[Solved] TPlink TD-W8970

Installing and Using OpenWrt
1

Hi, just tried to install openwrt to my TP Link TD-W8970 via the telnet interface to the machine:

ls -l /var/usbdisk/sda1/
drwxrwxrwx    2      8192 tdw8970stock
-rwxrwxrwx    1   3735741 openwrt-18.06.0-lantiq-xrx200-tplink_tdw8970-squashfs-sysupgrade.bin-2
-rwxrwxrwx    1   1310720 openwrt-18.06.0-lantiq-xrx200-tplink_tdw8970-squashfs-sysupgrade.bin-1
-rwxrwxrwx    1   5046461 openwrt-18.06.0-lantiq-xrx200-tplink_tdw8970-squashfs-sysupgrade.bin
~ # cat /var/usbdisk/sda1/openwrt-18.06.0-lantiq-xrx200-tplink_tdw8970-squashfs-
sysupgrade.bin-1 > /dev/mtdblock1
~ # cat /var/usbdisk/sda1/openwrt-18.06.0-lantiq-xrx200-tplink_tdw8970-squashfs-
sysupgrade.bin-2 > /dev/mtdblock2
~ # sync
-sh: sync: not found
~ # reboot

After reboot, the router doesn't come up. Every few seconds it flashes the ethernet lights, and this is detected as ethernet coming up for a short time.

So am I guessing that the only solution is to crack the case, and attach the UART, to find out what is going wrong?

2

Seems like your only choice...it looks like you bricked your router using the cat command to flash firmware.

3

The dd command is the preferred tool for binary files.

1 Like
4

Yes, my first choice to write to the flash would have have been "dd" or the mtd-util, alas the stock OS on this box didn't have these available, the only suitable command was "cat".

Daft thing is I could have copied the fresh written flash off the router - and checked that the memory was correct.

Anyway I'll have a go at cracking the case, it looks a tad tricky to get in (plastic case is stiff). From the pictures looks like the uart connections are surface mount type (e.g. aren't through board). Whats the easiest way of mounting to them? A short wire leading to a pin?

5

Ok -case open. Surprisingly empty board, and looks like many parts of the of the layout have their own partitions. E.g. RF is surrounded by a moat. The adsl connection and ethernet look like outside the main earth plane.

Anyway the uart pins, looks suspiciously like they are through board, at least they are clearly apparent on both sides of the board. On the top though, RX,TX, and VDD have been filled with solder. Earth though has most of the whole empty - but there is solder on the backside - so like its been drilled out most of the way.

Whats interesting is the jtag (surface mount) connections are all very clearly marked.

6

You can recovery nearly all TD-W8970 with the serial connection. Ground+rx+tx. I always solder all 4 pins.
To remove the solder thats already inside the pins you have to use a solder sucking gun (about 1-2 bucks in the shops).
Its a 3minute work :wink:

7

Soldering only 3 pins (RX, TX, GND) makes 100,0% sure you will never ever connect to Vcc on the board, effectively minimizing the risk to fry your device. Unexperienced users easily think that all pins have to be connected, which most likely will lead to problems.

1 Like
8

Okay. But i like "freedom". Also for example the freedom of beeing able to measure the voltage on VCC+ground when powered on with normal power supply.
I always make "the max possible" things. Does not matter if i need them later. Thats why i always solder all 4 of 4 possible pins.

1 Like
9

Vcc can also be used to power the serial adaptor for example if it was Bluetooth with no other power source.

1 Like
10

I'm with @tmomas on this, I seem to hear all too often about people plugging a powered VDD cable into a power VDD pin on a device. And connecting two power supplies together, even if nominally the same voltage, is a very bad idea.

11

OK - finally found time to get a solder sucker - cleared the holes, bit of a mess on RX hole. Anyway fixed on a 3 pin header.

Now on the UART I can see the boot messages - but I havn't been able to interrupt it. What I've been doing in gnu screen is hammering t, but it has no effect. The output I'm getting is:




ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 0.3ff
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-LANTIQ-v-2.0.40-svn4806 (Jun 12 2014 - 10:34:17)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device


Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  1  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
	Uncompressing ... 
Starting kernel ...

