TP-Link Archer C20 V4

TP-Link Archer C20 v4 is a router with a 5-port FE switch and non-detachable antennas, based on MediaTek MT7628AN + MT7610EN. As compared with the older v1 version, v4 is without any USB ports but has a third central antenna for 5GHz. It also appears to have reduced power consumption.

As of mid-2020 OpenWrt works with most, if not all, features.

TP Link Archer C20 v1

Install OpenWrt (generic explanation)

Only TFTP is supported for this device.

Warning about bricking your device

You need to use TFTP to install. Do not flash from the stock UI because you will get an lzma kernel decompression error and you’ll have to use serial console to recover from soft-brick. If the serial console shows the device keeps resetting, press on “4” or “1” or “7” during the boot cycle to switch to console command mode or directly into TFTP transfer of a firmware

There is a hardcoded tftp update command in uboot for revision V4:

tftp 0x80060000 tp_recovery.bin;erase tplink 0x20000 0x7a0000;cp.b 0x80080000 0x20000 0x7a0000

As the uboot isn't flashed, there is no problems to recover the device.

On Linux:

  1. Download the ...squashfs-tftp-recovery.bin as shown in the table above.
  2. Configure a computer with static IP 192.168.0.66/24 and a TFTP server. On Debian or Ubuntu you can use either the tftpd-hpa or tftpd server packages.
  3. Rename the downloaded firmware file to tp_recovery.bin and place it in the tftp server's root directory. (If using tftpd-hpa this is /var/lib/tftpboot/; if tftpd, it is /srv/tftp/.) You can test that the file is downloadable with tftp localhost and get tp_recovery.bin.
  4. Connect the computer to one of the router's Ethernet ports while the router is off. Press and keep pressed the router's reset button and power it up. After about 7-10 seconds release the reset button. The power LED will flicker rapidly for ~3 seconds, indicating download of the firmware file.
  5. The router will write the firmware to flash during ~40 more seconds of occasional power LED blinks, and then will reboot by itself, ready for use.
Architecture MIPS
Vendor MediaTek
Bootloader U-Boot
System-On-Chip MediaTek MT7628A - rampis mt76x8
CPU/Speed 580 MHz
Flash-Chip GD 25Q64CSIG or Winbond W25Q64JV
Flash size 8 MiB
RAM 64 MiB
Wireless 1 MT7628A 2.4GHz (working)
Wireless 2 MT7610E 5GHz (only AP)
Ethernet 5 x 10/100 Mbit/s w/ vlan support
USB likely not fanned out
Serial Yes
JTAG No

Remove two screws under the devices, then pop the black top off (needs some force to get it off, try to screw the screws back in 1 turn and push against them)

port.serial general information about the serial port, serial port cable, etc.

There should be 4 pads (J2) looking from the font on right side, where the square pad is vcc 3.3V. FRONT | vcc3.3 - gound - tx & rx | BACK

Serial connection parameters
for TP-Link Archer C20 V4
115200, 8N1

... TBD ...


