OpenWrt support for TP-Link Deco M4R

Hi OpenWRT team, could you provide firmware support for TP-Link Deco M4R mesh router?

Adding support for a new device usually requires to have the device in question on the desk, opened up, with a serial console attached and spending somewhere between a long rainy weekend and several weeks on first checking what the OEM firmware does and what the hardware needs, before being able to go over to testing initramfs images and finally developing support for flashing it (after having reverse engineered what the OEM firmware/ bootloader accept). At this point, you're the only one with this hardware (or the motivation to buy it), so you'd be the the only one in a position to do the steps above.

--
most more regular developers would look into ipq4018/ ipq4019 based devices for this purpose, much newer/ faster hardware for similar prices, so the M4R is not a particularly attractive target to buy.

2 Likes

Hi,
I know its not too much, but +1 for OpenWRT on TP-Link Deco M4R.
Thanks!

2 Likes

would love to see support added for these devices! The default firmware is a nightmare! Can't even pick your wifi channels and performance isn't the greatest.

1 Like

The Deco platform is very popular - It would be amazing if OpenWrt could be supported on these mesh systems.... Any idea if its theoretically possible/capable enough for the task ??

I would even go as far as paying someone to do it! (I know its free software) but that's how much I want OpenWrt on Deco mesh system.

TP-LINK have just put a basic configuration on there which is a shame.. It is a very capable bit of kit.

1 Like

I'd just throw in ASUS 'lyra' MAP-AC2200, Linksys EA8300/ MR8300 as alternative (admittedly slightly pricier) options, all of them tri-radio devices which are supported by OpenWrt right now (and are faster/ more modern ipq4019 hardware).

1 Like

Would still like the Deco to be supported since it's a popular platform!

1 Like

I would really appreciate support for deco M4 as well.

I was unable to configure the mesh system without registering. which in my opinion should become illegal.
also they are forcing me to use the app as it has more functionality then the web interface.

sorry for complaining here about TP-link

It seems the whole Deco ecosystem is built on top of OpenWRT already. Just look at the GPL page on TP-Link website: https://www.tp-link.com/pt/support/gpl-code/?model=Deco%20M4

For the M4 specifically, here's the source code: https://static.tp-link.com/resources/gpl/GPL_M4R.tar.gz

I don't know if this is enough to be able to replace the firmware, but it should simplify the task, no?

1 Like

I've got one (out of three) on my desk and open.

I'm super new to this so any help on how to process further would be appreciated.

The compiled firmware can be found here: https://www.tp-link.com/de/support/download/deco-m4/#Firmware

The firmware is indeed based on OpenWRT, but no clue what version. The source can be downloaded here: https://static.tp-link.com/resources/gpl/GPL_M4R.tar.gz

And if that link doesn't work then go to https://www.tp-link.com/de/support/gpl-code/ and search for "deco m4" in "Modellnummer:". (Seems like the M4 doesn't exist on the US page of tp-link.com.)

The Version on the webpage for the source code does say "V1". My device says it's a "Deco M4R(EU) Ver: 2.0"

Pictures for the V1 can be found here: https://fccid.io/TE7M4R/Internal-Photos/18-Internal-Photos-4041064

I've got a shitty smartphone camera and even worse lighting, so these are the best pictures I can do of the V2 board without everything being white:
Front: https://i.imgur.com/qtLb9DK.png
Back: https://i.imgur.com/r8445G5.png

Do you see anywhere I could attach some cables to to gain access to the serial console if it exists (which I guess it does)?

The layout is a bit different to the V1, but the chips are the same:

  • SoC: QCA9563-AL3A
  • RAM: Zentel A3R1GE40JBF (DDR3-800 1GB)
  • Wireless 2.4GHz: QCA9563-AL3A (the main SoC)
  • Wireless 5GHz: QCA9886
  • Ethernet Switch: QCA8337N-AL3C (This thing supports 7 (!) ports and all they give us is two...)

This is basically the Archer C6 V2 just with more RAM: https://openwrt.org/toh/tp-link/archer_c6_v2

So now I need to know two things: How do I get a serial console working and how can I save the firmware that is currently on there in case I want to go back? (I'm a software developer, but I'm a total noob with a screwdriver when it comes to "hacking" such devices.)

1 Like

It's probably going to be those pads on the bottom side. I can't see from your pictures are any of these pads labelled something like tx/rx/tx_uart/rx_uart?

1 Like

I just realized that the pictures from the V1 are from the FCC and that there must be pictures for the V2 too: https://fccid.io/TE7M4RV2/Internal-Photos/18-Internal-Photos-4471847

Not sure if these are even worse than mine.

