[SOLVED]Got stuck unbricking TP-Link W8970_v1 - Do i miss something?

Installing and Using OpenWrt
1

Hello,

i somehow bricked my TP-Link W8970_v1 Router when i flashed a new homemade Snapshot-build :frowning:

I cannot connect via LAN Port to it. Everytime trying it , i don get an IP.
Using a static IP doesn't help :frowning:

When conneting via serial cable i find the device bootlooping:

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-LANTIQ-v-2.3.08 (Sep 29 2014 - 14:06:03)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: e8-94-f6-01-23-45  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
        Uncompressing ... 
Starting kernel ...

[    0.000000] Linux version 4.4.92 (buildbot@debian8) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3560-79f57e422d) ) #0 Tue Oct 17 17:46:20 2017
[    0.000000] SoC: xRX200 rev 1.2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)
[    0.000000] MIPS: machine is TDW8970 - TP-LINK TD-W8970
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyLTQ0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=000111a0
[    0.000000] Readback ErrCtl register=000111a0
[    0.000000] Memory: 58432K/65536K available (3923K kernel code, 161K rwdata, 884K rodata, 1224K init, 213K bss, 7104K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] Setting up vectored interrupts
[    0.000000] CPU Clock: 500MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns
[    0.000010] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns
[    0.007857] Calibrating delay loop... 332.54 BogoMIPS (lpj=665088)
[    0.042316] pid_max: default: 32768 minimum: 301
[    0.047159] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.053722] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.066721] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.076364] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.082577] pinctrl core: initialized pinctrl subsystem
[    0.089151] NET: Registered protocol family 16
[    0.098140] pinctrl-xway 1e100b10.pinmux: Init done
[    0.103681] dma-xway 1e104100.dma: Init done - hw rev: 7, ports: 7, channels: 28
[    0.213752] dcdc-xrx200 1f106a00.dcdc: Core Voltage : 1016 mV
[    0.219505] Can't analyze schedule() prologue at 80009078
[    0.344147] PCI host bridge /fpi@10000000/pcie@d900000 ranges:
[    0.364212] usbcore: registered new interface driver usbfs
[    0.369702] usbcore: registered new interface driver hub
[    0.375060] usbcore: registered new device driver usb
[    0.380486] PCI host bridge to bus 0000:00
[    0.384483] pci_bus 0000:00: root bus resource [mem 0x1c000000-0x1cffffff]
[    0.391388] pci_bus 0000:00: root bus resource [io  0x1d800000-0x1d8fffff]
[    0.398331] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.405187] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.413256] ifx_pcie_rc_class_early_fixup: fixed pcie host bridge to pci-pci bridge
[    0.432226] pci 0000:00:00.0: BAR 8: assigned [mem 0x1c000000-0x1c0fffff]
[    0.438908] pci 0000:00:00.0: BAR 9: assigned [mem 0x1c100000-0x1c1fffff pref]
[    0.446174] pci 0000:01:00.0: BAR 0: assigned [mem 0x1c000000-0x1c01ffff 64bit]
[    0.453572] pci 0000:01:00.0: BAR 6: assigned [mem 0x1c100000-0x1c10ffff pref]
[    0.460835] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.465872] pci 0000:00:00.0:   bridge window [mem 0x1c000000-0x1c0fffff]
[    0.472728] pci 0000:00:00.0:   bridge window [mem 0x1c100000-0x1c1fffff pref]
[    0.480038] ifx_pcie_bios_map_irq port 0 dev 0000:00:00.0 slot 0 pin 1 
[    0.486694] ifx_pcie_bios_map_irq dev 0000:00:00.0 irq 144 assigned
[    0.493046] ifx_pcie_bios_map_irq port 0 dev 0000:01:00.0 slot 0 pin 1 
[    0.499712] ifx_pcie_bios_map_irq dev 0000:01:00.0 irq 144 assigned
[    0.506952] clocksource: Switched to clocksource MIPS
[    0.513209] NET: Registered protocol family 2
[    0.518511] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.525403] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.531778] TCP: Hash tables configured (established 1024 bind 1024)
[    0.538299] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.544137] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.550696] NET: Registered protocol family 1
