How can I open the case of Archer A6 v2? (or C6 v2)

Hardware Questions and Recommendations
1

Hey everyone!

I own an Archer A6 v2 (RU), it's currently running OpenWRT 24.10.0-rc7
And since the table of hardware only has a page for the US version, which differs from RU or EU, I want to add RU to it. But before doing this, I decided to open the case in order to get info about all of the hardware. And here's the problem: I can't get it to open.

The A6 is very similar to the C6, at least the outside is identical. So, following the guide for the C6, I removed the two screws on the bottom and started trying to pry open the top. There's a warning about the case being really tight, but it's SO tight that I can't get it to open even when using full force. I've tried credit cards, a flat head screwdriver, multiple prying tools, etc. Nothing works, it just dents the plastic a bit. And yes, I've checked for leftover screws, but there aren't any.

I've tried searching online for a disassemble video but couldn't find one. It's either already open or it's a different version (the v2 and v3 differ a lot).

So, the question is: how do I open this thing? Is there some sort of weird angle that I have to start from? Maybe someone who owns a C6 or A6 can give some advice? Any help is appreciated!

2

Can you get the boot log from tplink's web gui and show the page with your fw download links. Maybe it is a clone of other device or close in optimal case, or broadcom in pessimal one.

3

Can you get the boot log from tplink's web gui

Do you mean from the stock firmware or from OpenWRT? If the latter, then here:

Summary 
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.000000] Linux version 6.6.73 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28388-58d0057481) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Wed Jan 22 19:52:54 2025
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] printk: bootconsole [early0] enabled
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] MIPS: machine is TP-Link Archer C6 v2 (EU/RU/JP)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Initrd not found or empty - disabling initrd
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Zone ranges:
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Movable zone start for each node
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Early memory node ranges
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
Fri Feb  7 12:23:05 2025 kern.debug kernel: [    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
Fri Feb  7 12:23:05 2025 kern.debug kernel: [    0.000000] pcpu-alloc: [0] 0
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Writing ErrCtl register=00000000
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Readback ErrCtl register=00000000
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] Memory: 119968K/131072K available (6819K kernel code, 604K rwdata, 900K rodata, 1204K init, 233K bss, 11104K reserved, 0K cma-reserved)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] NR_IRQS: 51
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] CPU clock: 775.000 MHz
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.000001] sched_clock: 32 bits at 388MHz, resolution 2ns, wraps every 5541893118ns
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.008311] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.074798] pid_max: default: 32768 minimum: 301
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.089160] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.096899] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.113464] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.127974] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.138396] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.148044] pinctrl core: initialized pinctrl subsystem
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.156662] NET: Registered PF_NETLINK/PF_ROUTE protocol family
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.163524] thermal_sys: Registered thermal governor 'step_wise'
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.165358] /ahb/apb: Fixed dependency cycle(s) with /ahb/apb/interrupt-controller@18060010
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.192262] clocksource: Switched to clocksource MIPS
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.207862] NET: Registered PF_INET protocol family
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.213291] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.222359] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.231293] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.239477] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.247567] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.255036] TCP: Hash tables configured (established 1024 bind 1024)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.262473] MPTCP token hash table entries: 512 (order: 0, 6144 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.270319] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.277266] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.285565] NET: Registered PF_UNIX/PF_LOCAL protocol family
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.291615] PCI: CLS 0 bytes, default 32
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.300343] workingset: timestamp_bits=14 max_order=15 bucket_order=1
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.308816] squashfs: version 4.0 (2009/01/31) Phillip Lougher
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.315017] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.332572] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.343735] pinctrl-single 1804002c.pinmux: 544 pins, size 68
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.351044] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.363008] printk: console [ttyS0] disabled
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.367948] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.377220] printk: console [ttyS0] enabled
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.386295] printk: bootconsole [early0] disabled
Fri Feb  7 12:23:05 2025 kern.info kernel: [    0.429789] spi-nor spi0.0: en25qh64 (8192 Kbytes)
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.434914] 5 fixed-partitions partitions found on MTD device spi0.0
Fri Feb  7 12:23:05 2025 kern.err kernel: [    0.441510] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
Fri Feb  7 12:23:05 2025 kern.err kernel: [    0.448392] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.455480] Creating 5 MTD partitions on "spi0.0":
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.460449] 0x000000000000-0x000000020000 : "u-boot"
Fri Feb  7 12:23:05 2025 kern.notice kernel: [    0.468812] 0x000000020000-0x000000030000 : "info"
Fri Feb  7 12:23:05 2025 kern.err kernel: [    0.475916] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions

I used to think that A6 and C6 are identical, but I found this photo of the A6 v2 EU online which shows a difference in the switch, so it seems that they do, in fact, differ. EDIT: well, at least I think they do, the difference is only in the 4 letters on the row before "TAIWAN". Here's the C6 for comparison: https://openwrt.org/_detail/media/tplink/tplink_archer_c6_inside.jpg?id=toh%3Atp-link%3Aarcher_c6_v2

59556826
595568261125×1500 291 KB

show the page with your fw download links

Do you mean this one?

4

Look carefully at the bootlog - it says C6 :open_mouth:
If thete is same fw file offered for any C6 go for it.

5

C6V2 at l#ast fw date matches, check whether both fw files are same

6

Look carefully at the bootlog - it says C6 :open_mouth:

Yeah, I know, but that's probably because I installed the C6 build of OpenWRT :wink:
(there weren't any builds for A6 v2 RU or EU)

And my goal here is to determine whether both models are really identical in terms of hardware, even though the A6 calls itself C6 at times there seem to be small differences.

C6V2 at l#ast fw date matches, check whether both fw files are same

What do you mean by this?
EDIT: I ran a diff on the firmware files and the source code of A6 and C6 and it showed a lot of differences

7

Functilnal tests:
MACs match printed label
Leds match labels
iw list shows correct powers
usb works (not necessarily hubctl)

i did not pay attention you posted openwrt bootlog. I was to compare bootlog with C wiki page namely partition map

8

Functilnal tests:
MACs match printed label
Leds match labels
iw list shows correct powers
usb works (not necessarily hubctl)

Uh, sorry, I don't really get what you mean by this?

9

To test whether you did not corrupt factory partition and the data from it comes in same order as c6v2...

10

Well, the MAC matches
The LEDs behave exactly like on the stock firmware (AFAIK)
iw list shows this:

Summary 
Wiphy phy1
        wiphy index: 1
        max # scan SSIDs: 4
        max scan IEs length: 2257 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports AP-side u-APSD.
        Device supports T-DLS.
        Available Antennas: TX 0x7 RX 0x7
        Configured Antennas: TX 0x7 RX 0x7
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * mesh point
                 * P2P-client
                 * P2P-GO
                 * outside context of a BSS
        Band 1:
                Capabilities: 0x11ee
                        HT20/HT40
                        SM Power Save disabled
                        RX HT20 SGI
                        RX HT40 SGI
                        TX STBC
                        RX STBC 1-stream
                        Max AMSDU length: 3839 bytes
                        DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 8 usec (0x06)
                HT TX/RX MCS rate indexes supported: 0-23
                Frequencies:
                        * 2412.0 MHz [1] (22.0 dBm)
                        * 2417.0 MHz [2] (22.0 dBm)
                        * 2422.0 MHz [3] (22.0 dBm)
                        * 2427.0 MHz [4] (22.0 dBm)
                        * 2432.0 MHz [5] (22.0 dBm)
                        * 2437.0 MHz [6] (22.0 dBm)
                        * 2442.0 MHz [7] (22.0 dBm)
                        * 2447.0 MHz [8] (22.0 dBm)
                        * 2452.0 MHz [9] (22.0 dBm)
                        * 2457.0 MHz [10] (22.0 dBm)
                        * 2462.0 MHz [11] (22.0 dBm)
                        * 2467.0 MHz [12] (disabled)
                        * 2472.0 MHz [13] (disabled)
                        * 2484.0 MHz [14] (disabled)
        valid interface combinations:
                 * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
                   total <= 2048, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

