TP-Link Archer C20 (EU) V5
TP-Link Archer C20(EU) v5 is a router with a 5-port FE switch and non-detachable antennas, based on MediaTek MT7628AN + MT7610EN. It has 2 2.4GHz antennas (left and right) and one 5GHz (center). Both 2.4 antennas are soldered to the board, the 5GHz is connected using an U.FL connector.
Supported Versions
Hardware Highlights
Installation
Create Factory image
As all installation methods require a U-Boot to be integrated into the Image (and we do not ship one with the image) we are not able to create an image in the OpenWrt build-process.
Download a TP-Link image from their Website(pay attention to regional match, i.e. if the router is EU-based, download firmware file for EU) and a OpenWrt sysupgrade image for the device and build yourself a factory image like following:
TP-Link image: tpl.bin OpenWrt sysupgrade image: owrt.bin > dd if=tpl.bin of=boot.bin bs=131584 count=1 > cat owrt.bin >> boot.bin
Installing via Web-UI
Upload the boot.bin via TP-Links firmware upgrade tool in the web-interface.
Installing via Recovery
Activate Web-Recovery by beginning the upgrade Process with a Firmware-Image from TP-Link. After starting the Firmware Upgrade, wait ~3 seconds (When update status is switching to 0%), then disconnect the power supply from the device. Upgrade flag (which activates Web-Recovery) is written before the OS-image is touched and removed after write is succesful, so this procedure should be safe.
Plug the power back in. It will come up in Recovery-Mode on 192.168.0.1. When active, all LEDs but the WPS LED are off. Remeber to assign yourself a static IP-address as DHCP is not active in this mode.
The boot.bin can now be uploaded and flashed using the web-recovery.
Installing via TFTP
Prepare an image like following (Filenames from factory image steps apply here)
> dd if=/dev/zero of=tp_recovery.bin bs=196608 count=1 > dd if=tpl.bin of=tmp.bin bs=131584 count=1 > dd if=tmp.bin of=boot.bin bs=512 skip=1 > cat boot.bin >> tp_recovery.bin > cat owrt.bin >> tp_recovery.bin
Place tp_recovery.bin in root directory of TFTP server and listen on 192.168.0.66/24.
Connect router LAN ports with your computer and power up the router while pressing the reset button. The router will download the image via tftp and after ~1 Minute reboot into OpenWrt.
U-Boot CLI
U-Boot CLI can be activated by holding down '4' on bootup.
Dual U-Boot
This is TP-Link MediaTek device with a split-uboot feature design like a TP-Link Archer C50 v4. The first (factory-uboot) provides recovery via TFTP and HTTP, jumping straight into the second (firmware-uboot) if no recovery needs to be performed. The firmware-uboot unpacks and executed the kernel.
Web-Recovery
TP-Link integrated a new Web-Recovery like the one on the Archer C7v4 / TL-WR1043v5 / Archer C50v4. Stock-firmware sets a flag in the “romfile” partition before beginning to write and removes it afterwards. If the router boots with this flag set, bootloader will automatically start Web-recovery and listens on 192.168.0.1. This way, the vendor-firmware or an OpenWrt factory image can be written.
By doing the same while performing sysupgrade, we can take advantage of the Web-recovery in OpenWrt.
It is important to note that Web-Recovery is only based on this flag. It can't detect e.g. a crashing kernel or other means. Once activated it won't boot the OS before a recovery action (either via TFTP or HTTP) is performed. This recovery-mode is indicated by an illuminated WPS-LED on boot.
Buttons
→ hotplug_lede on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.
The TP-Link Archer C20(EU) v5 has the following buttons:
| BUTTON | Event |
|---|---|
| Reset | reset |
| Wi-Fi/WPS | wps |
Hardware
Info
| Architecture | MIPS |
|---|---|
| Vendor | MediaTek |
| Bootloader | U-Boot |
| System-On-Chip | MediaTek MT7628AN - rampis mt76x8 |
| CPU/Speed | 580 MHz |
| Flash-Chip | cFeon QH64A-104HIP |
| Flash size | 8 MiB |
| RAM | 64 MiB |
| Wireless 1 | MT7628AN 2.4GHz |
| Wireless 2 | MT7610EN 5GHz |
| Ethernet | 5 x 10/100 Mbit/s w/ vlan support |
| USB | SoC capable, but not in the board |
| Serial | Yes |
| JTAG | No |
Photos
Opening the case
Remove two screws under the devices, then pop the black top off (needs some force to get it off, try to screw the screws back in 1 turn and push against them. You'll likely break some tabs, this case is not designed to be opened)
Serial
→ port.serial general information about the serial port, serial port cable, etc.
