TP-Link Archer C2 AC750
Hardware Highlights
OpenWrt support
Hardware details
| Instruction set | MIPS |
|---|---|
| Vendor | MediaTek |
| bootloader | U-Boot |
| System-On-Chip | MT7620A |
| CPU/Speed | 580 MHz |
| Flash-Chip | Winbond 25Q64BVSIG docs |
| Flash size | 8192 KiB |
| RAM | 64 MiB |
| Wireless No1 | SoC-integrated: MT7620A 2.4GHz 802.11bgn |
| Wireless No2 | On-board chip: MT7610EN 5GHz 802.11ac |
| switch | RTL8367RB Gigabit Switch |
| USB | Yes 1 x 2.0 |
| Serial | Yes |
Firmware downloads
Installation
→ Install OpenWrt (generic explanation)
The following procedure is known to work only on the v1 and v1.1 models. Please, don't try this on any other revision. You can check which version your C2 is by looking at the bottom of it or, in the router's web interface, Status page, Hardware Version information, if you are using stock firmware.
As per the instructions in the git commit adding support for the Archer C2 AC750 v1, you need an OpenWrt image with integrated bootloader when flashing through TFTP (TP-Link pretty much always has the bootloader integrated in their firmwares). OpenWrt 19.07.1 can be flashed via TFTP using an unofficial recovery image provided here; however, if you are familiar with the command line and have access to a Linux box, it's recommended you build such an image yourself, as you'll be able to use the latest OpenWrt stable release. See instructions below.
Creating an OpenWrt TFTP recovery image
The following instructions might break your router. Use only the provided recovery image if you don't understand what is going on.
Avoid renaming any arbitrary image to ArcherC2V1_tp_recovery.bin. Providing an image without proper bootloader to TFTP recovery bricks your router and needs flashing with a SPI programmer.
If you feel uncomfortable doing this, grab the prepped 19.07.1 image linked to above and skip this section.
The C2v1 TFTP recovery overwrites the uboot partition, hence it must be included in a recovery.bin An official stock TPLink firmware file has a 512 byte header, which needs to be stripped for TFTP. You need access to a Linux box for this procedure (Windows Subsystem for Linux ('WSL') might work as well). Instructions below are taken from the git commit that added support into OpenWrt.
1. Download a stock TP-Link Firmware file from the TP-Link homepage.
2. Extract u-boot from the binary file:
$ dd if=c2v1_stock_firmware.bin of=c2v1_uboot.bin bs=1 skip=512 count=131072
3. Now merge the OpenWrt sysupgrade image and the u-boot into one binary:
$ cat c2v1_uboot.bin openwrt-squashfs-sysupgrade.bin > ArcherC2V1_tp_recovery.bin
Flashing OpenWRT
- Set your computer's IP to a static 192.168.0.66 address (subnet mask 255.255.255.0 and default gateway to 192.168.0.1).
- To flash the recovery image, start a TFTP server from IP address 192.168.0.66 and serve the recovery image named 'ArcherC2V1_tp_recovery.bin'.
- Connect your device to the LAN port, then press the WPS/Reset button and power it up. Keep pressing the WPS/Reset button for 10 seconds
- The device will try to download the recovery image and flash it. This might take up to 20-25 minutes to finish. When done, the router will reboot itself.
- After reboot, you can access OpenWrt at 192.168.1.1. From here on out, you can simply use sysupgrade with the vanilla OpenWrt images to upgrade.
Remember to allow access to your TFTP server program in firewall settings. (In case of Windows Firewall, it prompts you in first run.)
If you encounter timeouts, you might want to put a switch between your router and client to facilitate the flashing process. The tips below might not be needed after that.
Also, you might have to lower your ethernet link to 10 Mbps Half Duplex in order to finish the process.
A few users reported that flashing via TFTP is not always possible on some devices. Apparently there was a slight hardware change in some produced devices that causes TFTP inside u-boot to expect RFC7440 behavior without actually requesting RFC7440 behavior. There is a forum thread with a detailed analysis of the issue and possible solutions.
TLDR:
If you want to stick to flashing via TFTP:
- on Windows use TFTPD32/64 with the option
Use anticipation window of 1000 bytes - on every other platform you could use apardyl/PyTFTPd with the patch provided by
pbasistain the forum thread
Otherwise your best option is to establish a serial connection to the device and then load the image via kermit (either directly copying it into the flash or booting an initramfs variant from memory and then flashing via OpenWrt).
Other variants and more information is provided in the aforementioned forum thread.
Similar instructions can be found as posted by OpenWrt forum member yoq here. Old recovery image c2_recovery.zip can be downloaded here.
Flash Layout
| TP-Link Archer C2 AC750 v1 flash layout | ||||||||
|---|---|---|---|---|---|---|---|---|
| Layer0 | raw NOR flash memory chip (Spansion S25Fl064K spi0.0: s25fl064k) 8192 KiB | |||||||
| Layer1 | mtd0 u-boot | mtd1 firmware 7808 KiB | mtd5 config | mtd6 rom | mtd7 romfile | mtd8 radio | ||
| Layer2 | mtd2 kernel 1690 KiB* | mtd3 rootfs 6117 KiB* | ||||||
| mountpoint | / | |||||||
| filesystem | OverlayFS | |||||||
| Layer3 | mtd4 rootfs_data 1448 KiB* | |||||||
| Size in KiB | 128 KiB | 1690 KiB | 4669 KiB* | 1448 KiB* | 64 KiB | 64 KiB | 64 KiB | 64 KiB |
| Name | u-boot | kernel | rootfs_data | |||||
| mountpoint | none | none | /rom | /overlay | none | none | none | none |
| filesystem | none | none | SquashFS | JFFS2 | none | none | none | none |
* These seemingly irregular values are the result of the dynamic mtd splitter resizing the OpenWrt kernel and rootfs 'partitions' as needed. Sizes are extracted from a personalised build, so kernel, rootfs and rootfs_data values may slightly differ on stock OpenWrt builds (and also between 19.07, 21.02 and master e.g.). Other partition sizes should be identical.
Back to OEM firmware
The following procedure is known to work on the v1 and possibly on v1.1 models. Please, don't try this on any other revision. You can check which version your C2 is by looking at the bottom of it or, in the router's web interface. The following instructions might break your router. It may be cautious to make a full backup of your device using the methods mentioned in this article here.
Original instructions can be found as posted by OpenWrt forum member Dbzafgt here (post #346). The same procedure was also detailed by OpenWrt forum member alizes here.
1. Download the OEM firmware : ArcherC2_v1_xxxxxx.bin
2. In a Linux terminal, create a new stripped binary based on this original OEM firmware :
$ dd if=ArcherC2_v1_xxxxxx.bin of=stripped_OEM.bin skip=257 bs=512
3. In the Luci Web UI, flash this new stripped binary. OpenWrt will then attempt to check this binary and will display warnings. You need to force the flashing at this step.
4. The OEM firmware will start flashing and its web admin will be at 192.168.0.1 after.
Hardware
See the hardware details tab at the top of the page.
Pictures of the board
The case is a bit hard to open, start with the two screws. Then start prying the lid from the bottom of the case, starting at the side with the ethernet connectors, There are 11 notches all around keeping the lid in place. They come loose by pushing the bottom part of the case outward.
v1
v1.1
Serial
At least one user has reported 3.3 V logic levels, not TTL (5 V) levels
| Serial connection parameters for Archer C2 AC750 v1 | 115200, 8N1 |
|---|
The Serial connector is labeled 'J2', and is wired as follows. See picture below for the location on the board.
Ethernet side of PCB
VCC ... not used.
GND -------------- GND of Serial adapter
RX <-- input <-- Tx of Serial adapter
TX --> output --> Rx of Serial adapter
Led side of PCB
Where 'RX' connects to the output of your serial adapter, and TX, connects to the input of your serial adapter. You can verify this, by using a volt meter to check that 'TX' pin is at Vcc level, and the RX pin is at GND level. The bootloader of the stock firmware can be interrupted by pressing a digit from 1 .. 7, press '4' for the u-boot prompt. From the serial console, you can login to the running Linux based stock firmware with: username 'admin' and password '1234'.
Soldering
The GND pin may be a bit hard to solder, i needed to scratch away some paint from the PCB to make a large enough connection. On some versions you need to solder 2 bridges to get serial port working. You need good soldering experiences for that!
Board picture (v1)
UART isn't populated, it's indicated by a red rectangle on the picture below (click for bigger size).
Switch
The C2 uses a external GBit switch, connected by MDIO bus. Network traffic to the CPU is passed through the internal switch of the MT7620A SoC:
+---------------+
| MT7620A CPU |
+---------------+
|
6
+----------------------------+
| MT7620A |
| embedded switch |
+----------------------------+
unused 5 (RGMII)
5x FastEth PHY |
|
6 (RGMII)
+----------------------------+
| RTL8367RB |
| switch & 5x GBit PHY |
+----------------------------+
0 1 2 3 4
| | | | |
WAN LAN1 LAN2 LAN3 LAN4
Earlier versions of this article suggested “the driver for OpenWrt” (for the RTL8367R(B) switch chip) would have limited the range of usable 802.1q VLAN IDs to 1 – 31.
While this may have been true for some earlier builds (could not confirm immediately), OpenWrt 21.02.3 (at least) no longer seems to suffer from such hard limit. There is still a soft limit which, for some reason, makes VLAN IDs above 31 unusable and non-working by default, but you can override this limit and use the full range of VLAN IDs by setting the enable_vlan4k option to 1 in the switch1 section of the /etc/config/network configuration file, as follows:
config switch
option name 'switch1'
option reset '1'
option enable_vlan '1'
option enable_vlan4k '1'
If you edit the switch VLAN configuration in LuCI, it may add the enable_vlan4k configuration directive automatically for you. But for manual edits, you need to do it yourself to be able to get the higher-numbered VLAN IDs work.
OpenWrt releases 21.02.0 — 21.02.3 (the latest official release as of this writing) appear to have a regression in their default network configuration which makes the inner (MT7620A) switch visible in LuCI as switch0 for no real purpose, with a pseudo VLAN configuration that makes no sense.
The router works as it should but configuring VLANs through LuCI may not work as expected and only the outer switch (switch1, RTL8367B) configuration is relevant. A bug report has been filed on this by the ID FS#3879 - Incorrect switch config for TP-Link Archer C2 AC750 #8871.
Until fixed in later releases, you can work around the issue by removing the extraneous switch0 configuration from the file /etc/config/network. This is best accomplished by issuing the following commands in the command line:
uci delete network.@switch[0] uci commit reboot
UBoot
Version: 1.1.3 (Dec 4 2013) Ralink UBoot Version 4.1.2.0
MT7620 # bdinfo boot_params = 0x83F4FFB0 memstart = 0x80000000 memsize = 0x04000000 flashstart = 0x00000000 flashsize = 0x00800000 flashoffset = 0x00000000 ethaddr = xx:xx:xx:xx:xx:xx ip_addr = 192.168.0.1 baudrate = 115200 bps
Push '4' to enter UBoot
GPIO
| Color | Name | GPIO | Polarity |
|---|---|---|---|
| Green | LAN | 1 | Active low |
| Green | USB | 11 | Active low |
Forum Threads
The following forum threads have been used to discuss the C2:
Thanks to everyone that contribute to make this possible.