TP-Link Archer VR200v:: Current State of Support

Hardware Questions and Recommendations
1

Hello,

I want to install LEDE/OpenWRT on my "TP-Link Archer VR200v".
I use this device a DSL-Router and a DECT base. WLAN is disabled!

I read about unsupported features. All stemmed january this year.

What is the current state?

1 Like
2

Do you have any reason to believe that the situation has changed? Hint, the mere passing of time isn't a valid reason.

Judging from the chipset itself and without any particular knowledge of the specific device, the ADSL/ VDSL modem should be supportable - DECT and analogue/ ISDN ports are not supported (and that isn't very likely to change anytime soon). The wireless situation doesn't look too promising either.

3

take a look at:
----8<--- https://wiki.openwrt.org/toh/tp-link/vr200v --->8---
TP-Link Archer VR200v
Dual band AC750 VDSL2 Modem Router with telephony capabilities, Lantiq-target
This router bears similarities with TP-Link TD-W8970.
The router is targeted towards German market, but could easily be used in rest of Europe as well.
The current TP-Link firmware is based on OpenWrt Backfire 10.03.1_LTQ. See ongoing research on the v3 header.
Flashing using u-boot serial console to upload image through tftp works.
The VR200v image also works on the VR200, which is essentially the same target without POTS ports.
----8<--- https://wiki.openwrt.org/toh/tp-link/vr200v --->8---

  1. I'm German and I live in Germany
  2. the firmware is already OpenWRT based (Backfire: 2011-2012 ??)
  3. the lede-17.01.02 download offers "VR200v-squashfs-sysupgrade.bin", but no corresponding "VR200v-squashfs-factory.bin".
  4. ...
    What are the problems about this device ? tell me!
4

Lots of routers are based on some random, ancient and badly messed up, OpenWrt fork, that doesn't mean at all that the hardware is actually supported by OpenWrt or LEDE. Usually these routers use an old vendor kernel with lots of binary/ unavailable kernel modules, binary libraries and daemons and a different webinterface. Yes, those devices might provide some more features than totally proprietary firmware bases, if those features are left accessible to the user, but getting a device supported in OpenWrt/ LEDE requires (at least) access to hardware driver source.

5

I'll try it; risk 60 Eur

6

Backfire running on it just means the manufacturer tailored that to suit their needs - ie: closed binary drivers where necessary etc. And a 2.6 kernel if I'm not mistaken.

It is in no way whatsoever an indication that the upstream LEDE or OpenWrt codebase would run on it; rather the opposite. The thing with those manufacturer supplied firmwares is not in which sources they do offer for download; it's which sources they don't.

As for any actual LEDE images being available, the fact there's only a sysupgrade image available might mean you can just upgrade from the manufacturer firmware (chances are it already has a 'sysupgrade' command).

1 Like
7

Thank you for that info.

8

I just read:
[LEDE-DEV] lantiq: update vdsl subsystem to official VRX200 release V5.7.6.1 (Annnex A) / V5.7.6.2 (Annex B)
I postpone my project

9

Hello,

I have been using the Tp-link VR200 and VR200v for over 2 years now with Telecom Italia VDSL2.
They work fine except for Wifi. I have not tested the POTS port or the DECT functionality.

I have not tested upgrading directly from factory firmware, but it is mentioned on the old ToH that this is not possible because Tp-link implemented signature verification in their firmware due to a heavy-handed regulation from the FCC that was interpreted at the time as prohibiting custom firmware.

In order to upgrade from factory firmware one must use the sysupgrade image provided by OpenWRT, and flash it with TFTP through the bootloader console by soldering a TTL level UART to pins on the motherboard.

I am currently using the latest stable 18.06.1 which works great.

10

Hello vittorio88,
nice to read your name!
Are you using the POTS too? (TP-LINK Archer VR200v | FXS and DECT support)
What about WiFi, I know you make some progress with it... Can you make a PR or lead me the way?

11

Problem with POTS is solved! See this PR@github: Add FXS support for TP-Link Archer VR200v

12

Hello @Aeronaut,

Nice to see you again as well!

I do not currently use the POTS ports, but would like to get around to it someday! Congratulations, on getting it working!

I have made some progress with WAVE 300 Wi-Fi.

I have documented it in this separate thread, because the subject may be of interest to people using routers other than the Tp-Link VR200/VR200v.

If you are interested, the help sure is wanted!

13

I'm currently working on a way to install OpenWrt on the VR200v without having to open the device. My installation procedure (writing to /dev/mtdblock* in the factory firmware) is a bit unreliable right now and I have to figure out why, but at least installing the kernel works well.
Obviously, using the vendor firmware upgrade mechanism and just bypassing the signature checks would be even nicer.

Does anyone else have a working procedure for this?

14

Has anyone tried to use some sort of TFTP recovery with this board? I tried all available buttons, but I didn't see any TFTP requests.

15

Side note: The exploit mentioned in the VR200v device page of setting the SSID to $(...) for getting access to the running vendor firmware does not work anymore if you upgrade to firmware version 180529. Downgrading is not possible from the GUI.

16

https://openwrt.org/toh/tp-link/vr200v#original_firmware_root_access_-_for_debugging_purposes

It's a wiki, you can update the page yourself :slight_smile:

17

I'm currently trying to rework the VR200v wiki entry to make it a bit easier for beginners to flash the device.

My TODOs:

Getting a backup of the flash contents of the factory firmware is a bit difficult for the following reasons:

  • OpenWrt does not build an U-Boot image for this device, so the Lantiq trick of running a flash backup from U-Boot via tftpput can't be used
  • The factory firmware does not have the dd utility, just cat, so dumping the memory-mapped flash contents from /dev/mem is not possible
  • There is no mtdblock device covering the whole flash
  • /dev/mtdblock7 is not being created, so even if you use cat to dump /dev/mtdblock[0-6], the radio partition will be missing
  • The factory U-Boot is missing useful stuff like tftpput, ymodem etc.

Possible ways to backup the complete flash contents:

  • Use a SOIC16 clip on the flash chip, then attach a SPI programmer (e.g. a Raspberry Pi running flashrom.org on Linux) to dump the whole 16 MB chip (needs extra hardware)
  • Use the md command in U-Boot, log the output and reverse the hex dump (sloow, takes roughly one hour)
  • Copy a working dd command to the running factory firmware, then dump the memory-mapped SPI flash (easy if you can get a statically linked binary of dd for that architecture)
  • Compile a U-Boot image with TFTP PUT support for the device, then use tftpput in a chainloaded U-Boot image (AFAIK the VR200v U-Boot sources are not imported into OpenWrt, so the existing U-Boot code in OpenWrt would have to be adapted for the board)
  • Load an OpenWrt kernel+initramfs from factory U-Boot to memory via TFTP, boot it, and work from there (usefulness depends on the binaries present in the initramfs)
  • Check if all that's missing in the factory image is the device node for /dev/mtd7 and create it manually (easy unless there is some hidden catch)

If anyone has better ideas, I'm all ears.

1 Like
18

@hailfinger: Is it somehow possible to flash OpenWRT through rooted factory firmware without opening the device?

19

Hello
does the device support Wifi 2.4GHz and WiFi 5GHz with the current trunk?
best reguards