[    0.000000] Linux version 4.9.111 (buildbot@builds-03.infra.lede-project.org) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7102-3f3a2c9) ) #0 SMP Sat Jul 14 13:48:14 2018
[    0.000000] SoC: xRX200 rev 1.2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)
[    0.000000] MIPS: machine is TP-LINK TD-W8970
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Detected 1 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] percpu: Embedded 12 pages/cpu @8108c000 s17488 r8192 d23472 u49152
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyLTQ0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00025080
[    0.000000] Readback ErrCtl register=00025080
[    0.000000] Memory: 57884K/65536K available (4302K kernel code, 177K rwdata, 900K rodata, 1260K init, 244K bss, 7652K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] Setting up vectored interrupts
[    0.000000] Setting up IPI vectored interrupts
[    0.000000] CPU Clock: 500MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns
[    0.000011] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns
[    0.007886] Calibrating delay loop... 332.54 BogoMIPS (lpj=665088)
[    0.042390] pid_max: default: 32768 minimum: 301
[    0.047271] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.053810] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.065459] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.065472] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.065681] CPU1 revision is: 00019556 (MIPS 34Kc)
[    0.116548] Synchronize counters for CPU 1: 
[    0.116550] done.
[    0.123043] Brought up 2 CPUs
[    0.130663] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.140335] futex hash table entries: 512 (order: 2, 16384 bytes)
[    0.146575] pinctrl core: initialized pinctrl subsystem
[    0.153092] NET: Registered protocol family 16
[    0.166327] pinctrl-xway 1e100b10.pinmux: Init done
[    0.172320] dma-xway 1e104100.dma: Init done - hw rev: 7, ports: 7, channels: 28
[    0.285526] dcdc-xrx200 1f106a00.dcdc: Core Voltage : 1016 mV
[    0.291346] Can't analyze schedule() prologue at 8043081c
[    0.429372] PCI host bridge /fpi@10000000/pcie@d900000 ranges:
[    0.463252] usbcore: registered new interface driver usbfs
[    0.468885] usbcore: registered new interface driver hub
[    0.474289] usbcore: registered new device driver usb
[    0.480005] PCI host bridge to bus 0000:00
[    0.484038] pci_bus 0000:00: root bus resource [mem 0x1c000000-0x1cffffff]
[    0.490940] pci_bus 0000:00: root bus resource [io  0x1d800000-0x1d8fffff]
[    0.497887] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.504750] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.512819] ifx_pcie_rc_class_early_fixup: fixed pcie host bridge to pci-pci bridge
[    0.532425] pci 0000:00:00.0: BAR 8: assigned [mem 0x1c000000-0x1c0fffff]
[    0.539130] pci 0000:00:00.0: BAR 9: assigned [mem 0x1c100000-0x1c1fffff pref]
[    0.546437] pci 0000:01:00.0: BAR 0: assigned [mem 0x1c000000-0x1c01ffff 64bit]
[    0.553751] random: fast init done
[    0.557239] pci 0000:01:00.0: BAR 6: assigned [mem 0x1c100000-0x1c10ffff pref]
[    0.564558] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.569580] pci 0000:00:00.0:   bridge window [mem 0x1c000000-0x1c0fffff]
[    0.576455] pci 0000:00:00.0:   bridge window [mem 0x1c100000-0x1c1fffff pref]
[    0.583749] ifx_pcie_bios_map_irq port 0 dev 0000:00:00.0 slot 0 pin 1 
[    0.590409] ifx_pcie_bios_map_irq dev 0000:00:00.0 irq 144 assigned
[    0.596750] ifx_pcie_bios_map_irq port 0 dev 0000:01:00.0 slot 0 pin 1 
[    0.603415] ifx_pcie_bios_map_irq dev 0000:01:00.0 irq 144 assigned
[    0.612065] clocksource: Switched to clocksource MIPS
[    0.619585] NET: Registered protocol family 2
[    0.625223] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.632129] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    0.638553] TCP: Hash tables configured (established 1024 bind 1024)
[    0.645058] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.650915] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.657514] NET: Registered protocol family 1
[    0.662682] gptu: totally 6 16-bit timers/counters
[    0.667566] gptu: misc_register on minor 63
