TP-Link TD-W9980 / TD-W9980B Wiki inacurracy that can lead to bricks

I recently bricked one of those by first backing up the mtd files(they did not help since I did not find anyone knowing how to use them to unbrick it) then I flashed openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin and it worked for a bit and then I updated to 19 and it kinda messed up my config and I tried to flash openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin which ultimately bricked it. I'd advice to add some big warning and maybe a way to recover from mtd files. I would add the warning myself but I am not a wiki contributor. Btw since I am getting a new one could I just dump it's eeprom and flash it to the bricked one?

While I wholeheartedly agree that the OpenWrt wiki, like a lot of places, would benefit from a warning sign: What exactly would you want to warn against?

That's pretty much exactly what https://openwrt.org/toh/tp-link/td-w9980#restore_tp-link_fw_though_serial_connection describes.

Since you're willing top open the device for advanced surgery, you could try recovering/reflashing via serial and u-boot first.

2 Likes

It seems like only openwrt-18.06.1 has the correct image size for it to be not bricked and 19.07.6 is too big

https://openwrt.org/toh/tp-link/td-w9980#restore_tp-link_fw_though_serial_connection first line reads "Firsts 128KiB (131 072 bytes) are for bootloader, and the lasts 256KiB (262 144 bytes) aren't contained in any firmware download." So essentially what openwrt 19 does if flashed through uboot it overwrites those resulting in a brick with the following boot log

 `DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #
`

I actually used the uboot method and only did the web ui hack to backup the mtd files. I already have done the surgery.

Your uboot is starting, responsive, and trying to boot OpenWrt.

Your device isn't bricked.

Now why 19.07.6 is not working for you is worth investigating.

No it doesn't. The W8980/W9980 has two mtd partitions for kernel and rootfs, starting at 0x20000, together they are 0x7a0000 (7995392) bytes in size. That's the area that will be erased (sf erase 0x20000 0x7a0000). The 19.07.6 OpenWrt image is 5505310 bytes and does fit easily, i.e. it's not nearly large enough to overwrite something it shouldn't.

2 Likes

Well I tried reflashing back to 18 and it had the same boot log

Which disproves your initial assumptions.

I would suggest trying to flash back to manufacturer firmware first, as described in the wiki. If that doesn't work either it indicates that something is wrong with your flashing process.

1 Like

I experienced this after flashing 19.07.6 I am not sure what caused it to be bricked and I was going by correlation but it seems like the radio partition mtd6 namely (perhaps the bootloader mtd1 also?)has been either overwritten or erased. I concluded that the boot loader might have been overwritten by running binwalk on all mtd files and I found mtd1 and mtd2 that had LZMA compression although mtd2 had it over squashfs
I just re flashed and it still has the same boot log.

OpenWrt's own sysupgrade wouldn't do that. You would have to do it manually, in uboot, by screwing up pretty badly at the numbers. A missing radio partition would be bad, possibly preventing your Wifi from working correctly. But it would not prevent the device from booting. And your bootloader is clearly intact. Also, mtd1 is not the bootloader (that would be mtd0) but the kernel partition, and that one is supposed to be overwritten.

No offense, but for all the highly technical stuff you have been going through -- soldering, serial console, backupping raw flash, binwalking over binaries -- you seem to be swinging a long stick at a lot of air.

What happens if you exactly, to the letter follow the serial flash process as outlined in the wiki? Edit: including uploading u-boot.asc! What are the responses from the console? I'm still not convinced you're doing it right.

3 Likes
Welcome to minicom 2.8

OPTIONS: I18n 
Port /dev/ttyUSB0, 17:34:45

Press CTRL-A Z for help on special keys


ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART

ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART
********************************************************************************************************************************************************************************************************************************************e

U-Boot 2010.06-LANTIQ-v-2.0.40 (Dec 04 2015 - 09:20:29)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x841d
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device


Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  1  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
e[39;9HUncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 # tftp $(loadaddr) openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin
8192 KiB W25Q64 at 0:3 is now current device
Using vr9 Switch device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin'.
Load address: 0x80800000
Loading: *#################################################################
e[47;9H #################################################################
e[48;9H #################################################################
e[49;9H #################################################################
e[50;9H #################################################################
e[51;9H ###################
done
Bytes transferred = 5046461 (4d00bd hex)
VR9 # sf erase 0x20000 0x7a0000

..........................................................................................................................

Successfully erased 7995392 bytes @ 0x20000

VR9 # sf write $(loadaddr) 0x20000 0x$(filesize)


.............................................................................

