TP-LINK Deco S4 v2

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1900)
AC1900 Whole Home Mesh Wi-Fi System
Homepage Product page
Wikipedia TP-Link
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
Brand • Model • Rev TP-LINK Deco S4 v2
FCC ID TE7M4RV2
Type wireless system, wireless router
CPU1 checkY Qualcomm Atheros QCA9563
CPU1 Type MIPS 74Kc
CPU1 Speed 750 MHz
Flash1 Chip Brand? Model?
Flash1 Size 16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (SPI NOR)
RAM1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip Zentel A3R1GE40JBF
ETH chip1 Qualcomm Atheros QCA9563
Switch Qualcomm Atheros QCA8337N
Ethernet Port Count 2-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Stock bootloader U-Boot
Expansion IF types none specified
Power 12 VDC, 1.5 A
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)
Other
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
FCC approval date 09 October 2019
Physical
Dimensions 6.4 × 3.6 × 3.6 in (162.3 × 90.7 × 90.7 mm)
Radio 1
Chip1 Qualcomm Atheros QCA9563
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 3x3:3
Wireless Standard IEEE 802.11b/g/n
n-QAM up to 600 Mbps
802.11n up to 450 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 Qualcomm Atheros QCA9886
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 3x3:3
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 1300 Mbps
802.11n up to 450 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz

For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented TP-LINK devices with specifications, see TP-LINK.

• 600 Mbps - 3SS 2.4GHz 802.11n (40MHz chan., 256-QAM),
• 1300 Mbps - 3SS 5GHz 802.11ac (80MHz chan.) = AC1900 class

Flashing

Flashing OpenWrt

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 23.05.0
Current supported version: 25.12.1
LAN Hardware: Qualcomm Atheros QCA8337N
WLAN Hardware: Qualcomm Atheros QCA9563, Qualcomm Atheros QCA9886
WLAN Comment: MIMO 2x2:2 2.4Ghz, MIMO 2x2:2 5Ghz
Installation method(s):
see devicepage
Recovery method(s):
see devicepage
git • >> 
ath79: add support for TP-Link Deco S4
Add support for TP-Link Deco S4 wifi router

The label refers to the device as S4R and the TP-Link firmware
site calls it the Deco S4 v2. (There does not appear to be a v1)

Hardware (and FCC id) are identical to the Deco M4R v2 but the
flash layout is ordered differently and the OEM firmware encrypts
some config parameters (including the label mac address) in flash

In order to set the encrypted mac address, the wlan's caldata
node is removed from the DTS so the mac can be decrypted with
the help of the uencrypt tool and patched into the wlan fw
via hotplug

Specifications:
SoC: QCA9563-AL3A
RAM: Zentel A3R1GE40JBF
Wireless 2.4GHz: QCA9563-AL3A (main SoC)
Wireless 5GHz: QCA9886
Ethernet Switch: QCA8337N-AL3C
Flash: 16 MB SPI NOR

UART serial access (115200N1) on board via solder pads:
RX = TP1 pad
TX = TP2 pad
GND = C201 (pad nearest board edge)

The device's bootloader and web gui will only accept images that
were signed using TP-Link's RSA key, however a memory safety bug
in the bootloader can be leveraged to install openwrt without
accessing the serial console. See developer forum S4 support page
for link to a "firmware" file that starts a tftp client, or you
may generate one on your own like this:
```
python - > deco_s4_faux_fw_tftp.bin <<EOF
import sys
from struct import pack

b = pack('>I', 0x00008000) + b'X'*16 + b"fw-type:" \
  + b'x'*256 + b"S000S001S002" + pack('>I', 0x80060200) \

b += b"\x00"*(0x200-len(b)) \
  + pack(">33I", *[0x3c0887fc, 0x35083ddc, 0xad000000, 0x24050000,
                   0x3c048006, 0x348402a0, 0x3c1987f9, 0x373947f4,
                   0x0320f809, 0x00000000, 0x24050000, 0x3c048006,
                   0x348402d0, 0x3c1987f9, 0x373947f4, 0x0320f809,
                   0x00000000, 0x24050000, 0x3c048006, 0x34840300,
                   0x3c1987f9, 0x373947f4, 0x0320f809, 0x00000000,
                   0x24050000, 0x3c048006, 0x34840400, 0x3c1987f9,
                   0x373947f4, 0x0320f809, 0x00000000, 0x1000fff1,
                   0x00000000])

b += b"\xff"*(0x2A0-len(b)) + b"setenv serverip 192.168.0.2\x00"
b += b"\xff"*(0x2D0-len(b)) + b"setenv ipaddr 192.168.0.1\x00"
b += b"\xff"*(0x300-len(b)) + b"tftpboot 0x81000000 initramfs-kernel.bin\x00"
b += b"\xff"*(0x400-len(b)) + b"bootm 0x81000000\x00"
b += b"\xff"*(0x8000-len(b))

sys.stdout.buffer.write(b)
EOF
```

Installation:
1. Run tftp server on pc with static ip 192.168.0.2
2. Place openwrt "initramfs-kernel.bin" image in tftp root dir
3. Connect pc to router ethernet port1
4. While holding in reset button on bottom of router, power on router
5. From pc access router webgui at http://192.168.0.1
6. Upload deco_s4_faux_fw_tftp.bin
7. Router will load and execture in-memory openwrt
8. Switch pc back to dhcp or static 192.168.1.x
9. Flash openwrt sysupgrade image via luci/ssh at 192.168.1.1

Revert to stock:
Press and hold reset button while powering device to start the
bootloader's recovery mode, where stock firmware can be uploaded
via web gui at 192.168.0.1

Please note that one additional non-github commits is also needed:
firmware-utils: add tplink-safeloader support for Deco S4
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=TP-LINK_Deco_S4_v2&oldid=519527"