        HT Capability overrides:
                 * MCS: ff ff ff ff ff ff ff ff ff ff
                 * maximum A-MSDU length
                 * supported channel width
                 * short GI for 40 MHz
                 * max A-MPDU length exponent
                 * min MPDU start spacing
        max # scan plans: 1
        max scan plan interval: -1
        max scan plan iterations: 0
        Supported extended features:
                * [ RRM ]: RRM
                * [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
                * [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
                * [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
                * [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
                * [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
                * [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
                * [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
                * [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
                * [ DEL_IBSS_STA ]: deletion of IBSS station support
                * [ MULTICAST_REGISTRATIONS ]: mgmt frame registration for multicast
                * [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
                * [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
                * [ POWERED_ADDR_CHANGE ]: can change MAC address while up

And there's no USB

What's next?

11

Downgrade to 23.05.5 for 5ghz wifi bug on v24on c6v2.
Then search in github for a PR adding "alternative name" for some tplink.

12

But why would I do that? The question isn't about 5ghz, it's about opening the lid and comparing the hardware to the C6, which I'm unable to do

I'm looking for tips on how to open the case or maybe someone who already has an A6 for comparison

13

It has very long clasps that break when opening from flat piece to box piece hooked at sides. Lots of hot glue to put it together.

14

Ill get to keyboard and check differences between a6 c6 fw, since it already works might be one letter.

What is there about "ath" in dmesg? lspci?

15

Here's the output of dmesg | grep -i ath:

dmesg

[ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[ 1.246678] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[ 1.903924] ag71xx-legacy 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[ 1.915941] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[ 20.638552] ath10k 6.10 driver, optimized for CT firmware, probing pci device: 0x56.
[ 21.023083] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[ 21.029895] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[ 23.962895] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[ 23.972476] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 23.987025] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7
[ 24.338785] ath10k_pci 0000:00:00.0: failed to fetch board data for bus=pci,bmi-chip-id=0,bmi-board-id=20 from ath10k/QCA9888/hw2.0/board-2.bin
[ 24.860641] ath10k_pci 0000:00:00.0: failed to fetch board-2.bin or board.bin from ath10k/QCA9888/hw2.0
[ 24.870433] ath10k_pci 0000:00:00.0: failed to fetch board file: -12
[ 24.892331] ath10k_pci 0000:00:00.0: could not probe fw (-12)
[ 24.987899] ath: EEPROM regdomain: 0x0
[ 24.987926] ath: EEPROM indicates default country code should be used
[ 24.987932] ath: doing EEPROM country->regdmn map search
[ 24.987947] ath: country maps to regdmn code: 0x3a
[ 24.987954] ath: Country alpha2 being used: US
[ 24.987960] ath: Regpair used: 0x3a
[ 25.000728] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0x77453c75, irq=2
[ 50.868437] ath9k 18100000.wmac phy1-ap0: entered allmulticast mode
[ 50.875245] ath9k 18100000.wmac phy1-ap0: entered promiscuous mode

And lspci isn't installed

16

5ghz is 9888 not 9880 in c6
You have to replace board and firmware packages.

17

All right, after some more digging around online it seems that there isn't a way to open this thing without damaging the case (be it breaking the clips or making dents). I thought that there would be some way to do this gracefully but oh well.

Since this is a family router I decided to leave it alone for now. Though I still haven't found any images showing what's under the A6's metal protection for the CPU, but that's a separate topic.

To answer the question from the title: use a lot of force and be prepared to damage the case.

18

You booted C6 image and it is just wifi firmware+board package off Try to fix up 5GHz and you have new device port ready.

1 Like
19

But isn't the A6 already ported? Even though there isn't a separate firmware file for it, looks like support got added in this commit: https://github.com/openwrt/firmware-utils/commit/07f78f071075f1b7e866ebea4be821b0ca9e9add

Edit: hmm, after taking a closer look at that commit, I think it's safe to say the hardware for the A6 and C6 is 100% identical?

20

Maybe wiki page just needs other models added and googleable?
Just revert to 23.05.5 for now.
https://openwrt.org/releases/24.10/notes-24.10.0#known_issues