Successfully programmed 5046461 bytes @ 0x20000

VR9 # reset

ROM VER: 1.1.4

CFG 04

EEPROM Data OK

UART


ROM VER: 1.1.4

CFG 05


ROM VER: 1.1.4

CFG 05


DDR autotuning Rev 1.0

DDR size from 0xa0000000 - 0xa3ffffff

DDR check ok... start booting...




U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)


CLOCK CPU 500M RAM 250M

DRAM:  64 MiB

Using default environment


In:    serial

Out:   serial

Err:   serial

Net:   Internal phy(GE) firmware version: 0x8434

vr9 Switch8192 KiB W25Q64 at 0:3 is now current device

MAC: 60-e3-27-29-dd-12  



run "flash_flash" to bring up the kernel


Hit any key to stop autoboot:  1  0 

8192 KiB W25Q64 at 0:3 is now current device

8192 KiB W25Q64 at 0:3 is now current device

e[56;9HUncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover

VR9 #

There is a full log of me using exactly the wiki instructions with only one deviation that when I needed to reset after the sp write it actually dropped me to the bootloader flasher (I had removed the short) I just reset the power switch. Then here you will see me trying to flash the tplink firmware as stated on the wiki(Since I have to set boot env for the ip to be 192.168.1.2 which is default of the other uboot image I assumed it is stock, I have tried on openwrt uboot but still had the same result )

OPTIONS: I18n 
Port /dev/ttyUSB0, 17:12:26

Press CTRL-A Z for help on special keys


ROM VER: 1.1.4
CFG 05

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  

e[1;35re[35;1H
e[1;36re[35;1Hrun "flash_flash" to bring up the kernel
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HHit any key to stop autoboot:  1  0 
e[1;35re[35;1H
e[1;36re[35;1H8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1H8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1He[35;9HUncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
e[1;35re[35;1H
e[1;36re[35;1HVR9 # setenv ipaddr 192.168.1.1
e[1;35re[35;1H
e[1;36re[35;1HVR9 # setenv serverip 192.168.1.2
e[1;35re[35;1H
e[1;36re[35;1HVR9 # setenv bootargs 'board=WD8970'
e[1;35re[35;1H
e[1;36re[35;1HVR9 # tftpboot 0x80800000 tplink.bin
e[1;35re[35;1H
e[1;36re[35;1H8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1HMAC: 60-e3-27-29-dd-12  
e[1;35re[35;1H
e[1;36re[35;1HUsing vr9 Switch device
e[1;35re[35;1H
e[1;36re[35;1HTFTP from server 192.168.1.2; our IP address is 192.168.1.1
e[1;35re[35;1H
e[1;36re[35;1HFilename 'tplink.bin'.
e[1;35re[35;1H
e[1;36re[35;1HLoad address: 0x80800000
e[1;35re[35;1H
e[1;36re[35;1HLoading: *T T T T T T T #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H #################################################################
e[1;35re[35;1H
e[1;36re[35;1He[35;9H ###########################################
e[1;35re[35;1H
e[1;36re[35;1Hdone
e[1;35re[35;1H
e[1;36re[35;1HBytes transferred = 8257536 (7e0000 hex)
e[1;35re[35;1H
e[1;36re[35;1HVR9 # sf erase 0x20000 0x7a0000
e[1;35re[35;1H
e[1;36re[35;1HErasing SPI flash...
e[1;35re[35;1H
e[1;36re[35;1H..........................................................................................................................
e[1;35re[35;1H
e[1;36re[35;1HSuccessfully erased 7995392 bytes @ 0x20000
e[1;35re[35;1H
e[1;36re[35;1HDone
e[1;35re[35;1H
e[1;36re[35;1HVR9 # sf write 0x80800000 0x20000 0x7a0000
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1H..........................................................................................................................
e[1;35re[35;1H
e[1;36re[35;1HSuccessfully programmed 7995392 bytes @ 0x20000
e[1;35re[35;1H
e[1;36re[35;1HVR9 # reset
e[1;35re[35;1H
e[1;36re[35;1HROM VER: 1.1.4
e[1;35re[35;1H
e[1;36re[35;1HCFG 05
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HDDR autotuning Rev 1.0
e[1;35re[35;1H
e[1;36re[35;1HDDR size from 0xa0000000 - 0xa3ffffff
e[1;35re[35;1H
e[1;36re[35;1HDDR check ok... start booting...
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HU-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HCLOCK CPU 500M RAM 250M
e[1;35re[35;1H
e[1;36re[35;1HDRAM:  64 MiB
e[1;35re[35;1H
e[1;36re[35;1HUsing default environment
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HIn:    serial
e[1;35re[35;1H
e[1;36re[35;1HOut:   serial
e[1;35re[35;1H
e[1;36re[35;1HErr:   serial
e[1;35re[35;1H
e[1;36re[35;1HNet:   Internal phy(GE) firmware version: 0x8434
e[1;35re[35;1H
e[1;36re[35;1Hvr9 Switch8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1HMAC: 60-e3-27-29-dd-12  
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1Hrun "flash_flash" to bring up the kernel
e[1;35re[35;1H
e[1;36re[35;1He[1;35re[35;1H
e[1;36re[35;1HHit any key to stop autoboot:  1  0 
e[1;35re[35;1H
e[1;36re[35;1H8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1H8192 KiB W25Q64 at 0:3 is now current device
e[1;35re[35;1H
e[1;36re[35;1He[35;9HUncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
e[1;35re[35;1H
e[1;36re[35;1HVR9 #

