OpenWrt support for TP-Link Deco E4R v2

Yurannich2 · December 7, 2023, 2:56am

Hi everyone! I would like to install OpenWrt on this router, but I see that firmware assemblies are only available for M4R v2. I also realized that the hardware installed is the same as on the archer c60 v2. But ready-made firmware in the form of sysupgrade is not suitable for this device. I ask for help in creating or assembling for this device. Thank you in advance!

Hardware:

TP-LINK Deco E4R v2
CPU: Qualcomm Atheros QCA9561 MIPS 74Kc 750 MHz
Flash Chip: Winbond 25Q128BV 16 MiB
RAM: ESMT M14D1G1664A-2.5B 128 MiB
ETH: Qualcomm Atheros QCA9561 with 2 Ethernet Ports 100MbE
Radio 1: Qualcomm Atheros QCA9561 MIMO 2x2:2 IEEE 802.11b/g/n 2.4 GHz
Radio 2: Qualcomm Atheros QCA9886 MIMO 2x2:2 IEEE 802.11a/n/ac 5 GHz

Serial Header pinouts:

Tx (marked with small triangle)
Rx
GND
3.3 V

Yurannich2 · December 7, 2023, 4:01am

Serial Port Pinouts

Hardware information: http://en.techinfodepot.shoutwiki.com/wiki/TP-LINK_Deco_E4R

Yurannich2 · December 7, 2023, 4:06am

ath> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=spi0.0:512k(u-boot),2048k(uImage),12288k(rootfs),64k(mib0),64k(ART)
bootcmd=bootm 0x9f080000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap151${bc}-jffs2&&erase 0x9f050000 +0xE30000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9fe80000 +$filesize&&cp.b $fileaddr 0x9fe80000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Yurannich2 · December 7, 2023, 4:12am

Boot log

U-Boot 1.1.4 (Mar 30 2021 - 17:39:40)

ap151 - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 475k for U-Boot at: 87f88000
Reserving 192k for malloc() at: 87f58000
Reserving 44 Bytes for Board Info at: 87f57fd4
Reserving 36 Bytes for Global Data at: 87f57fb0
Reserving 128k for boot params() at: 87f37fb0
Stack Pointer at: 87f37f98
Now running in RAM - U-Boot at: 87f88000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment

Power up PLL with outdiv = 0 then switch to 3
In:    serial
Out:   serial
Err:   serial
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
factory boot check kernel ok.
Autobooting in 1 seconds
Net:   No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
## Booting image at 9f080000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2021-11-01  12:56:20 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    1049888 Bytes =  1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Contents:
   Image 0:  1049880 Bytes =  1 MB
   Verifying Checksum at 0x9f080040 ...OK
   Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 3.3.8 (tplink@tplink-H81M-S2PV) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #44 Mon Nov 1 20:55:55 HKT 2021
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA956X rev 0
[    0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00008000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00008000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=AP151 console=ttyS0,115200 mtdparts=spi0.0:512k(u-boot),2048k(kernel),12288k(rootfs),1472k(config),64k(art) rootfstype=squashfs crashkernel=10M@20M oops=panic
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126304k/131072k available (2221k kernel code, 4768k reserved, 599k data, 188k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:83
[    0.000000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] NET: Registered protocol family 16
[    0.070000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
[    0.080000] MIPS: machine is Qualcomm Atheros AP151 reference board
[    0.080000] AP151 Reference Board Id is 20
[    0.090000] registering PCI controller with io_map_base unset
[    0.090000]
[    0.090000] WLAN firmware dump buffer allocation of 2097152 bytes @ address 0x87a00000- SUCCESS !!!
[    0.100000] ar71xx: invalid MDIO id 1
[    0.500000] bio: create slab <bio-0> at 0
[    0.510000] PCI host bridge to bus 0000:00
[    0.510000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.520000] pci_bus 0000:00: root bus resource [io  0x0001]
[    0.520000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.530000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.530000] Switching to clocksource MIPS
[    0.540000] NET: Registered protocol family 2
[    0.540000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.540000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.550000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.550000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.560000] TCP reno registered
[    0.560000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.570000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.570000] NET: Registered protocol family 1
[    0.590000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.590000] msgmni has been set to 246
[    0.600000] io scheduler noop registered
[    0.600000] io scheduler deadline registered (default)
[    0.610000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.630000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.640000] console [ttyS0] enabled, bootconsole disabled
[    0.640000] console [ttyS0] enabled, bootconsole disabled
[    0.650000] m25p80 spi0.0: found w25q128, expected m25p80
[    0.660000] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.660000] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.670000] Creating 5 MTD partitions on "spi0.0":
[    0.670000] 0x000000000000-0x000000080000 : "u-boot"
[    0.680000] 0x000000080000-0x000000280000 : "kernel"
[    0.690000] 0x000000280000-0x000000e80000 : "rootfs"
[    0.690000] mtd: partition "rootfs" set to be root filesystem
[    0.700000] 0x000000e80000-0x000000ff0000 : "config"
[    0.710000] 0x000000ff0000-0x000001000000 : "art"
[    0.710000] flash_chrdev : flash_chrdev_init
[    0.720000] flash_chrdev : flash_chrdev_init
[    0.740000] ag71xx_mdio: probed
[    0.870000] ag71xx_mdio: probed
[    0.870000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.430000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    1.440000] eth1: Atheros AG71xx at 0xba000000, irq 5
[    1.990000] eth1: Found an AR934X built-in switch
[    3.030000] TCP cubic registered
[    3.030000] NET: Registered protocol family 17
[    3.030000] Bridge firewalling registered
[    3.040000] 8021q: 802.1Q VLAN Support v1.8
[    3.040000] ### of_selftest(): No testcase data in device tree; not running tests
[    3.060000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    3.060000] Freeing unused kernel memory: 188k freed
[    4.060000] init: Console is alive
[    7.070000] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Before mount_root
mounting /dev/root
cp: can't stat '/tmp/log_export_tmp/*': No such file or directory
After mount_root
377+0 records in
377+0 records out
377+0 records in
377+0 records out
[   12.530000] procd: - early -
[   13.180000] procd: - ubus -
[   14.200000] procd: - init -
Please press Enter to activate this console.
[   14.600000] NET: Registered protocol family 10
[   14.610000] Button Hotplug driver version 0.4.1
[   14.620000] PPP generic driver version 2.4.2
[   14.630000] NET: Registered protocol family 24
[   14.650000] L2TP core driver, V2.0
[   14.650000] L2TP netlink interface
[   14.660000] IPv6 over IPv4 tunneling driver
[   14.670000] GRE over IPv4 demultiplexor driver
[   14.670000] GRE over IPv4 tunneling driver
[   14.690000] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[   14.710000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.740000] nf_conntrack version 0.5.0 (1976 buckets, 7904 max)
[   14.760000] PPPoL2TP kernel driver, V2.0
[   14.760000] PPTP driver version 0.8.5
[   14.820000] xt_time: kernel timezone is -0000
[   14.900000] Netfilter messages via NETLINK v0.30.
[   14.900000] Ebtables v2.0 registered
[   14.930000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   14.990000] ctnetlink v0.93: registering with nfnetlink.
[   15.040000] ssdk_plat_init start
[   15.040000] chip_version:0x0
[   15.040000] chip_version:0x2
[   15.040000] Register QCA PHY driver
[   15.080000] qca-ssdk module init succeeded!
[   15.090000] AR71XX_RESET_REG_WDOG_CTRL: 0x0
[   15.090000]  QCA Hy-Fi multicast installation successfully
[   15.150000] u32 classifier
[   15.160000]     Performance counters on
[   15.160000]     input device check on
[   15.160000]     Actions configured
[   15.200000] Mirror/redirect action on
reloadprofile() begin
reloadprofile() end
==reloadConfig()== begin
  ==loadDefaultConfig()== begin
  ==loadConfigToFiles(): default-config to /tmp/defaultconfig== begin
  ==loadConfigToFiles()== end
  ==set_usrconfig_info()== start
  ==set_usrconfig_info()== end
  ==loadDefaultConfig()== end
  ==loadConfigToFiles(): user-config to /tmp/userconfig== begin
[NM_Error](nm_lib_readPtnUsedSize) 00743: partition not written