[    0.671777] gptu: succeeded to request irq 126
[    0.676218] gptu: succeeded to request irq 127
[    0.680703] gptu: succeeded to request irq 128
[    0.685247] gptu: succeeded to request irq 129
[    0.689734] gptu: succeeded to request irq 130
[    0.694266] gptu: succeeded to request irq 131
[    0.699147] phy-xrx200 gphy-xrx200: requesting lantiq/xrx200_phy11g_a22.bin
[    0.706735] phy-xrx200 gphy-xrx200: booting GPHY0 firmware at 3A60000
[    0.713092] phy-xrx200 gphy-xrx200: booting GPHY1 firmware at 3A60000
[    0.821023] No VPEs reserved for AP/SP, not initialize VPE loader
[    0.821023] Pass maxvpes=<n> argument as kernel argument
[    0.832391] No TCs reserved for AP/SP, not initializing RTLX.
[    0.832391] Pass maxtcs=<n> argument as kernel argument
[    0.845279] Crashlog allocated RAM at address 0x3f00000
[    0.851063] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.873968] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.879721] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.895055] io scheduler noop registered
[    0.899005] io scheduler deadline registered (default)
[    0.905352] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 112, base_baud = 0) is a lantiq,asc
[    0.914279] console [ttyLTQ0] enabled
[    0.914279] console [ttyLTQ0] enabled
[    0.921600] bootconsole [early0] disabled
[    0.921600] bootconsole [early0] disabled
[    0.933090] spi-lantiq-ssc 1e100800.spi: Lantiq SSC SPI controller (Rev 8, TXFS 8, RXFS 8, DMA 1)
[    0.954310] m25p80 spi32766.4: s25fl064k (8192 Kbytes)
[    0.958153] 4 fixed-partitions partitions found on MTD device spi32766.4
[    0.964733] Creating 4 MTD partitions on "spi32766.4":
[    0.969895] 0x000000000000-0x000000020000 : "u-boot"
[    0.977214] 0x000000020000-0x0000007c0000 : "firmware"
[    1.291075] random: crng init done
[    2.062545] 2 tplink-fw partitions found on MTD device firmware
[    2.067066] 0x000000020000-0x0000001c8963 : "kernel"
[    2.074254] 0x0000001c8964-0x0000007c0000 : "rootfs"
[    2.079975] mtd: device 3 (rootfs) set to be root filesystem
[    2.084539] 1 squashfs-split partitions found on MTD device rootfs
[    2.090549] 0x0000004f0000-0x0000007c0000 : "rootfs_data"
[    2.098284] 0x0000007c0000-0x0000007d0000 : "config"
[    2.104210] 0x0000007d0000-0x000000800000 : "boardconfig"
[    2.113790] libphy: Fixed MDIO Bus: probed
[    2.221449] libphy: lantiq,xrx200-mdio: probed
[    2.300670] Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.4 0:00: attached PHY driver [Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.4] (mii_bus:phy_addr=0:00, irq=-1)
[    2.384648] Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.4 0:05: attached PHY driver [Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.4] (mii_bus:phy_addr=0:05, irq=-1)
[    2.468632] Intel XWAY PHY11G (xRX v1.2 integrated) 0:11: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:11, irq=-1)
[    2.552631] Intel XWAY PHY11G (xRX v1.2 integrated) 0:13: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:13, irq=-1)
[    2.668558] ltq-cputemp cputemp@0: Current CPU die temperature: 28.5 °C
[    2.674240] wdt 1f8803f0.watchdog: Init done
[    2.682902] NET: Registered protocol family 10
[    2.688302] NET: Registered protocol family 17
[    2.691402] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.704342] 8021q: 802.1Q VLAN Support v1.8
[    2.716500] squashfs: SQUASHFS error: unable to read id index table
[    2.721886] List of all partitions:
[    2.724892] 1f00             128 mtdblock0 [    2.728847]  (driver?)
[    2.731162] 1f01            7808 mtdblock1 [    2.735179]  (driver?)
[    2.737568] 1f02            1698 mtdblock2 [    2.741533]  (driver?)
[    2.743869] 1f03            6109 mtdblock3 [    2.747908]  (driver?)
[    2.750253] 1f04            2880 mtdblock4 [    2.754263]  (driver?)
[    2.756607] 1f05              64 mtdblock5 [    2.760616]  (driver?)
[    2.762931] 1f06             192 mtdblock6 [    2.766949]  (driver?)
[    2.769326] No filesystem could mount root, tried: [    2.774002]  squashfs
[    2.776283] 
[    2.777724] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
[    2.789074] Rebooting in 1 seconds..