The tplink.bin file is made using dd if=orig.bin of=tplink.bin skip=257 bs=512 with orig.bin renamed from https://static.tp-link.com/res/down/soft/TD-W9980_V1_160125.zip (I did unzip it, I am not that stupid) and it is exactly 7995392 bytes. Am I doing it wrong?

I ... am not sure. Following your process here, it looks to be right, except

ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART
********************************************************************************************************************************************************************************************************************************************e

U-Boot 2010.06-LANTIQ-v-2.0.40 (Dec 04 2015 - 09:20:29)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x841d
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device


Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  1  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
e[39;9HUncompressing ... LZMA: uncompress or overwrite error 1

at this point is where it gives me pause. You are supposed to stop this second autoboot, too, then directly continue to flash. I am unsure if having the uploaded uboot run into a failed boot attempt here is merely unnecessary or actually causing problems with flashing later on.

1 Like

I have tried it, at that point of the boot process if it aborts and it drops you into the bootloader shell it's no different than actually pressing t. I think I need to make the mtd blocks into some sort of binary and then do an sp flash or like wire the chip to a pi and write the mtd blocks

Yes, it looks and behaves the same, but I'm really not sure it is the same. But that's a short in the dark really. Keep in mind this is how you successfully flashed 18.06 in the first place, so something else must have broken for you.

I think I will now have to defer this problem to someone more intimately familiar with this issue. I am successfully running a W8980 on 19.07, so I know it's not a generic problem with OpenWrt on these machines. But I'm pretty much out of ideas about what your exact problem might be.

1 Like

Could I use the mtd backups add a bootloader from the tplink binary and to try and flash the spi eeprom from a raspberry pi?

Commands with correct addresses:

tftpboot 0x80800000 lede-lantiq-xrx200-TDW8970-squashfs-sysupgrade.bin
sf erase 0x20000 0x7a0000
sf write 0x80800000 0x20000 0x680004

tftpboot 0x80800000 mtd5_27_03_2017_01-49-58.bin
sf erase 0x7C0000 0x10000
sf write 0x80800000 0x7C0000 0x10000

tftpboot 0x80800000 mtd6_art.bin
sf erase 0x7D0000 0x30000
sf write 0x80800000 0x7D0000 0x30000
reset

This is 680004, replace with your own.
The "Bytes transferred" line will contain the size of the firmware in "hex".

An example from your log entry: "4d00bd".

e[51;9H ###################
done
Bytes transferred = 5046461 (4d00bd hex)
VR9 # sf erase 0x20000 0x7a0000

That's the point of using 0x$(filesize), it uses the exact size of the previous transfer. His filesize is correct..

As far as I can see, uboot already fails at uncompressing the kernel, i.e. mtd1.

Maybe give a shot at the initramfs image, i.e. transferring the initramfs image into memory. (For the uninitiated, that's an image that is intended to be run from RAM only, it's not suitable or intended to be flashed to the flash memory.)

Something like this:

tftp 0x80800000 openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin
bootm 0x80800000

This should give you an in-memory OpenWrt. If it is booting correctly, it would tell you that the problem lies in the actual flashing to flash memory. If it doesn't, then the problem possibly lies in the transfer process itself (a wonky connection or wrong serial settings, or something else to that tune.) Also you could then simply do a regular in-OpenWrt sysupgrade to the actual proper sysupgrade image.

