TP-Link TD-W9980 / TD-W9980B Wiki inacurracy that can lead to bricks

MSRP was like 50 euro?

so like 100 tops with it as a router and then I will need to bridge it for it to have higher speeds? Also does the firmware work with super-vectoring?

The "LZMA overwrite" is because you loaded the compressed image to the same area of RAM where the uncompressed image needs to land. So as the kernel starts to uncompress, uncompressed data is written over top of the data remaining to be uncompressed. The kernel clobbers itself.

Change the TFTP load address to 0x81000000 (16 MB from the start of RAM) and it should work.

Booting an initramfs is my preferred way to de-brick. Erasing and writing flash manually has a large potential for error.

2 Likes

"Low-cost" chipset, think manufactoring.

"Bridging" in this case means using the router as a modem, without the need for the CPU to route anything. Again, I have never tried this.

No. It's not a firmware limitation, the modem chipset itself is incapable of SuperVectoring 35b.

1 Like
ROM VER: 1.1.4
CFG 05

ROM VER: 1.1.4
CFG 05

DDR autotuning Rev 1.0
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 2010.06-svn11047-LANTIQ-v-2.3.08 (May 07 2015 - 10:54:12)

CLOCK CPU 500M RAM 250M
DRAM:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   Internal phy(GE) firmware version: 0x8434
vr9 Switch8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  


run "flash_flash" to bring up the kernel

Hit any key to stop autoboot:  0 
VR9 # tftp 0x81000000 openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin
8192 KiB W25Q64 at 0:3 is now current device
MAC: 00-00-a0-bb-cc-ff  
Using vr9 Switch device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-19.07.6-lantiq-xrx200-tplink_tdw8980-initramfs-kernel.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################################
done
Bytes transferred = 4586136 (45fa98 hex)
VR9 # bootm 0x81000000 
        Uncompressing ... LZMA: uncompress or overwrite error 1 - must RESET board to recover
VR9 #

Didn't fix anything as far as I see.

Yeah I think that works as the person who informed me of this modem uses it in bridge mode and anyway sing 35b is unavailable then 17a is like 150mbit I think, how about 30a?

At that scale even 3d printers would cost 2 dimes today.

VDSL2 profiles 8a, 8b, 8c, 8d, 12a, 12b, 17a, 30a should be possible.

Are you still requiring help? As I have a Full SPI dump of W9980 non B variant.

I also have the non b varient so I think I could use that. I am indeed still requiring help. Do you know the pinout of the chip used? I have already removed it

I used an SOIC clip to do mine. Will find where I out it and will upload it when I can.

As for PinOut the Dimble is pin1

So what's puzzling to me is why this is still not working for you. You are uploading the uboot through serial, you are using it to boot an image uploaded through serial. The flash chip is entirely out of the picture at this point.

One last-ditch effort: I have seen and experienced myself that bootm can behave differently from just jumping to the load address. I.e., instead of bootm 0x81000000 you could try go 0x81000000

It is the flash chip... I made a dump and then erased it in order to flash the dump from @solidus1983 and I got errors when trying to write, I tried the WP pin Low high and hanging for which none of them worked. It is now spamming

ROM VER: 1.1.4
CFG 05
ROM VER: 1.1.4
CFG 05 
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05  
ROM VER: 1.1.4
CFG 05 

So I need a new eeprom, great...

Well then. I really hoped I wasn't right about this, but if you get write errors when using a programmer then ...

This still very much doesn't explain why booting initramfs would fail when everything was in-RAM only. But I guess at this point, short of a flash chip replacement, the device is a shiny doorstop.

Maybe it could need to write some to eeprom to boot from ram

That is uboot missing which is normal you erased the chip of all its firmware.

I know, we mean before when I tried booting from ram it might have needed some kind of write op to the flash

I found the same but working eeprom on another router so I will try it in the week since I am quite busy now

If you have the backup mtd files, you can recover this device. It looks like you have overwritten the mtd3, mtd4, mtd5, mtd6.

mtd3 contains the OEM firmware's configuration data. You don't need this for OpenWRT.

mtd4 contains the MAC adress and WPS key of the device. OpenWRT doesn't use the WPS key, but uses the MAC adress. At worst, you'll get a bad mac adress and networking is broken. It should not prevent the device from booting.

mtd5 is used by U-Boot to store ddr_settings. You should have this partition in order to factory U-Boot to work correctly.

mtd6 is the wifi calibration data. You will not have wifi without this partition. It should also not prevent the device from booting.

1 Like

Also, in case if you didn't figure it out already, TD-W8970, TD-W8980, TD-W9980, TD-W9980B, are essentially the same device with small differences. W8970 does not have the 5Ghz radio, and B variants support Annex B instead of Annex A.

TD-W8970 and TD-W8980 are sold as ADSL devices by TP-Link. This is a limitation of the original firmware. All devices are VDSL capable up to 30a with Vectoring support.

1 Like

Update
I got it working by replacing the spi storage with an identical one but on the 16 pin package in order to help with heat dissipation during soldering. I wonder if I can put a larger 16mb or 32mb spi storage chip on it but I am not certain and I don't know too much about these devices. I flashed @solidus1983 's binary and it booted first time and every operation is working. I would like to thank anyone who helped me during this endeavor, I'll be eternally graceful. This can now be considered solved.

1 Like

A post was split to a new topic: Searching for TD-W8980 flash dump

Hello @solidus1983 ,
can you please share your Full Spi Dump ?