Missing ath9k firmware (TP-Link TD-W8970 v1)

Hello!

After some hurdles with disappearing u-boot and other flash areas becoming zeroed out although I'm of the opinion of having followed the instructions closely, I have now managed to get OpenWrt 21.02.1 running.

However, ath9k complains about being unable to load the firmware for the Wifi.

[   15.570445] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[   15.576758] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[   15.604117] NET: Registered protocol family 24
[   15.623082] xt_time: kernel timezone is -0000
[   15.661693] urngd: v1.0.2 started.
[   15.791036] ifx_pcie_bios_map_irq port 0 dev 0000:01:00.0 slot 0 pin 1 
[   15.796325] ifx_pcie_bios_map_irq dev 0000:01:00.0 irq 144 assigned
[   15.802665] ath9k 0000:01:00.0: enabling device (0000 -> 0002)
[   15.817190] ath: phy0: Unable to initialize hardware; initialization status: -5
[   15.823367] ath9k 0000:01:00.0: Failed to initialize device
[   15.828868] ath9k: probe of 0000:01:00.0 failed with error -5
[   15.836307] kmodloader: done loading kernel modules from /etc/modules.d/*

Upon closer inspection, the firmware contains a bunch of zeroes:

root@OpenWrt:/# hexdump /lib/firmware/ath9k-eeprom-pci-0000\:01\:00.0.bin 
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0001000

Can anyone who has wifi working on this device provide me with this file?

Thanks in advance!

Are you sure you have installed 21.02.1 and not a snapshot because 21.02.1 is running Linux version 5.4?

The wifi infra driver mac80211 has been backported from 5.10 also in 21.02 branch

It was 5.10.68 in 21.02.1...

Ps. In master it is now already from kernel 5.15.8

You might first check from the mtd device that it really is zeroed out on flash, instead of checking the eeprom file created during boot. (If the caldata location is defined wrong, the file might be zeroes)

Even if somebody sends you the file, be prepared that the WiFi performance would be weak, as the device specific calibration would likely be off.

I'm pretty sure I grabbed the latest release that was linked on the corresponding wiki page.

As for mtd partitions, I've been wondering because they don't align with what's described on said wiki page. Here's mine, notably there's no radio partition:

root@OpenWrt:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 007a0000 00010000 "firmware"
mtd2: 0025cc4c 00010000 "kernel"
mtd3: 005433b4 00010000 "rootfs"
mtd4: 00140000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00030000 00010000 "boardconfig"

I now have several questions with no obvious answers :slight_smile:

Is each chip uniquely calibrated and the calibration data flashed in accordance to every modem, or is it a stock part of the OEM firmware?

Why's the partition table different on OpenWrt vs OEM, where is it stored and is it enough in theory to dump the original /dev/mtd6 into that file?
Edit: In case this file isn't supposed to be identical with the radio mtd partition of the OEM firmware, what else is it supposed to contain?

The calibration data is unique for each router device.

Typically the ath9k calibration data is stored in the same mtd partition as e.g. MAC addresses. So, the unique MACs, possible unique default wifi passwords etc., and the unique calibration data is written together. (typically the same info as in the printed labels on the router)

But as long as the calibration data format is right, the driver will likely accept it, although performance may vary. So, a data dump from another similar device might restore something.

Sounds like OpenWrt combines the last three OEM partitions into one "boardconfig". The sizes match.

OEM

|mtd3 |0x007c0000-0x007d0000 |config |XML string |user configuration|
|mtd4 |0x007d0000-0x007e0000 |romfile |n/a |???|
|mtd5 |0x007e0000-0x007f0000 |rom |n/a |???|
|mtd6 |0x007f0000-0x00800000 |radio |n/a |radio settings |

OpenWrt from wiki bootlog:

[    4.024000] 4 ofpart partitions found on MTD device spi32766.0
[    4.032000] Creating 4 MTD partitions on "spi32766.0":
[    4.036000] 0x000000000000-0x000000020000 : "u-boot"
[    4.044000] 0x000000020000-0x0000007c0000 : "firmware"
[    4.048000] 0x00000015b7b5-0x0000007c0000 : "rootfs"
[    4.052000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    4.068000] mtd: partition "rootfs" set to be root filesystem
[    4.072000] mtdsplit: no squashfs found in "spi32766.0"
[    5.072000] 0x0000007c0000-0x0000007d0000 : "config"
[    5.076000] 0x0000007d0000-0x000000800000 : "boardconfig"

/dev/mtd6 seems to contain incorrect data starting with lots of nul bytes, then some (left over?) data followed by 0xff. Seems that whatever was there is gone now...

root@OpenWrt:/# hexdump /dev/mtd6
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0010000 8888 8888 0014 2304 0014 2204 0056 5a04
0010010 0056 6604 0000 3d00 ffff ffff ffff ffff
0010020 ffff ffff ffff ffff ffff ffff ffff ffff
*
0020000 0000 0000 0000 0000 0000 0000 0000 0000
*
0030000

When I try to use tftp in u-boot, it also now fails to obtain the MAC address. I assume this is because the data is gone.

The eeprom file is data extracted from the flash chip by a firstboot script during the first boot after OpenWrt installation. Since your flash chip is corrupt there isn't much you can do. This area of the chip is written once during manufacture and neither the stock firmware or OpenWrt should ever change it.