1 Like
ROM VER: 1.1.4
CFG 05

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
VR9 # tftp 0x80800000 openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################################
done
Bytes transferred = 4586136 (45fa98 hex)
VR9 # bootm 0x80800000
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

Same error that it cannot uncompress it so now I'll try the other uboot image cause maybe in my bootloader the LZMA uncompression is blown?Also, one thing to note that when you write the other uboot image it is not persistent over a reboot? Is there some way to make it be persistent?
Here it is with the other bootloader

ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART
***********************************************************************************************************************************************************

U-Boot 2010.06-LANTIQ-v-2.0.40 (Dec 04 2015 - 09:20:29)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x841d
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device


Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  0 
VR9 # tftp 0x80800000 openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin
8192 KiB W25Q64 at 0:3 is now current device
Using vr9 Switch device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################################
done
Bytes transferred = 4586136 (45fa98 hex)
VR9 # bootm 0x80800000
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

However after that the sma connector shorted something on the board resulting in the U6 chip being made into ash, however the device SoC still works, what was shorted is the D5 lead to FB15 however even after that the LZMA did not work, but afaik that has not affected much at least the the ethernet/soc/ram/eeprom department so dsl probably is fine and that's all I need since I do not give a crap about wireless. I will not declare this scrap but still it is bricked with some error in the LZMA decompression stuff. I found all voltage eails had a stable voltage by probing at places with a multimeter so U6 might be redundant? I think the next step is to write a new bootloader to flash?

ROM VER: 1.1.4
CFG 05

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
VR9 # tftpboot 0x80800000 openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###################
done
Bytes transferred = 5046461 (4d00bd hex)
VR9 # sf erase 0x20000 0x7a0000
Erasing SPI flash...
..........................................................................................................................
Successfully erased 7995392 bytes @ 0x20000
Done
VR9 # sf write 0x80800000 0x20000 0x4d00bd

.............................................................................
Successfully programmed 5046461 bytes @ 0x20000
VR9 # tftpboot 0x80800000 mtd5.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'mtd5.bin'.
Load address: 0x80800000
Loading: #####
done
Bytes transferred = 65536 (10000 hex)
VR9 # sf erase 0x7C0000 0x10000
Erasing SPI flash...
.
Successfully erased 65536 bytes @ 0x7c0000
Done
VR9 # sf write 0x80800000 0x7C0000 0x10000

.
Successfully programmed 65536 bytes @ 0x7c0000
VR9 # tftpboot 0x80800000 mtd6.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 60-e3-27-29-dd-12  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'mtd6.bin'.
Load address: 0x80800000
Loading: #####
done
Bytes transferred = 65536 (10000 hex)
VR9 # sf erase 0x7D0000 0x30000
Erasing SPI flash...
...
Successfully erased 196608 bytes @ 0x7d0000
Done
                                                
Usage: sf write addr offset len
VR9 # sf write 0x80800000 0x7D0000 0x10000

.
Successfully programmed 65536 bytes @ 0x7d0000
VR9 # reset
ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
[\]
DQS GATE ECHO DLL Delay Slice0:0000001e
DQS GATE ECHO DLL Delay Slice1:0000001f
Read DQS Delay Slice0:00000024
Read DQS Delay Slice1:00000022
Write DQS Delay Slice0:00000065
Write DQS Delay Slice1:00000065


U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial

.
Successfully erased 65536 bytes @ 0x7e0000


Successfully programmed 32 bytes @ 0x7e0000
saved ddr param in flash!
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

The reason why it showed the usage thing is because I made a typo and had to remove it but backspace is not implemented in the best way. This time it seemed different as it did more things. I then tried the initramfs too cause maybe it would work

VR9 # tftp 0x80800000 openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################################
done
Bytes transferred = 4586136 (45fa98 hex)
VR9 # bootm 0x80800000
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

But nope it didn't. I also from curiosity checked if the burned chip was warming up which it did so maybe I blew something that was not used? I think my next step should be figuring out what handles the LZMA decompression and rewriting it?

At this point there's only two possibilities:

  1. as you say, uboot can't handle LZMA at all, or the specific LZMA compression of newer images. I don't know if older images have been LZMA compressed and if or when something was changed in this regard.
  2. there is something going wrong in the transfer of the binary

You could try to flash/memboot the image that last worked for you, which was ... 18.06.1?, using the u-boot.asc method just to be sure. Those images have not been changed since mid-2018. If that still gives LZMA errors, it's not uboot or LZMA, but something in your transfer process.