frollic · December 7, 2023, 7:22am

Yurannich2 · December 7, 2023, 8:55am

For that moment I need help../

frollic · December 7, 2023, 9:04am

and we're no mind readers.

Yurannich2 · December 12, 2023, 4:56am

What other information is required? Everything you have given in the links is present here. There is access to the console. Logs are attached.
Let me add that I have tried a huge number of different dumps from similar equipment (there is also a programmer), but so far it has not been possible to achieve a normal result. I tried to flash the u-boot separately from here rosysong loading occurs, but the network does not up....

Yurannich2 · December 12, 2023, 5:06am

Default MTD scheme:

cat /proc/mtd

dev: size erasesize name
mtd0: 00080000 00010000 "u-boot"
mtd1: 00200000 00010000 "kernel"
mtd2: 00c00000 00010000 "rootfs"
mtd3: 00170000 00010000 "config"
mtd4: 00010000 00010000 "art"

0x000000000000-0x000000080000 : "u-boot"
0x000000080000-0x000000280000 : "kernel"
0x000000280000-0x000000e80000 : "rootfs"
0x000000e80000-0x000000ff0000 : "config"
0x000000ff0000-0x000001000000 : "art"

Yurannich2 · December 12, 2023, 5:09am

Is it possible to convert ***-factory.bin from EAP225-Wall with similar hardware for examle to E4R or resize mtd or something?

frollic · December 12, 2023, 8:08am

no, but you can use the EAP225 commit as reference, when you add support for the E4R.

https://git.openwrt.org/?p=openwrt%2Fopenwrt.git&a=search&h=febc2b831f633d8d6648267952bd43c35689c36f&st=commit&s=EAP225

naf · January 29, 2024, 5:46pm

I see you have a working serial console and shell access into the stock firmware, correct?

Have you already created a new E4R target device and built an openwrt image for it? It could be a simple copy of a device with the same CPU/network cards (c60-v2 or eap225, whatever). After you build that, test by executing the initramfs version from the bootloader (no need to write to flash yet). The logs from that should show what you need to modify further.

If you send me a flash dump of the stock firmware, I might be able to point you in the right direction to the values you need to fix in the device tree.

rvbaelen · July 16, 2024, 9:31pm

any progress? i have 3 of these laying around? Thanks in advance!

sirherobrine23 · October 9, 2024, 4:38pm

I have the same router but V1, and the only thing that changes is the flash which is an XMC QH128AHIG

Internal photos

Ram memory:

CPU and Wifi chip 2.4Ghz:

Wifi chip 5Ghz:

Flash memory:

board:

maxakash · November 9, 2024, 8:24am

Hi, any update on this?