There should be 4 pads (J1) looking from the font on right side, where pin 1 (marked with silk-screen both with a thicker line and with a triangle) is TX.
FRONT | TX - RX - GND - VCC | BACK
Bootlogs
OEM bootlog
... TBD ...
OpenWrt bootlog
[ 0.000000] Linux version 5.4.179 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16495-bf0c965af0)) #0 Wed Feb 16 20:29:10 2022 [ 0.000000] Board has DDR2 [ 0.000000] Analog PMU set to hw control [ 0.000000] Digital PMU set to hw control [ 0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc) [ 0.000000] MIPS: machine is TP-Link Archer C20 v5 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] On node 0 totalpages: 16384 [ 0.000000] Normal zone: 144 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 16384 pages, LIFO batch:3 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240 [ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear) [ 0.000000] Writing ErrCtl register=0002f819 [ 0.000000] Readback ErrCtl register=0002f819 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 57444K/65536K available (5093K kernel code, 208K rwdata, 636K rodata, 1220K init, 205K bss, 8092K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] intc: using register map from devicetree [ 0.000000] random: get_random_bytes called from 0x805cfa28 with crng_init=0 [ 0.000000] CPU Clock: 580MHz [ 0.000000] timer_probe: no matching timers found [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns [ 0.000009] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns [ 0.007574] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048) [ 0.045464] pid_max: default: 32768 minimum: 301 [ 0.050104] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.057123] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.070539] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 0.079963] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.086612] pinctrl core: initialized pinctrl subsystem [ 0.094549] NET: Registered protocol family 16 [ 0.203310] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000 [ 0.358414] PCI host bridge /pcie@10140000 ranges: [ 0.362994] MEM 0x0000000020000000..0x000000002fffffff [ 0.368022] IO 0x0000000010160000..0x000000001016ffff [ 0.394884] PCI host bridge to bus 0000:00 [ 0.398864] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff] [ 0.405463] pci_bus 0000:00: root bus resource [io 0x10160000-0x1016ffff] [ 0.412090] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 0.418639] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.426337] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400 [ 0.432120] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff] [ 0.438138] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff] [ 0.444256] pci 0000:00:00.0: supports D1 [ 0.448060] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 0.455304] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 0.463213] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000 [ 0.469033] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff] [ 0.475184] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold [ 0.481291] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100 [ 0.487110] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff] [ 0.493249] pci 0000:01:00.1: supports D1 [ 0.497052] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold [ 0.504836] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 [ 0.511211] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01 [ 0.517598] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000] [ 0.523946] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000] [ 0.530667] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff] [ 0.537220] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff] [ 0.543784] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff] [ 0.550328] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff] [ 0.556878] pci 0000:00:00.0: PCI bridge to [bus 01] [ 0.561664] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff] [ 0.572862] clocksource: Switched to clocksource MIPS [ 0.578791] thermal_sys: Registered thermal governor 'step_wise' [ 0.579192] NET: Registered protocol family 2 [ 0.589336] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.597227] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.605327] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.612698] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.619496] TCP: Hash tables configured (established 1024 bind 1024) [ 0.625772] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.632092] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.639086] NET: Registered protocol family 1 [ 0.643355] PCI: CLS 0 bytes, default 32 [ 0.651851] workingset: timestamp_bits=14 max_order=14 bucket_order=0 [ 0.666099] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.671735] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.696673] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252) [ 