OpenWrt support for TP-Link Deco M4R

What a new years gift!
Just came back from holiday, planning to open up the RF shield when I saw this post :slight_smile:

So I installed OpenWrt on 2 of them and both successful, only problem I seem to have now is that I cannot install packages using opkg. Is this related to the version not being submitted?

Snipped from the verbose opkg update

Downloading 'https://downloads.openwrt.org/releases/21.02.1/targets/ramips/mt7621/kmods/5.10.161-1-13dc42c2cdfc68d3fd18e3a5e0d34d2b/Packages.sig'
Connecting to 168.119.138.211:443
HTTP error 404

While manually I can only find https://downloads.openwrt.org/releases/21.02.1/targets/ramips/mt7621/kmods/5.4.154-1-ecc7515846d9a85938da6124aee98749/

So no signed firmware necessary? Just installs with the recovery web page?

I wonder why they went through all the hassle to sign the firmware for V1, V2 and the S4 and even started to encrypt the MAC on the S4 and then stopped doing that for newer versions.

But hey, if that means you can install OpenWrt on every Deco M4 version then that's fine by me.

Now we only need someone with a V3 and a soldering iron and who doesn't lose interest half way through. :innocent:

Yeah, that's because it's a build based directly off git master, which is migrating to kernel 5.10. By fully functional I meant 'all basic features seem to work', not much more than that. Stuff like opkg definitely wouldn't because of that, don't use it in production yet. :stuck_out_tongue:

@bobthebuilder: no signed firmware necessary, if the fw_type field in the firmware header's vendor area is not set to Cloud, it will simply do a normal MD5 check. We null the entire vendor area in tplink-safeloader, which has the same effect. I'm not sure if this is the same for V1 and V2, though!

I have to admit that I know too little about this. But I'm guessing that it's not that easy for the v1 and v2 since @naf wrote an exploit for his S4 (which is an M4R v2 in a smaller case) and he likely wouldn't have done that if there was a much easier option. But his exploits make it almost as easy as simply installing the factory image, so I'm happy with that.

I just checked the GPL release for the M4R V1, and it indeed seems to have that section #if 0'd out, treating every firmware as the Cloud type, bummer.

For those with a v3 or any other deco uboot http firmware version that actually enforces signature checks who don't like to use the soldering iron: I made a dynamic version of the exploit that tries to search ram to find the addresses of the symbols it needs dynamically so no initial serial console should be required. see here: https://github.com/naf419/tplink_deco_exploits/releases/download/v1/deco_all_webfailsafe_faux_fw_tftp.bin

2 Likes

The V3's board looks like they slapped the components of a Deco M5 on the board of an M4R, so we would need a fitting firmware first.

Someone in 2021 with a V3 contacted me but then stopped replying. He wrote down these specs for the V3:
CPU: Qualcomm IPQ4019
Target: ipq40xx
Switch: Qualcomm Atheros QCA8072
Wifi: Qualcomm Atheros QCA4019

And this is the bootlog:

I also directed someone else to the Deco M5 post where @oklona started working on getting the V3 supported, but I don't know how far he got with that.


Edit: Just for clarification: Nobody is working on this because nobody here has a M4R V3. I merely shared what info I could gather about the device. But I can't do more without being able to test anything with the actual hardware.

So to people who have a V3 and liked this comment (like @batwingnz and @murraydr44): Don't get your hopes up. Either you become active in porting the V3 or we need to wait (a very) long time before someone else gets a V3 and decides that it needs OpenWrt. And there isn't even a guarantee that this happens at all. So be the change you want to see in the world and become active in porting your device.

2 Likes

Following up on this, I re-did some of the port (expanded and re-assigned the LEDs, wired interface now gets its proper MAC address) and the PR is available here: https://github.com/openwrt/openwrt/pull/11722
Hope it'll be merged soon!

2 Likes

Hello to all,

First of thank you very much for all the effort involved in bringing OpenWRT to the Deco M4R. I have Deco P9's and I would like to benefit of multiple SSID's for segmenting my home network. The idea is to use the Deco's only as AP's but with VLAN capabilities to use multiple SSID's like I mentioned. From what I have read through the thread this version is possible to also flash to the Deco P9's, right?
My devices are the ones from the picture below:

Could someone be so kind and enlighten me if what I am asking is possible and also ponit me in the right direction to flash my devices and benefit from OpenWrt?

Thank you very much in advanced for you help and support.

Best regards.

What you have there is a literal Deco M4R V2 with an additional board for Powerline (which is Ethernet over power).

If you want you can use my last instructions on how to flash an M4R V2 to flash your device: OpenWrt support for TP-Link Deco M4R - #144 by bobthebuilder

Keep in mind that you will lose the Powerline functionality. So far there has been one guy trying his luck at getting it to work but he has given up and I've not seen anyone else with a P9 since now.

And if the exploit linked in my instructions doesn't work then try the new one from naf 4 comments back: OpenWrt support for TP-Link Deco M4R - #172 by naf

Hello @bobthebuilder,

Thank you very much for your prompt reply and help.
The Powerline feature does not bother me if it does not work. The P9's are all wired to the main router and are going to be configured as dumb ap's with VLAN'S for Guest and IoT.

You mention that there was only another person trying to flash P9's. Do yo know why he gave up?

I am going to have a look at your instructions and give them a go.
As soon as I have some news or encounter some issues I post here :slight_smile:. I hope nothing happens to the P9 (like becoming a brick :grimacing: )

Thanks again for your support.

Best regards.

I didn't write that he gave up flashing his P9. I wrote that he gave up getting the Powerline feature to work.

Oh! Sorry misinterpreted what you have writen. Well the Powerline feature is not important so I am going definitely give it a go :).

Thanks again for your valuable help.

I've talked with the guy before in DMs. The powerline feature does seem to work with the out of the box defaults, just configuring it is not possible because there is no known utility that can configure the Broadcom PLC chip.
Screenshot_20230115_123535
He gave up on porting the device because he could not get the same level of performance as stock.


The only change is in 02_network to define the extra interfaces that the M4R doesn't have. It would be trivial to create a dtsi for the 2 and create a PR for the P9.
There is also a debug firmware in case the exploit doesn't work (if the website doesn't start the download, you can do it with wget or curl):
https://static.tp-link.com/beta/2021/202101/20210118/Deco_P9_1.1.3_20210115_debug.zip

Hello @KinteLiX ,

Thank you for your input. The Powerline feature for me is not important as I have all the unit's wired to my main switch. I think this way I am safe following the trivial flashing method for the M4R and it should work, right?

"There is also a debug firmware in case the exploit doesn't work (if the website doesn't start the download, you can do it with wget or curl):"

Regarding this subject above (sorry I am on my phone I do not know how to do quotes) as I am starting on this journey and am not experienced with these procedures, wget or curl should be done how? Connected to the Deco?
Sorry for the newbie question.

Thanks for your help.

You can start by trying the exploit.
Download this:
https://github.com/naf419/tplink_deco_exploits/releases/download/v1/deco_all_webfailsafe_faux_fw_tftp.bin
Follow these instructions but use the exploit linked above.

If this doesn't work, the debug firmware method can be used which is outlined here:

In the pre-requisites don't download what is linked, use the debug firmware linked in my earlier post. Also be careful if you have to use this method because overwriting the wrong partition can hard-brick the device. Only use this if you must.

Thank you very much for the detailed help.

You guys are great!

As soon as I give it a go or if I have any issues during the process I will let you know.

Thanks again.

1 Like

Just wanted to confirm that I was also able to flash the latest version onto two Deco P9s v1.80s using the universal tftp exploit. Have them both setup in dumb AP mode in a 802.11s mesh. I was also able to setup a 5 GHz AP and do the mesh on the same band, although the performance of either isn't super inconsistent so I might move the mesh to 2.4 GHz and see if that improves anything. Software/hardware flow offloading also appear to greatly improve the wireless performance.

Huge thanks to everyone who put the work into getting this to work! Super happy to finally get away from the crappy stock firmware and app.

2 Likes

Hi,

Thank for your work. I've installed using exploit the firmware in a Deco M4R V1.0 and everything was as expected (using exploit with dynamic search instead the other one).

I have three Deco M4(EU) V4.0. Honestly I don't know if version M4R V4.0 is the same that I have it. Someone knows if there are difference or maybe is only the name for different regions?

Try the firmware for your V4s. Worst case the firmware doesn't work and you can use the recovery webpage to flash the oem firmware from tp-link.