Can someone who has the device in question (or a similar enough device) send me their file?

I have the same problem, the file content is:

root@OpenWrt:~# hexdump /dev/mtd6
0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
000f100 e8de 2786 9cc8 ffff ffff ffff ffff ffff
000f110 ffff ffff ffff ffff ffff ffff ffff ffff
*
000f200 02bd 2ffb 0000 0000 ffff ffff ffff ffff
000f210 ffff ffff ffff ffff ffff ffff ffff ffff
*
0010000 8888 8888 0014 2304 0014 2304 0056 6604
0010010 0056 6504 0000 0025 0000 0025 0000 0300
0010020 ffff ffff ffff ffff ffff ffff ffff ffff
*
0020000 0003 7fe0 0049 ffff ffff ffff ffff ffff
0020010 ffff ffff ffff ffff ffff ffff ffff ffff
*
0021000 a55a 0000 0003 6000 168c 002d 6008 0001
0021010 0280 602c 168c a199 5000 168c 002e 5008
0021020 0001 0280 502c 168c a199 5064 8cc0 0504
0021030 570c 3f01 2200 506c 3c11 0003 4004 050b
0021040 004a 4074 0003 0000 4000 5001 01c2 6034
0021050 0044 0000 510c 2010 0006 5164 1412 ff24
0021060 5168 17ff 0015 5068 2010 0019 ffff ffff
0021070 ffff ffff ffff ffff ffff ffff ffff ffff
*
0021100 02d7 5fa3 e004 1601 0000 001f 0003 7fbe
0021110 efe8 0303 0000 0000 0000 0009 1b00 0401
0021120 fbfa fa00 0000 0000 0000 0000 0000 0000
0021130 0000 0000 0000 0000 0000 0000 0000 0000
*
0021160 0000 0010 0000 0010 0000 0210 0000 2d20
0021170 2000 00e2 0002 0e1c ffff 0201 0000 0000
0021180 0600 0e0e 0200 0000 002d 0003 0303 0303
0021190 0300 0000 0000 0000 0000 0000 0000 0000
00211a0 0000 0000 0000 0000 0000 0000 0000 0080
00211b0 0000 0000 0000 0000 0000 0000 0000 0000
00211c0 0000 0070 89ac 0a76 0000 0000 0000 0000
00211d0 7976 0000 0000 0000 0000 8876 0000 0000
00211e0 0000 0000 7076 0000 0000 0000 0000 0876
00211f0 0000 0000 0000 0000 7976 0000 0000 0000
0021200 0000 9076 0000 0000 0000 0000 4076 0000
0021210 0000 0000 0000 0676 0000 0000 0000 0000
0021220 7976 0000 0000 0000 0000 6076 0000 0000
0021230 0000 0000 4876 0000 0000 0000 0000 0876
0021240 0000 0000 0000 0000 7976 0000 0000 0000
0021250 0000 9076 0000 0000 0000 0000 7876 0000
0021260 0000 0000 0000 0876 0000 0000 0000 0000
0021270 7976 0000 0000 0000 0000 9876 0000 0000
0021280 0000 0000 8076 0000 0000 0000 0000 0876
0021290 0000 0000 0000 0000 7976 0000 0000 0000
00212a0 0000 a076 0000 0000 0000 0000 b039 0000
00212b0 0000 0000 0000 7024 2424 24b8 2424 2424
00212c0 ff00 0000 0070 2424 1e1c 8924 241e 1cac
00212d0 2424 1e1c 7024 2424 2422 1e18 1289 2424
00212e0 2424 221e 1812 a222 2222 2222 1e18 1270
00212f0 2222 2222 201c 160e 8922 2222 2220 1c16
0021300 0eac 2222 2222 201c 160e 1112 1517 4142
0021310 4547 3132 3537 7020 7560 a220 0000 7020
0021320 7560 a220 0000 701c 755c a216 0000 701c
0021330 755c a216 0000 701a 755c a214 0000 701a
0021340 755c a214 0000 7a16 7f58 9358 9810 7a16
0021350 7f58 9358 9810 703c 757c ac3c b83c 703c
0021360 757c ac3c b83c 703c 757c ac3c 0000 703c
0021370 757c ac3c 0000 703c 757c ac3c 0000 703c
0021380 757c ac3c 0000 7a3c 7f7c 937c a23c 7a3c
0021390 7f7c 937c a23c 701c 755c ac1c 0000 701c
00213a0 755c ac1c 0000 701c 755c ac1c 0000 701c
*
00213c0 755c ac1c 0000 7a1c 7f5c 935c a21c 7a1c
00213d0 7f5c 935c a21c 00ff ffff ffff ffff ffff
00213e0 ffff ffff ffff ffff ffff ffff ffff ffff
*
0030000

Based on your file hexdump, maybe you don't have that problem...

The section starting at 0x21000 looks like a valid ath9k calibration data. (Looks similar as in my WNDR3700 with ath9k.)

Sorry, I mean I have a similar problem, same router, same firmware but the wifi device could not be seen

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 007a0000 00010000 "firmware"
mtd2: 0025c946 00010000 "kernel"
mtd3: 005436b8 00010000 "rootfs"
mtd4: 00140000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00030000 00010000 "boardconfig"