Edit: Possibility 3 is that your device is simply knackered beyond repair. B0rked SOC, b0rked flash, b0rked RAM. Something like that. Honestly, it's not that highly valuable of a device anymore anyway, especially with the Wifi never having been great, and Lantiq XRX200 devices are dime a dozen, so it's not that big of a loss.

1 Like

openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin - RAM ( no LZMA)
For flash you need.
openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-squashfs-kernel.bin - FLASH

1 Like

Yeah idk what it is doing but even with the initramfs it still has some lzma

VR9 # printenv\
bootcmd=run flash_flash
bootdelay=1
baudrate=115200
preboot=echo;echo run "flash_flash" to bring up the kernel;echo;
bootfile="uImage"
mem=63M
phym=64M
ipaddr=192.168.1.1
serverip=192.168.1.100
ethaddr=00:E0:92:00:01:40
netdev=eth0
console=ttyS0
tftppath=
loadaddr=0x80800000
rootpath=/mnt/full_fs
rootfsmtd=/dev/mtdblock2
nfsargs= setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
addmisc=setenv bootargs $(bootargs) console=$(console),$(baudrate) ethaddr=$(ethaddr) phym=$(phym) mem=$(mem) panic=1 mtdparts=$(mtdparts) init=/etc/prein 
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
net_nfs=tftp $(loadaddr) $(tftppath)$(bootfile);run nfsargs addip addmisc;bootm
net_flash=tftp $(loadaddr) $(tftppath)$(bootfile); run flashargs addip addmisc; bootm
net_ram=tftp $(loadaddr) $(tftppath)$(bootfile); run ramargs addip addmisc; bootm
u-boot=u-boot.ltq
rootfs=rootfs.img
firmware=firmware.img
fullimage=fullimage.img
totalimage=totalimage.img
load=tftp $(loadaddr) $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)
flashargs=setenv bootargs root=$(rootfsmtd) rw rootfstype=squashfs
flash_flash=sf probe 3; bootm 0x80800000
update_uboot=tftp $(loadaddr) $(tftppath)$(u-boot); nand write.partial $(loadaddr) 4000 $(filesize);reset
update_kernel=tftpboot $(loadaddr) $(tftppath)$(bootfile);upgrade $(loadaddr) $(filesize)
update_bootloader=update_uboot;update gphyfirmware
update_rootfs=tftpboot $(loadaddr) $(tftppath)$(rootfs);upgrade $(loadaddr) $(filesize)
update_firmware=tftpboot $(loadaddr) $(tftppath)$(firmware);upgrade $(loadaddr) $(filesize)
update_fullimage=tftpboot $(loadaddr) $(tftppath)$(fullimage);upgrade $(loadaddr) $(filesize)
update_totalimage=tftpboot $(loadaddr) $(tftppath)$(totalimage);upgrade $(loadaddr) $(filesize)
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot-2010.06-svn11047-LANTIQ-v-2.3.08
ethact=vr9 Switch

Environment size: 2105/8188 bytes
VR9 #

I also dumped the env variables cause maybe they tell something

R

OM VER: 1.1.4
CFG 05

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
VR9 # tftp $(loadaddr) openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###################
done
Bytes transferred = 5046461 (4d00bd hex)
VR9 # sf erase 0x20000 0x7a0000
Erasing SPI flash...
..........................................................................................................................
Successfully erased 7995392 bytes @ 0x20000
Done
VR9 # sf write $(loadaddr) 0x20000 0x$(filesize)

.............................................................................
Successfully programmed 5046461 bytes @ 0x20000
VR9 # reset
ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
8192 KiB W25Q64 at 0:3 is now current device
8192 KiB W25Q64 at 0:3 is now current device
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

The one that worked originally does not work anymore, the transfer method is the same, boot uboots don't have a successful boot. I can try spi flashing from a pi if someone tells me how to make an appropriate binnary to flash with mtd blocks 1-6 missing mtd 0. This router is not too critical as I got a replacement from Norway coming free of charge. Another question I raise is that of speed, I have a dsl speed of 200mbit/s I have researched this and it seems this modem is a bit slow cause of lack of hardware acceleration but I found some patches on the forum, would they have been already applied or do I need to build an image myself?

I never tried the modem in a bridge configuration, I imagine it would be fine. The CPU, though, tops out routing ~100mbps. Keep in mind the SoC was introduced more than a decade ago as a low-cost, energy efficient option targeted at 50mbps lines.

1 Like