k(kernel),6912k(rootfs),64k(config),64k(ART) mem=128M
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 112924k/131072k available (1852k kernel code, 17984k reserved, 428k data, 120k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop… 279.55 BogoMIPS (lpj=559104)
Mount-cache hash table entries: 512
****************ALLOC***********************
Packet mem: 8026c4c0 (0xe00000 bytes)
********************************************
NET: Registered protocol family 16
PCI init:ath_pcibios_init
ath_pcibios_init(294): PCI CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
Returning IRQ 64
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 220
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
5 cmdlinepart partitions found on MTD device ath-nor0
Creating 5 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000007e0000 : "rootfs"
0x0000007e0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
->Oops: flash id 0xef4017 .
—-TP IGMP has been init——
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
athwdt_init: Registering WDT success
ath_otp_init: Registering OTP success
ath_clksw_init: Registering Clock Switch Interface success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 120k freed
init started: BusyBox v1.01 (2013.02.27-07:39+0000) multi-call binary
This Board use 2.6.31
insmod: cannot open module `/lib/modules/2.6.31/kernel/x_tables.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/xt_tcpudp.ko': No such file or directory
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory
(none) mips #1 Wed Mar 20 15:14:56 CST 2013 (none)
(none) login: Now flash open!
Now flash open!
Now flash open!
Now flash open!
Now flash open!
Erase from 0X7E0000 to 0X7EFC80:.
Program from 0X7E0000 to 0X7EFC80:
write successfully
Now flash open!
Now flash open!
Erase from 0X7E0000 to 0X7EFC80:.
Program from 0X7E0000 to 0X7EFC80:
write successfully
Now flash open!
Erase from 0X7E0000 to 0X7EFC80:.
Program from 0X7E0000 to 0X7EFC80:
write successfully
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: RX TASKLET – Pkts per Intr:100
ATHR_GMAC: Mac address for unit 0:bfff0000
ATHR_GMAC: ff:ff:ff:ff:ff:ff
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 128
ATHR_GMAC: Max rx descriptor count : 128
ATHR_GMAC: Mac capability flags : 2381
athr_gmac_ring_alloc Allocated 2048 at 0x87af3000
athr_gmac_ring_alloc Allocated 2048 at 0x87a6f800
WASP —-> S17 PHY *
Setting Drop CRC Errors, Pause Frames and Length Error frames
Hello, nat module!
thread: napt_ct_scan create success pid:108
netlink_kernel_create succeeded at tp_rule_nl_prot: [29]
isis_ip_intf_entry_add id[0] for vid[1]
isis_ip_intf_entry_add id[1] for vid[2]
ACL(Index 0) For packet From Wan Port and TTL is zero
ACL is not yet enabled. Enabling…
ACL Rule(Index 2) For UDP with Zero Checksum
######## S17 SSDK init succeeded! ########
++++ athrs17_igmp_setup once
athrs17_reg_init:done
Setting PHY…
napt_ct_scan_thread: time: 4
ADDRCONF(NETDEV_UP): eth0: link is not ready
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
Now flash open!
Receive unknown msgType:10 at isis_nat_helper.2631.c:2930/tp_rule_netlink()!
isis_ip_intf_entry_add id[1] for vid[2]
br0: port 1(eth0.1) entering forwarding state
ACL Rule(Index 1) For Packet From WAN to LAN Port And DIP is in lan net
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
Enet:0 port4 up
ATH_MAC_TIMER: enet unit:0 is up…
RGMii 1000Mbps full duplex
ATH_MAC_TIMER: done cfg2 0x7215 ifctl 0x0 miictrl
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17..1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2..0_U10.1020 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Restoring Cal data from Flash
dfs_attach: use DFS enhancements
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5108] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5083] tx chainmask mismatch actual 3 sc_chainmak 0
SC Callback Registration for wifi0
wifi0: Atheros 9340: mem=0xb8100000, irq=2
ath_pci: 9.2.0_U10.1020 (Atheros/multi-bss)
__ath_attach: Set global_scn[1]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Restoring Cal data from Flash
dfs_attach: use DFS enhancements
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5108] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5083] tx chainmask mismatch actual 3 sc_chainmak 0
SC Callback Registration for wifi1
wifi1: Atheros 9580: mem=0x10000000, irq=64 hw_base=0xb0000000
wlan_vap_create : enter. devhandle=0x87bd82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x87bd82c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
DES SSID SET=TP-LINK_2.4GHz_B69685
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1
br0: port 2(ath0) entering disabled state
DES SSID SET=TP-LINK_2.4GHz_B69685
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state
br0: starting userspace STP failed, starting kernel STP
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
wlan_vap_create : enter. devhandle=0x86c802c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x86c802c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath1 created
DES SSID SET=TP-LINK_5GHz_B69686
ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1
Found best 11na chan: 44
br0: port 1(eth0.1) entering disabled state
br0: topology change detected, propagating
br0: port 1(eth0.1) entering forwarding state
device ath1 entered promiscuous mode
br0: topology change detected, propagating
br0: port 3(ath1) entering forwarding state
ieee80211_ioctl_siwmode: imr.ifm_active=852608, new mode=3, valid=1
br0: port 3(ath1) entering disabled state
DES SSID SET=TP-LINK_5GHz_B69686
br0: topology change detected, propagating
br0: port 3(ath1) entering forwarding state
br0: port 3(ath1) entering disabled state
br0: topology change detected, propagating
br0: port 3(ath1) entering forwarding state
fuse init (API version 7.12)
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
SCSI subsystem initialized
usb 1-1: new high speed USB device using ath-ehci and address 2
usb 1-1: configuration #1 chosen from 1 choice
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
Initializing USB Mass Storage driver…
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
GPL NetUSB up!
kc 86 : run_telnetDBGDServer start
kc 223 : init_DebugD end
INFO1758: NetUSB 1.184, 0002061F : May 7 2012 10:36:59
INFO175A: AUTH ISOC
INFO175B:
usbcore: registered new interface driver KC NetUSB General Driver
INFO0076: init proc : PAGE_SIZE 4096
INFO17B4: Check mac address
INFO162C: infomap 8654c220
INFO162F: sleep to wait br0 to wake up
INFO02D0: use dev Name br0
INFO1638: sleep to wait br0 end.
INFO1651: UDP_BROAD 7437 tcpPort:625868800
INFO02D0: use dev Name br0
INFO1538: tcpConnector() started…
TP_RULE_NAT:enable hardware nat
IPv6 over IPv4 tunneling driver
(tp_mroute_enable_write)140, tp_mroute_enable = 1
INFO1415: Bind to br0[/code]