[    0.561892] gptu: totally 6 16-bit timers/counters
[    0.566752] gptu: misc_register on minor 63
[    0.570832] gptu: succeeded to request irq 126
[    0.575318] gptu: succeeded to request irq 127
[    0.579830] gptu: succeeded to request irq 128
[    0.584344] gptu: succeeded to request irq 129
[    0.588857] gptu: succeeded to request irq 130
[    0.593371] gptu: succeeded to request irq 131
[    0.598205] phy-xrx200 gphy-xrx200: requesting lantiq/vr9_phy11g_a2x.bin
[    0.605520] phy-xrx200 gphy-xrx200: booting GPHY0 firmware at 39A0000
[    0.611853] phy-xrx200 gphy-xrx200: booting GPHY1 firmware at 39A0000
[    0.718491] No VPEs reserved for AP/SP, not initialize VPE loader
[    0.718491] Pass maxvpes=<n> argument as kernel argument
[    0.729846] No TCs reserved for AP/SP, not initializing RTLX.
[    0.729846] Pass maxtcs=<n> argument as kernel argument
[    0.741694] Crashlog allocated RAM at address 0x3f00000
[    0.767694] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.773418] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.787218] io scheduler noop registered
[    0.791026] io scheduler deadline registered (default)
[    0.796876] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 112, base_baud = 0) is a lantiq,asc
[    0.805777] console [ttyLTQ0] enabled
[    0.805777] console [ttyLTQ0] enabled
[    0.813101] bootconsole [early0] disabled
[    0.813101] bootconsole [early0] disabled
[    0.826358] m25p80 spi0.4: s25fl064k (8192 Kbytes)
[    0.829785] 4 ofpart partitions found on MTD device spi0.4
[    0.835206] Creating 4 MTD partitions on "spi0.4":
[    0.839994] 0x000000000000-0x000000020000 : "u-boot"
[    0.846881] 0x000000020000-0x0000007c0000 : "firmware"
[    0.953111] random: nonblocking pool is initialized
[    1.055532] 2 tplink-fw partitions found on MTD device firmware
[    1.060042] 0x000000020000-0x0000001b09d0 : "kernel"
[    1.066700] 0x0000001b09d0-0x0000007c0000 : "rootfs"
[    1.072416] mtd: device 3 (rootfs) set to be root filesystem
[    1.077246] 1 squashfs-split partitions found on MTD device rootfs
[    1.082865] 0x0000004d0000-0x0000007c0000 : "rootfs_data"
[    1.090035] 0x0000007c0000-0x0000007d0000 : "config"
[    1.095723] 0x0000007d0000-0x000000800000 : "boardconfig"
[    1.101791] spi-lantiq 1e100800.spi: Lantiq SPI controller (TXFS 8, RXFS 8, DMA 32)
[    1.210680] libphy: lantiq,xrx200-mdio: probed
[    1.283684] eth0: attached PHY [Lantiq XWAY PEF7071] (phy_addr=0:00, irq=-1)
[    1.351658] eth0: attached PHY [Lantiq XWAY PEF7071] (phy_addr=0:05, irq=-1)
[    1.419642] eth0: attached PHY [Lantiq XWAY VR9 GPHY 11G v1.4] (phy_addr=0:11, irq=-1)
[    1.487642] eth0: attached PHY [Lantiq XWAY VR9 GPHY 11G v1.4] (phy_addr=0:13, irq=-1)
[    1.595867] ltq-cputemp cputemp@0: Current CPU die temperature: 30.5 °C
[    1.601435] wdt 1f8803f0.watchdog: Init done
[    1.608234] NET: Registered protocol family 10
[    1.616604] NET: Registered protocol family 17
[    1.619748] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.632260] 8021q: 802.1Q VLAN Support v1.8
[    1.643540] squashfs: SQUASHFS error: unable to read id index table
[    1.648692] List of all partitions:
[    1.651904] 1f00             128 mtdblock0  (driver?)
[    1.656892] 1f01            7808 mtdblock1  (driver?)
[    1.661939] 1f02            1602 mtdblock2  (driver?)
[    1.667004] 1f03            6205 mtdblock3  (driver?)
[    1.672036] 1f04            3008 mtdblock4  (driver?)
[    1.677084] 1f05              64 mtdblock5  (driver?)
[    1.682133] 1f06             192 mtdblock6  (driver?)
[    1.687186] No filesystem could mount root, tried:  squashfs
[    1.692837] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
[    1.702655] Rebooting in 1 seconds..

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-LANTIQ-v-2.3.08 (Sep 29 2014 - 14:06:03)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial

[... going on forever]

When i stop the bootloop (via serial Interface) i cannot upload anything to the Router because i cannot establish a connection via LAN interface !

I suppose that the Hardware of the Router just died, otherwise it sholud be possible to get a LAN connection, right ?

Or do i miss something ?

Any help is welcome.

Gerd

2

Yes, you have missed something. Your router is still not booting. It appears the issue is in the file system compiled into your firmware:

No, your router is not dead. Your serial output tells you exactly what's wrong! You device hasn't booted up yet!

That's because your router isn't booted, it appears the firmware you created has a corrupt/incompatible file system. Have you tried to TFTP the image so you can permanently flash it?

1 Like
3

@lleachii
Thanks for your answer !

No i didn't. As far as i understood the TFTP has to run over a IP network. This means as long as i cannot connect via LAN to the router I cannot flash via TFTP. Did I understood this wrong and the TFTP transfers via the serial Interface ?

4

Some bootloaders allow you to setup the Ethernet and TFTP.

Some require serial transfer.

In any case, you have to successfully transfer a good image so it can boot.

5

@lleachii

yes, the bootloader offers this possibility, but as i wrote:

(And: Yes I used diffent Ehternet-cables and diffent Laptops just to verify that the is no external hardware failure.)

So i have no clue how to get the new image to the router.

[EDIT:]
Wait, you wrote:

Some require serial transfer.

perhaps i can push a new bootloader which is able to transfer via serial via UART-mode to the device ? I'll give it a try.

6

I never see where you mention that you actually:

Most bootloaders don't setup the Ethernet automatically (maybe more like 50/50); and you only mention that you stoped the bootloader. Also, some only offer access on WAN port; and some devices, you have to time the plugging in of the cable to get past the boot-up reset of the switch.

Let us know your results.

7

Not true regarding LAN connectivity. The TFTP connection could be done in early bootloader phase when there is no ssh possibility and be done by using some exotic IP address, defined by the manufacturer as the recovery process address.

Some TP-Link routers offer TFTP client instead of TFTP server, so the router may try fetching a firmware from a pre-defined IP address - usually 192.168.0.66 (where you should have a TFTP server running on your PC serving the firmware named suitably). One example here: https://www.trishtech.com/2015/06/unbrick-tplink-wr740n-wifi-router/
More debugging advice at https://crosp.net/blog/hardware/unbrick-tp-link-wifi-router-wr841nd-with-tftp-wireshark/

You may need to search the web further to find out details for just your router.

Ps. you have a working bootloader and also the kernel itself seems to start later, so you have an almost working router. Trying to "push a new bootloader" sounds very risky. Bootloader is usually the permanent component that e.g. Openwrt never changes (for 99% of routers).

1 Like
8

There are also lots of device-specific Openwrt advice available. It seems to cover also detailed instructions of using u-boot serial console to set up network for TFTP transfer and flash.
https://openwrt.org/toh/tp-link/td-w8970_v1
https://openwrt.org/toh/hwdata/tp-link/tp-link_td-w8970_v1
https://openwrt.org/toh/tp-link/td-w8970_v1#failsafe_mode
https://forum.openwrt.org/viewtopic.php?id=42380

Exact recovery / flash methods can be rather specific to the router, so you need to investigate rather closely.

1 Like
9

Just use TFTP to load original firmware and try install precompiled firmware. TFTP helped me on two devices when I bricked them.

1 Like
10

@lleachii

Thanks for your patience with me !

Sorry for being so unspecific in my previous Posts.

The printenv within the bootloader stated:

ipaddr=192.168.1.1
serverip=192.168.1.100
netdev=eth0

So i just set up my Laptop to static IP 192.168.1.100 . Therefore i didn't needed set up the Router-Ethernet because it could run on default values.
But the uboot-TFTP-client from the router couldn't connect to the Laptop.
Then i set up another OpenWRT Router as TFTP-Server.

VR9 # setenv ipaddr 192.168.15.189
VR9 # setenv serverip 192.168.15.101
VR9 # setenv bootargs 'board=WD8970'
VR9 # tftpboot 0x81000000 openwrt-lantiq-xrx200-TDW8970-sysupgrade.image
8192 KiB W25Q64 at 0:3 is now current device
MAC: e8-94-f6-ab-cd-ef
Using vr9 Switch device
TFTP from server 192.168.15.101; our IP address is 192.168.15.189
Filename 'openwrt-lantiq-xrx200-TDW8970-sysupgrade.image'.
Load address: 0x81000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
8192 KiB W25Q64 at 0:3 is now current device
MAC: e8-94-f6-ab-cd-ef
Using vr9 Switch device
TFTP from server 192.168.15.101; our IP address is 192.168.15.189
Filename 'openwrt-lantiq-xrx200-TDW8970-sysupgrade.image'.
Load address: 0x81000000
Loading: T T T T T T T T T T
[...]