[ 0.000000] Linux version 4.14.42 (buildbot@slashdirt-02) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7016-52809db)) #0 Tue May 22 19:02:01 2018 [ 0.000000] Board has DDR2 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc) [ 0.000000] MIPS: machine is TP-Link Archer C20 v4 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] On node 0 totalpages: 16384 [ 0.000000] free_area_init_node: node 0, pgdat 8047af00, node_mem_map 81000040 [ 0.000000] Normal zone: 128 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 16384 pages, LIFO batch:3 [ 0.000000] random: get_random_bytes called from start_kernel+0x8c/0x47c with crng_init=0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Writing ErrCtl register=0004d423 [ 0.000000] Readback ErrCtl register=0004d423 [ 0.000000] Memory: 59856K/65536K available (3559K kernel code, 177K rwdata, 856K rodata, 200K init, 214K bss, 5680K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] intc: using register map from devicetree [ 0.000000] CPU Clock: 580MHz [ 0.000000] timer_probe: no matching timers found [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns [ 0.000012] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns [ 0.007543] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216) [ 0.073492] pid_max: default: 32768 minimum: 301 [ 0.078181] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.084528] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.097016] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.106505] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.112454] pinctrl core: initialized pinctrl subsystem [ 0.118695] NET: Registered protocol family 16 [ 0.231230] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000 [ 0.386517] PCI host bridge /pcie@10140000 ranges: [ 0.391095] MEM 0x0000000020000000..0x000000002fffffff [ 0.396121] IO 0x0000000010160000..0x000000001016ffff [ 0.415483] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.421097] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.426677] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.432942] PCI host bridge to bus 0000:00 [ 0.436900] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff] [ 0.443480] pci_bus 0000:00: root bus resource [io 0xffffffff] [ 0.449202] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 0.455746] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.463442] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400 [ 0.463483] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff] [ 0.463500] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff] [ 0.463583] pci 0000:00:00.0: supports D1 [ 0.463595] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 0.463873] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 0.471746] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000 [ 0.471803] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff] [ 0.471965] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold [ 0.472235] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100 [ 0.472291] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff] [ 0.472434] pci 0000:01:00.1: supports D1 [ 0.472445] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold [ 0.472672] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 [ 0.472693] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01 [ 0.472749] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000] [ 0.479128] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000] [ 0.485808] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff] [ 0.492360] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff] [ 0.498917] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff] [ 0.505475] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff] [ 0.512014] pci 0000:00:00.0: PCI bridge to [bus 01] [ 0.516813] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff] [ 0.527528] clocksource: Switched to clocksource MIPS [ 0.533568] NET: Registered protocol family 2 [ 0.538782] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.545474] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.551657] TCP: Hash tables configured (established 1024 bind 1024) [ 0.557885] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.563483] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.569835] NET: Registered protocol family 1 [ 0.574056] PCI: CLS 0 bytes, default 32 [ 0.576946] Crashlog allocated RAM at address 0x3f00000 [ 0.583252] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.595322] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.600942] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.618821] io scheduler noop registered [ 0.622552] io scheduler deadline registered (default) [ 0.628513] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.637503] console [ttyS0] disabled [ 0.640998] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A [ 0.649730] console [ttyS0] enabled [ 0.656731] bootconsole [early0] disabled [ 0.665452] cacheinfo: Failed to find cpu0 device node [ 0.670702] cacheinfo: Unable to detect cache hierarchy for CPU 0 [ 0.677684] spi-mt7621 10000b00.spi: sys_freq: 193333333 [ 0.690872] m25p80 spi0.0: gd25q64 (8192 Kbytes) [ 0.695608] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.702108] Creating 4 MTD partitions on "spi0.0": [ 0.706986] 0x000000000000-0x000000020000 : "boot" [ 0.712761] 0x000000020000-0x0000007c0000 : "firmware" [ 0.768575] 2 tplink-fw partitions found on MTD device firmware [ 0.774609] 0x000000020000-0x0000001977ac : "kernel" [ 0.780591] 0x0000001977ac-0x0000007c0000 : "rootfs" [ 0.786391] mtd: device 3 (rootfs) set to be root filesystem [ 0.793480] 1 squashfs-split partitions found on MTD device rootfs [ 0.799827] 0x000000380000-0x0000007c0000 : "rootfs_data" [ 0.806184] 0x0000007c0000-0x0000007d0000 : "config" [ 0.812122] 0x0000007d0000-0x000000800000 : "factory" [ 0.818857] libphy: Fixed MDIO Bus: probed [ 0.834412] rt3050-esw 10110000.esw: link changed 0x00 [ 0.841215] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 0.851498] NET: Registered protocol family 10 [ 0.859819] Segment Routing with IPv6 [ 0.863659] NET: Registered protocol family 17 [ 0.868301] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 0.881452] 8021q: 802.1Q VLAN Support v1.8 [ 0.896837] VFS: Mounted root (squashfs filesystem) readonly on device 31:3. [ 0.905141] Freeing unused kernel memory: 200K [ 0.909676] This architecture does not have kernel memory protection. [ 1.903913] init: Console is alive [ 1.907678] init: - watchdog - [ 2.303300] random: fast init done [ 3.009143] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.214195] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.232069] init: - preinit - [ 4.664976] rt3050-esw 10110000.esw: link changed 0x00 [ 4.849495] random: procd: uninitialized urandom read (4 bytes read) [ 8.020325] rt3050-esw 10110000.esw: link changed 0x02 [ 8.163082] rt3050-esw 10110000.esw: link changed 0x00 [ 8.224043] jffs2: notice: (363) jffs2_build_xattr_subsystem: complete building xattr subsystem, 29 of xdatum (3 unchecked, 26 orphan) and 59 of xref (26 dead, 0 orphan) found. [ 8.245312] mount_root: switching to jffs2 overlay [ 8.274768] overlayfs: upper fs does not support tmpfile. [ 8.292747] urandom-seed: Seeding with /etc/urandom.seed [ 8.464046] procd: - early - [ 8.467073] procd: - watchdog - [ 9.055172] procd: - watchdog - [ 9.058846] procd: - ubus - [ 9.166040] random: ubusd: uninitialized urandom read (4 bytes read) [ 9.269191] random: ubusd: uninitialized urandom read (4 bytes read) [ 9.276970] random: ubusd: uninitialized urandom read (4 bytes read) [ 9.285335] procd: - init - [ 9.732058] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.745272] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 9.764413] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180 [ 9.772613] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d [ 9.785009] ip_tables: (C) 2000-2006 Netfilter Core Team [ 9.801178] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 9.878992] xt_time: kernel timezone is -0000 [ 10.042242] mt76_wmac 10300000.wmac: ASIC revision: 76280001 [ 10.059121] mt76_wmac 10300000.wmac: Firmware Version: _e2_mp [ 10.064965] mt76_wmac 10300000.wmac: Build Time: 20150211175503 [ 10.087550] firmware init done [ 10.258462] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 10.331161] PPP generic driver version 2.4.2 [ 10.338371] NET: Registered protocol family 24 [ 10.347208] kmodloader: done loading kernel modules from /etc/modules.d/* [ 10.938260] rt3050-esw 10110000.esw: link changed 0x02 [ 11.543895] urandom_read: 5 callbacks suppressed [ 11.543905] random: jshn: uninitialized urandom read (4 bytes read) [ 13.603278] rt3050-esw 10110000.esw: link changed 0x00 [ 16.733297] rt3050-esw 10110000.esw: link changed 0x02 [ 16.853948] rt3050-esw 10110000.esw: link changed 0x00 [ 19.575670] br-lan: port 1(eth0.1) entered blocking state [ 19.581242] br-lan: port 1(eth0.1) entered disabled state [ 19.587093] device eth0.1 entered promiscuous mode [ 19.592010] device eth0 entered promiscuous mode [ 19.646523] rt3050-esw 10110000.esw: link changed 0x02 [ 19.654055] br-lan: port 1(eth0.1) entered blocking state [ 19.659605] br-lan: port 1(eth0.1) entered forwarding state [ 19.665465] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 20.597793] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 24.070092] IPv6: ADDRCONF(NETDEV_UP): wlan0-1: link is not ready [ 24.094867] br-lan: port 2(wlan0-1) entered blocking state [ 24.100532] br-lan: port 2(wlan0-1) entered disabled state [ 24.106481] device wlan0-1 entered promiscuous mode [ 25.266935] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 34.801078] rt3050-esw 10110000.esw: link changed 0x00 [ 38.244151] rt3050-esw 10110000.esw: link changed 0x02


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1