Which pads are you referring to? Inside the RF shield? top right? bottom left?

There are multiple labels with a "U" following a number, but I don't think that's for UART. And on the front in the middle above the "circled" bit there are TP1 and TP2.

1 Like

If the pads are not labelled then you can really only guess. TP1 and TP2 sounds promising. These boards often use 3.3v and a baudrate of 115200. The wiki has some instructions on how to figure out which are the correct pads (https://openwrt.org/docs/techref/hardware/port.serial).

1 Like

I've soldered cables to TP1, TP2 and GND of the power plug.

I was really unsure if my adapters were going to work.
One is one of those Chinese knockoff Prolific USB-to-Serial adapters. And the other one I've got is a CH340 board for ESP8266s that has 3.3V on Vcc but 5V on its TX line. So I'm not eager to try that.

The Chinese knockoff has 3.3V on its TX line and something like 0.43V on its RX line, so I thought that connecting GND and RX to the Deco can't hurt. *fingers crossed*

I've also measured the test points with a multimeter: I've got 2.57V on TP2 that is dipping to 2.4V and even to 1.4V every once in a while. Meanwhile TP1 is at 0V to 0.1V. So I'm guessing that TP2 is TX and TP1 is RX of the SoC.

I crossed all available fingers and connected to GND and TX of the board and voila! I've got the output of the U-Boot bootloader and then a lot of kernel messages.

Will have to remove any settings like the SSIDs I've set before I post that output.

And then someone will really have to help me to patch the OpenWRT code because from now on I've got no idea what I'm doing.

1 Like

This is the output:

I've changed all the MAC addresses to 00:00:00:00:00:00 and the SSIDs to test1 and backhaul1 but otherwise it's what I got via Putty.

When I press Enter to activate the console then it asks for a login name and password. Of course no clue what those could be. But if I press [f] and [enter] as suggested in the beginning then I get a prompt:

So it seems that now I need to know what to do to get the needed info for a custom firmware. Any suggestions? Step-by-step would be great but I'm fine with a link to a tutorial or something like that.

Edit: Seems like you can only edit your last comment.

Info about the Flash chip:
XMC
QH128AHIG

So I'm guessing it's the XM25QH128AHIG with 128Mb of NOR Flash: https://lcsc.com/product-detail/FLASH_XMC-XM25QH128AHIG_C328463.html

2 Likes

Hmm, I'm guessing you should run bootloader commands to gather information about the device. I suggest you check out this page on OpenWRT's website. It seems like the bootloader is U-Boot so I can suggest you search for U-Boot commands and what they do. I have the same device and it would be cool to see OpenWRT running on it. Good luck!
P.S I'm not a developer.

What you just did is like an illiterate telling someone who just learned their ABCs that they should read a specific book about tangential economics.

I need answers from people who know what I have to do and can guide me and not from people who just want a firmware created by someone else without putting any work into it.

Might sound harsh, but this just isn't helping.

And even though this device uses U-Boot, the command prompt of the bootloader is turned off. So no easy testing of RAM images.

You've made me look as if I was ordering someone to make the firmware, I did not. In fact, it wouldn't matter to me if it never happened, I just said it would be "cool".

I would be more than happy to put work into it if I knew how to. I'm sorry that my suggestions didn't help, I tried my best, the attack on me and meanness wasn't warranted.

Might have helped to read the text in the yellow panel that appears for your first 2 posts. Also don't just demand answers from developers, you've already made good progress with the router, if it's interesting enough, someone will help you and take on the task of making the firmware.

I'm not demanding anything.

My point still stands that "I'm guessing you could read this page." or making vague comments about the bootloader isn't helping. A thumbs-up would have helped more.

I would be more than happy to put work into it if I knew how to.

You've made it all the way to the forums. Why stop now? You've got the device. Open it up. I can tell you how. Buy a soldering iron and a USB-2-TTL connector. Get in on the action. There is literally not a single line to program. As a test I've compiled the firmware image for the TL-WA1201 which is almost the same device. And all it took was me reading a bit of the wiki: https://openwrt.org/docs/guide-user/additional-software/beginners-build-guide

if it's interesting enough

It's interesting for the people who own the device, not the people who know what to do but would rather spend their time with more recent and more powerful devices.

Well, firstly I'm sorry for suggesting something bad and accusing you of demanding something. I've never soldered anything in my life and this is my daily driver router so it's potentially too big of a risk for me.

Good luck tinkering.