Missing ath9k firmware (TP-Link TD-W8970 v1)

Hello!

After some hurdles with disappearing u-boot and other flash areas becoming zeroed out although I'm of the opinion of having followed the instructions closely, I have now managed to get OpenWrt 21.02.1 running.

However, ath9k complains about being unable to load the firmware for the Wifi.

[   15.570445] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[   15.576758] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[   15.604117] NET: Registered protocol family 24
[   15.623082] xt_time: kernel timezone is -0000
[   15.661693] urngd: v1.0.2 started.
[   15.791036] ifx_pcie_bios_map_irq port 0 dev 0000:01:00.0 slot 0 pin 1 
[   15.796325] ifx_pcie_bios_map_irq dev 0000:01:00.0 irq 144 assigned
[   15.802665] ath9k 0000:01:00.0: enabling device (0000 -> 0002)
[   15.817190] ath: phy0: Unable to initialize hardware; initialization status: -5
[   15.823367] ath9k 0000:01:00.0: Failed to initialize device
[   15.828868] ath9k: probe of 0000:01:00.0 failed with error -5
[   15.836307] kmodloader: done loading kernel modules from /etc/modules.d/*

Upon closer inspection, the firmware contains a bunch of zeroes:

root@OpenWrt:/# hexdump /lib/firmware/ath9k-eeprom-pci-0000\:01\:00.0.bin 
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0001000

Can anyone who has wifi working on this device provide me with this file?

Thanks in advance!

Are you sure you have installed 21.02.1 and not a snapshot because 21.02.1 is running Linux version 5.4?

The wifi infra driver mac80211 has been backported from 5.10 also in 21.02 branch

It was 5.10.68 in 21.02.1...

Ps. In master it is now already from kernel 5.15.8

You might first check from the mtd device that it really is zeroed out on flash, instead of checking the eeprom file created during boot. (If the caldata location is defined wrong, the file might be zeroes)

Even if somebody sends you the file, be prepared that the WiFi performance would be weak, as the device specific calibration would likely be off.

I'm pretty sure I grabbed the latest release that was linked on the corresponding wiki page.

As for mtd partitions, I've been wondering because they don't align with what's described on said wiki page. Here's mine, notably there's no radio partition:

root@OpenWrt:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 007a0000 00010000 "firmware"
mtd2: 0025cc4c 00010000 "kernel"
mtd3: 005433b4 00010000 "rootfs"
mtd4: 00140000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00030000 00010000 "boardconfig"

I now have several questions with no obvious answers :slight_smile:

Is each chip uniquely calibrated and the calibration data flashed in accordance to every modem, or is it a stock part of the OEM firmware?

Why's the partition table different on OpenWrt vs OEM, where is it stored and is it enough in theory to dump the original /dev/mtd6 into that file?
Edit: In case this file isn't supposed to be identical with the radio mtd partition of the OEM firmware, what else is it supposed to contain?

The calibration data is unique for each router device.

Typically the ath9k calibration data is stored in the same mtd partition as e.g. MAC addresses. So, the unique MACs, possible unique default wifi passwords etc., and the unique calibration data is written together. (typically the same info as in the printed labels on the router)

But as long as the calibration data format is right, the driver will likely accept it, although performance may vary. So, a data dump from another similar device might restore something.

Sounds like OpenWrt combines the last three OEM partitions into one "boardconfig". The sizes match.

OEM

|mtd3 |0x007c0000-0x007d0000 |config |XML string |user configuration|
|mtd4 |0x007d0000-0x007e0000 |romfile |n/a |???|
|mtd5 |0x007e0000-0x007f0000 |rom |n/a |???|
|mtd6 |0x007f0000-0x00800000 |radio |n/a |radio settings |

OpenWrt from wiki bootlog:

[    4.024000] 4 ofpart partitions found on MTD device spi32766.0
[    4.032000] Creating 4 MTD partitions on "spi32766.0":
[    4.036000] 0x000000000000-0x000000020000 : "u-boot"
[    4.044000] 0x000000020000-0x0000007c0000 : "firmware"
[    4.048000] 0x00000015b7b5-0x0000007c0000 : "rootfs"
[    4.052000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    4.068000] mtd: partition "rootfs" set to be root filesystem
[    4.072000] mtdsplit: no squashfs found in "spi32766.0"
[    5.072000] 0x0000007c0000-0x0000007d0000 : "config"
[    5.076000] 0x0000007d0000-0x000000800000 : "boardconfig"

/dev/mtd6 seems to contain incorrect data starting with lots of nul bytes, then some (left over?) data followed by 0xff. Seems that whatever was there is gone now...

root@OpenWrt:/# hexdump /dev/mtd6
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0010000 8888 8888 0014 2304 0014 2204 0056 5a04
0010010 0056 6604 0000 3d00 ffff ffff ffff ffff
0010020 ffff ffff ffff ffff ffff ffff ffff ffff
*
0020000 0000 0000 0000 0000 0000 0000 0000 0000
*
0030000

When I try to use tftp in u-boot, it also now fails to obtain the MAC address. I assume this is because the data is gone.

The eeprom file is data extracted from the flash chip by a firstboot script during the first boot after OpenWrt installation. Since your flash chip is corrupt there isn't much you can do. This area of the chip is written once during manufacture and neither the stock firmware or OpenWrt should ever change it.

Can someone who has the device in question (or a similar enough device) send me their file?