I double checked the Name of the File. I have no clue why i just can't use TFTP via Ethernet.

@hnyman
Thank you very much for the Detailed answer.
The two Links from your first Post and the last from the second Post were new to me .
The use of wireshark for nerwork debugging was a way i had forgotten to think of :grin:
But just an hour befor your answer I found a tool to push the firmware via serial cable and without any more hassle with Ethernet. So i followed that road.

Yes it is. But i had no clue how to get the new firmware to the Router via serial. And after one week of testing and trying i was kind of frustrated and close to go this last and final way of rescue.

.
.
.
Here is how i finally got the Router debricked only via serial

After reading this Page: https://openwrt.org/toh/tp-link/td-w8970_v1 I was a little bit confused which firmware to choose, because the Installation using serial "says":

  1. Download the openwrt-lantiq-xrx200-TDW8970-uImage-sysupgrade.image
    and further down
  2. tftpboot 0x81000000 openwrt-lantiq-xrx200-TDW8970-sysupgrade.image (with no uImage ) in the filename.

But in actual Download-area is no uimage-sysupgrade.image and no sysupgrade.image but an squashfs-sysupgrade.bin :cry:

After a while of research i found this Page: https://openwrt.org/inbox/firmware_image_names which states that there is no (more an ?) uImage for LANTIQ devices.
So i suppose that someone just copied the Installation using serial from the old OpenWRT wiki http://wiki.openwrt.org/toh/tp-link/td-w8970 to the new one, without reviewing it.

At least i figured that i didn't needed the uImage because I had OpenWRT running on this Router. The actual Image (17.01.4) is called [...]squashfs-sysupgrade.bin and i wasn't sure about the sqashfs in the filename. Do i decided that that the best way to follow an outdated HOWTO is to use the outdated software metioned in it. And coming to the Download aera of OpenWRT 14.07 voila: there were uimage.image and sysupgrade.image files, so i was on the right trail :smile:

So i followed this procedere:

  1. Download the OpenWRT image from here: https://archive.openwrt.org/barrier_breaker/14.07/lantiq/xrx200/openwrt-lantiq-xrx200-TDW8970-sysupgrade.image

  2. Download the tool ubootwrite.py from here: https://github.com/TheExpertNoob/ubootwrite/blob/master/ubootwrite.py

  3. make sure that python (>= 2.7) and python-serial are installed (on your Linux PC)

  4. open a "Terminal"-window and cd to the path of the "ubootwrite.py" tool and the downloaded Image. In my case it was:

    cd /home/user/Download

    connect to the Router via serial cable using this command:

    sudo screen -L screen_session_1.log /dev/ttyUSB0 115200

    at the bootloaderprompt enter:

    setenv bootargs 'board=WD8970'

    then exit screen with STRG+a followed by STRG+d

  5. copy the OpenWRT image to the Router with:

> sudo python ubootwrite.py --verbose --serial=/dev/ttyUSB0 --write=openwrt_14.07_lantiq-xrx200-TDW8970-sysupgrade.image --addr=0x81000000

This will take a long time. (I went away and came back two hours later, then it was done.) Take a look at the last lines of output. One has to state something like:

You should run 'crc32 81000000 003e0004' on the modem and the result must be 99287562

  1. again use the screen command to connect to the Router:

    sudo screen -L screen_session_2.log /dev/ttyUSB0 115200

  2. At the bootloader-prompt enter first what was suggested to you. The last number may vary, depending on the Image you chose.

    crc32 81000000 003e0004

    If the result matches the one given from the ubootwrite.py tool then go on with:

    sf erase 0x20000 0x7a0000

    exchange the $(filesize) with the last Number from the crc32 command

    sf write 0x81000000 0x20000 0x$(filesize)

    finally:

    reset

    If everything is good now you can see the bootprocess via the serial screen !
    If not you have two log-files called:
    screen_session_1.log and screen_session_2.log
    which may help debugging your process.

  3. connect a Ethernet-cable to a LAN Port of your router and the other end to you PC.
    Open your Internet-Browser and type

    192.168.1.1

    Now you can flash any desired (newer) OpenWRT Image you want via Web-Interface.

And that is How it worked for me.

1 Like
11

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.