0.707121] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.712802] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.718453] mt7621_gpio 10000600.gpio: registering 32 gpios [ 0.724150] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.733119] printk: console [ttyS0] disabled [ 0.737281] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A [ 0.746014] printk: console [ttyS0] enabled [ 0.754421] printk: bootconsole [early0] disabled [ 0.765355] spi-mt7621 10000b00.spi: sys_freq: 193333333 [ 0.780442] spi-nor spi0.0: en25qh64 (8192 Kbytes) [ 0.785448] 7 fixed-partitions partitions found on MTD device spi0.0 [ 0.791914] Creating 7 MTD partitions on "spi0.0": [ 0.796799] 0x000000000000-0x000000030000 : "factory-uboot" [ 0.803579] 0x000000030000-0x000000050000 : "boot" [ 0.809630] 0x000000050000-0x0000007c0000 : "firmware" [ 0.819583] 2 tplink-fw partitions found on MTD device firmware [ 0.825667] Creating 2 MTD partitions on "firmware": [ 0.830731] 0x000000000000-0x0000001e89d1 : "kernel" [ 0.836932] 0x0000001e89d4-0x000000770000 : "rootfs" [ 0.842958] mtd: device 4 (rootfs) set to be root filesystem [ 0.850856] 1 squashfs-split partitions found on MTD device rootfs [ 0.857220] 0x000000500000-0x000000770000 : "rootfs_data" [ 0.863839] 0x0000007c0000-0x0000007d0000 : "config" [ 0.870009] 0x0000007d0000-0x0000007e0000 : "rom" [ 0.875897] 0x0000007e0000-0x0000007f0000 : "romfile" [ 0.882132] 0x0000007f0000-0x000000800000 : "radio" [ 0.904008] rt3050-esw 10110000.esw: link changed 0x00 [ 0.911242] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5 [ 0.921772] NET: Registered protocol family 10 [ 0.930815] Segment Routing with IPv6 [ 0.934742] NET: Registered protocol family 17 [ 0.939353] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 0.952517] 8021q: 802.1Q VLAN Support v1.8 [ 0.966970] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 0.981056] Freeing unused kernel memory: 1220K [ 0.985682] This architecture does not have kernel memory protection. [ 0.992223] Run /sbin/init as init process [ 1.204862] random: fast init done [ 1.904086] init: Console is alive [ 1.907963] init: - watchdog - [ 2.981531] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.152634] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.170563] init: - preinit - [ 4.850200] random: jshn: uninitialized urandom read (4 bytes read) [ 4.942469] random: jshn: uninitialized urandom read (4 bytes read) [ 5.171452] random: jshn: uninitialized urandom read (4 bytes read) [ 5.739688] rt3050-esw 10110000.esw: link changed 0x00 [ 5.945307] urandom_read: 2 callbacks suppressed [ 5.945317] random: procd: uninitialized urandom read (4 bytes read) [ 9.309710] rt3050-esw 10110000.esw: link changed 0x01 [ 10.180196] jffs2: notice: (470) jffs2_build_xattr_subsystem: complete building xattr subsystem, 9 of xdatum (0 unchecked, 1 orphan) and 10 of xref (1 dead, 0 orphan) found. [ 10.198031] mount_root: switching to jffs2 overlay [ 10.210143] overlayfs: upper fs does not support tmpfile. [ 10.223268] urandom-seed: Seeding with /etc/urandom.seed [ 10.349228] procd: - early - [ 10.352265] procd: - watchdog - [ 10.962564] procd: - watchdog - [ 10.967648] procd: - ubus - [ 11.039929] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.049153] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.056278] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.066185] procd: - init - [ 12.216382] kmodloader: loading kernel modules from /etc/modules.d/* [ 12.262412] Loading modules backported from Linux version v5.10.85-0-ge4f2aee6612e [ 12.270193] Backport generated by backports.git v5.10.85-1-0-gf988973f [ 12.337773] xt_time: kernel timezone is -0000 [ 12.456816] mt76_wmac 10300000.wmac: ASIC revision: 76280001 [ 12.616190] urngd: v1.0.2 started. [ 12.825370] crng init done [ 12.828121] random: 1 urandom warning(s) missed due to ratelimiting [ 13.506773] mt76_wmac 10300000.wmac: Firmware Version: 20151201 [ 13.512879] mt76_wmac 10300000.wmac: Build Time: 20151201183641 [ 13.552878] mt76_wmac 10300000.wmac: firmware init done [ 13.729561] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 13.852327] PPP generic driver version 2.4.2 [ 13.865731] NET: Registered protocol family 24 [ 13.910213] mt76x0e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4 [ 13.916774] mt76x0e 0000:01:00.0: ASIC revision: 76100002 [ 14.185585] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00 [ 14.466619] mt76x0e 0000:01:00.0: EEPROM ver:02 fae:00 [ 14.479599] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 14.495116] kmodloader: done loading kernel modules from /etc/modules.d/* [ 20.474369] rt3050-esw 10110000.esw: link changed 0x00 [ 24.093075] rt3050-esw 10110000.esw: link changed 0x01
Notes
WAN LED in this devices is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED.