OpenWrt support for TP-Link Deco M4R

Seems like they're not going to sell this device in the USA, so no FCC ID and thus no pictures of the inside.

And no clue what "Deco M4(ZG)" means.

Means you will have to carefully pry the RF shield from the board with a flat screwdriver if you definitely want to know what chips are used (and if you wreck it, I'm not responsible for telling you to do that. So if you do it then always at your own risk).

About your TTL adapters: No clue.

If you only want to read what the Deco sends then either of the three adapters will do fine. Simply only connect GND and Rx of the adapter to GND and Tx of the Deco.

But if you want to send any commands to the Deco then you need to make sure that the Tx pin of the adapter you end up using is using 3.3V max and not 5V. Or you need to make sure that the SoC of the Deco is fine with receiving 5V on its Rx pin.

You can of course just check with a multimeter between Tx and GND of the adapter, open a connection to it with Putty or your favorite serial console program and then pressing and holding a random key on your keyboard and see what voltages the multimeter spits out.

@bobthebuilder, @KinteLiX and many others.

I just created this account to say thank you to you guys for your work on making OpenWrt possible on this device. I've been silently following this thread since the very beginning in hopes of fixing my fast roaming issues on Deco M4R with mediatek devices. Just today I saw your noob friendly instructions and enough feedback to finally try flashing OpenWrt for the very first time. And after more than 2 years of fast roaming not working and unable to select better wifi channels, we finally have a better router/access point. Thank you to everyone who contributed and I hope you'll have a wonderful new year! Cheers!

2 Likes

After talking to @naf he was kind enough to create an exploit for the M4R v1 too. We are now able to flash OpenWrt to the Deco M4R v1 without using any debug firmware. Follow these instructions but use the exploit down below if you have a v1.
Download it from here:
https://github.com/KinteLiX/openwrt/releases/download/v21.02.1/deco_m4rv1_faux_fw_tftp.bin

1 Like

Happy new year! A family member provided an M4R v4 in the hope it could be useful, and after some wrangling I've got a basic working OpenWrt port:

I'll submit it upstream within the next few days, but for now this image seems fully functional if you'd like to give it a try: http://up.shiz.me/f/openwrt-snapshot-unknown-ramips-mt7621-tplink_deco-m4r-v4-squashfs-factory.bin
It needs to be flashed using the bootloader recovery interface, accessible by pressing x in the u-boot serial console right after reset, or (supposedly) by holding the reset button for 15 seconds. Set a static IP of 192.168.0.2 on your computer and visit http://192.168.0.1 in a browser!

3 Likes

What a new years gift!
Just came back from holiday, planning to open up the RF shield when I saw this post :slight_smile:

So I installed OpenWrt on 2 of them and both successful, only problem I seem to have now is that I cannot install packages using opkg. Is this related to the version not being submitted?

Snipped from the verbose opkg update

Downloading 'https://downloads.openwrt.org/releases/21.02.1/targets/ramips/mt7621/kmods/5.10.161-1-13dc42c2cdfc68d3fd18e3a5e0d34d2b/Packages.sig'
Connecting to 168.119.138.211:443
HTTP error 404

While manually I can only find https://downloads.openwrt.org/releases/21.02.1/targets/ramips/mt7621/kmods/5.4.154-1-ecc7515846d9a85938da6124aee98749/

So no signed firmware necessary? Just installs with the recovery web page?

I wonder why they went through all the hassle to sign the firmware for V1, V2 and the S4 and even started to encrypt the MAC on the S4 and then stopped doing that for newer versions.

But hey, if that means you can install OpenWrt on every Deco M4 version then that's fine by me.

Now we only need someone with a V3 and a soldering iron and who doesn't lose interest half way through. :innocent:

Yeah, that's because it's a build based directly off git master, which is migrating to kernel 5.10. By fully functional I meant 'all basic features seem to work', not much more than that. Stuff like opkg definitely wouldn't because of that, don't use it in production yet. :stuck_out_tongue:

@bobthebuilder: no signed firmware necessary, if the fw_type field in the firmware header's vendor area is not set to Cloud, it will simply do a normal MD5 check. We null the entire vendor area in tplink-safeloader, which has the same effect. I'm not sure if this is the same for V1 and V2, though!

I have to admit that I know too little about this. But I'm guessing that it's not that easy for the v1 and v2 since @naf wrote an exploit for his S4 (which is an M4R v2 in a smaller case) and he likely wouldn't have done that if there was a much easier option. But his exploits make it almost as easy as simply installing the factory image, so I'm happy with that.

I just checked the GPL release for the M4R V1, and it indeed seems to have that section #if 0'd out, treating every firmware as the Cloud type, bummer.

For those with a v3 or any other deco uboot http firmware version that actually enforces signature checks who don't like to use the soldering iron: I made a dynamic version of the exploit that tries to search ram to find the addresses of the symbols it needs dynamically so no initial serial console should be required. see here: https://github.com/naf419/tplink_deco_exploits/releases/download/v1/deco_all_webfailsafe_faux_fw_tftp.bin

2 Likes

The V3's board looks like they slapped the components of a Deco M5 on the board of an M4R, so we would need a fitting firmware first.

Someone in 2021 with a V3 contacted me but then stopped replying. He wrote down these specs for the V3:
CPU: Qualcomm IPQ4019
Target: ipq40xx
Switch: Qualcomm Atheros QCA8072
Wifi: Qualcomm Atheros QCA4019

And this is the bootlog:

I also directed someone else to the Deco M5 post where @oklona started working on getting the V3 supported, but I don't know how far he got with that.


Edit: Just for clarification: Nobody is working on this because nobody here has a M4R V3. I merely shared what info I could gather about the device. But I can't do more without being able to test anything with the actual hardware.

So to people who have a V3 and liked this comment (like @batwingnz and @murraydr44): Don't get your hopes up. Either you become active in porting the V3 or we need to wait (a very) long time before someone else gets a V3 and decides that it needs OpenWrt. And there isn't even a guarantee that this happens at all. So be the change you want to see in the world and become active in porting your device.

2 Likes

Following up on this, I re-did some of the port (expanded and re-assigned the LEDs, wired interface now gets its proper MAC address) and the PR is available here: https://github.com/openwrt/openwrt/pull/11722
Hope it'll be merged soon!

2 Likes

Hello to all,

First of thank you very much for all the effort involved in bringing OpenWRT to the Deco M4R. I have Deco P9's and I would like to benefit of multiple SSID's for segmenting my home network. The idea is to use the Deco's only as AP's but with VLAN capabilities to use multiple SSID's like I mentioned. From what I have read through the thread this version is possible to also flash to the Deco P9's, right?
My devices are the ones from the picture below:

Could someone be so kind and enlighten me if what I am asking is possible and also ponit me in the right direction to flash my devices and benefit from OpenWrt?

Thank you very much in advanced for you help and support.

Best regards.

What you have there is a literal Deco M4R V2 with an additional board for Powerline (which is Ethernet over power).

If you want you can use my last instructions on how to flash an M4R V2 to flash your device: OpenWrt support for TP-Link Deco M4R - #144 by bobthebuilder

Keep in mind that you will lose the Powerline functionality. So far there has been one guy trying his luck at getting it to work but he has given up and I've not seen anyone else with a P9 since now.

And if the exploit linked in my instructions doesn't work then try the new one from naf 4 comments back: OpenWrt support for TP-Link Deco M4R - #172 by naf

Hello @bobthebuilder,

Thank you very much for your prompt reply and help.
The Powerline feature does not bother me if it does not work. The P9's are all wired to the main router and are going to be configured as dumb ap's with VLAN'S for Guest and IoT.

You mention that there was only another person trying to flash P9's. Do yo know why he gave up?

I am going to have a look at your instructions and give them a go.
As soon as I have some news or encounter some issues I post here :slight_smile:. I hope nothing happens to the P9 (like becoming a brick :grimacing: )

Thanks again for your support.

Best regards.

I didn't write that he gave up flashing his P9. I wrote that he gave up getting the Powerline feature to work.

Oh! Sorry misinterpreted what you have writen. Well the Powerline feature is not important so I am going definitely give it a go :).

Thanks again for your valuable help.

I've talked with the guy before in DMs. The powerline feature does seem to work with the out of the box defaults, just configuring it is not possible because there is no known utility that can configure the Broadcom PLC chip.
Screenshot_20230115_123535
He gave up on porting the device because he could not get the same level of performance as stock.


The only change is in 02_network to define the extra interfaces that the M4R doesn't have. It would be trivial to create a dtsi for the 2 and create a PR for the P9.
There is also a debug firmware in case the exploit doesn't work (if the website doesn't start the download, you can do it with wget or curl):
https://static.tp-link.com/beta/2021/202101/20210118/Deco_P9_1.1.3_20210115_debug.zip

Hello @KinteLiX ,

Thank you for your input. The Powerline feature for me is not important as I have all the unit's wired to my main switch. I think this way I am safe following the trivial flashing method for the M4R and it should work, right?

"There is also a debug firmware in case the exploit doesn't work (if the website doesn't start the download, you can do it with wget or curl):"

Regarding this subject above (sorry I am on my phone I do not know how to do quotes) as I am starting on this journey and am not experienced with these procedures, wget or curl should be done how? Connected to the Deco?
Sorry for the newbie question.

Thanks for your help.

You can start by trying the exploit.
Download this:
https://github.com/naf419/tplink_deco_exploits/releases/download/v1/deco_all_webfailsafe_faux_fw_tftp.bin
Follow these instructions but use the exploit linked above.

If this doesn't work, the debug firmware method can be used which is outlined here:

In the pre-requisites don't download what is linked, use the debug firmware linked in my earlier post. Also be careful if you have to use this method because overwriting the wrong partition can hard-brick the device. Only use this if you must.