Any idea - try redoing the pins? Or ask an expert at work?

12

Okay - assuming it to be a dry joint, I stripped the solder off that pin. The pad that its soldering to is obviously a bit blackend, from when I was getting the solder sucker to work (sigh now I used to it - cleared the solder off this time first go). Anyway resoldered the pin.

However still can't interrupt uboot, it only gives 1s before booting - but I should be able to do that (after all it reboots every 10s or so).

So whats the conclusion, did I destroy the connection when first removing solder from the holes? Or is it just very hard to interrupt uboot (hey I did "yes t | cat > /dev/ttyUSB0" yesterday just to get a continuous stream of "t"'s - but no help).

Any ideas? Not easy for me to post a photo btw, but if it helps I'll see what I can do ...

13

Have you tested if your USB serial adapter is working.

An easy way to do that is connect the TX and RX on the serial adapter to each other and nothing else.
Then you will get an echo of whatever you type.

14

Yes loop back works. Its and FTDI RPi cable and they seem fairly reliable.

I'm getting to the stage where all I can think of is taking the solder off all three pins, and removing the header - then at least I can look at the board from the other side.
May well be best to ask expert at work - don't know if he can test the solder joint using magic ....

15

OK expert at work rapidly found my problem. Alas when removing the solder from the RX hole, the soldar sucker removed the pad as well as the solder (on the back of the board).

So what seems easiest now is to remove the heat sink on the CPU, and attacking an RX wire direct onto the chip. Hopefully its a quad flat pack package.

Can't believe I removed the pad, that stupidity for you. Must have applied too much heat or something ... sigh ...

16

It isn't, it's BGA instead.

17

Argh - so no way to attach to the other end of the track.

So only option is to try and find a way to remove the 3 pin header? Hard as even with solder wick/ sucker its hard to remove all solder. And that means unsoldering all three legs at the same time ...

Anyway if could remove it, then could use the pad on the top of the board I guess ...

18

not sure if you have looked at the pages

https://wiki.openwrt.org/toh/tp-link/td-w8970
https://wiki.openwrt.org/toh/tp-link/td-w8980

but they talk about shorting a pin to get into UART mode
maybe you connection is on but the mode is not enabled

19

Thank Lucky1. Thats for getting the xway cpu bootloader to go into uart mode.

In my case the uboot (and the kernel) that runs on top of it is fine, so I should be able to do a standard boot, and not force the cpu bootloader into a special mode.

uboot monitors the keyboard so, I should be able to interupt that.

Anyway, think over night, if I can remove the black pin holder, the pins will be individually mounted on the board. Then I can unsolder each one at at time. That should give access to the pads on the top of the board, and I can solder wires directly onto that.

Now how hard it is to remove the black pin holder remains to be seen ....

20

The trace leading to the RX pad seems to be placed on the top layer. You said the missing pad is on the back of the board (bottom layer)? In this case, I would leave the header pins in place, just remove some of the plastic and check the trace/pad on the top side for possible damage, then solder the RX pin to the top side pad.

1 Like