User Tools

Site Tools


toh:tp-link:td-w8960n

TP-Link TD-W8960N

300Mbps Wireless N ADSL2+ Modem Router

→ CURRENTLY UNSUPPORTED DEVICE ← Reported as ticket #10666
Forum discussion here

OEM source code available at:
TD-W8960Nv1.0_RELEASE_GPL_CODE.tar.gz

Hardware Highlights

(for version 1 and version 3)

CPU Ram Flash Network Wireless NIC Wireless Standard USB Serial JTag ADSL2+ Modem
BCM6358@300MHz 32 MB 4 MB 4x 100mbps BCM4351 (onboard) b/g/n NO YES YES YES

Hardware Picture

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96358VW2
System-On-Chip: BCM6358
CPU/Speed BMIPS4350 V1.0 / 300 Mhz BMIPS Dual Core
Flash-Chip: Spansion S25FL032A (on v1.3 hardware)
Flash size: 4 MiB
RAM-Chip : DDR-400
RAM size : 32 MiB
Wireless: Broadcom BCM4351 802.11b/g/n (onboard)
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
USB: no
Serial: Yes
JTAG: Yes

Installation

WARNING! CURRENTLY THIS WILL BRICK YOUR ROUTER

  1. Download the latest openwrt-96358VW2-generic-squashfs-cfe.bin from OpenWrt trunk.
  2. Use a tftp CLIENT to upload the image (for example tftp2.exe on windows)
  3. Wait for it to flash, router will reboot and enter in recovery mode
  4. Go to http://192.168.1.1 and reflash the openwrt-96358VW2-generic-squashfs-cfe.bin image
  5. The router should now boot to openwrt

Alternative mode (you have to open the router case):

  1. Flash using a Serial TTL adapter and CFE bootloader.
  2. Setup a TFTP server on your computer.
  3. Using the serial connection, stop the boot process by pressing any key when asked
  4. Once you are on the CFE prompt do "flashimage hostip:image.bin" (example CFE > flashimage 192.168.1.2:firmware.bin)
  5. The device should automatically reboot to openwrt

Revert to original firmware

You will need an active serial connection!

  1. Download the latest firmware from the TP-LINK servers
  2. Using an hex-editor remove everything from offset 00000000 to 000001FF (this means that now the 1st character of the firmware is a 6 (or 36 in BIN))
  3. Save that modified original image
  4. Go to the CFE prompt and do "flashimage hostip:image.bin"
  5. The device should automatically reboot to original tplink firmware

Serial

port.serial Pin: TX,RX,GND,VCC (3.3v)
Speed: 115200 8N1

Don't connect VCC! Just use TX,RX and GND and then power on the device.
Also, you MUST short those 2 pads marked in yellow to enable serial RX and TX.
Don't forget that RX connects to the RS232TTL-TX and TX to the RS232TTL-RX!


How to open the case

TD-W8960N is a little tricky to open.

  1. Below 2 rubber feets there are 2 screws - remove them
  2. Using your hands and a small screwdriver, try to open the upper and lower part (both are white) so that you can grab the 2 black laterals and push them a little. Don't force it!
  3. Near the leds, there are 2 snaps. Using a flat screwdriver, try to open them from the inside. If you don't have space, check if the 2 antenna cables are stuck on any capacitor.
  4. The front part should be now loose and all you need is to pull the white upper cover.

Hardware mods

Because TD-W8960N is an unit that gets way too hot, adding 2 heatsinks is a good idea.

  1. Add 1 heatsink to the cpu (look at the above image, it's the big square chip on the center)
  2. Add 1 heatsink to the switch (also look at the above image, it's the left chip with "broadcom" written on it)

This should prevent any overheating signs.

Debug Logs

# cat /proc/cpuinfo system type : 96358VW2 processor : 0 cpu model : BCM6358 V1.0 BogoMIPS : 297.98 wait instruction : no microsecond timers : yes tlb_entries : 32 extra interrupt vector : no hardware watchpoint : no ASEs implemented : VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 8260 # cat /proc/mtd dev: size erasesize name mtd0: 00313000 00313000 "Physically mapped flash" # cat /proc/partitions major minor #blocks name 31 0 3148 mtdblock0 # cat /proc/meminfo MemTotal: 29820 kB MemFree: 9148 kB Buffers: 2320 kB Cached: 7860 kB SwapCached: 0 kB Active: 6868 kB Inactive: 6576 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 3276 kB Mapped: 2684 kB Slab: 3092 kB SReclaimable: 508 kB SUnreclaim: 2584 kB PageTables: 384 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 14908 kB Committed_AS: 7320 kB VmallocTotal: 1032148 kB VmallocUsed: 1732 kB VmallocChunk: 1029348 kB # cat /proc/version Linux version 2.6.21.5 (root@localhost.localdomain) (gcc version 4.2.3) #4 Fri Oct 28 18:30:25 CST 2011 --------------------------------------------------------------------- Logs at boot time (RS232ttl) CFE version 1.0.37-102.9 for BCM96358 (32bit,SP,BE) Build Date: äş 12ć 29 20:10:30 CST 2009 (root@localhost.localdomain) Copyright (C) 2000-2009 Broadcom Corporation. Serial flash device: name S25FL032A, id 0x0115, size 4096KB CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz CPU running TP0 Total memory: 33554432 bytes (32MB) Boot Address 0xbfc00000 Param0 : 192.168.1.1:ffffff00 Param1 : 192.168.1.100 Param2 : Param3 : f Param4 : vmlinux Param5 : bcm963xx_fs_kernel Param6 : 1 Param7 : 0 Num = 8;gNumBootParams = 8 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-5) : 96358VW2 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:23:cd:##:##:## PSI Size (1-64) KBytes : 24 Main Thread Number [0|1] : 0 Device Pin : "#######" * * * Press any key to stop auto run (1 seconds) * * * Auto run second count down: 1 web info: Waiting for connection on socket 0. CFE> CFE> help Available commands: sm Set memory or registers. dm Dump memory or registers. w Write the whole image start from beginning of the flash e Erase [n]vram or [a]ll flash except bootrom r Run program from flash image or from host depend on [f/h] flag p Print boot line and board parameter info c Change booline parameters f Write image to the flash i Erase persistent storage data b Change board parameters reset Reset the board flashimage Flashes a compressed image after the bootloader. help Obtain help for CFE commands For more information about a command, enter 'help command-name' * * * command status = 0

Bootlogs

OEM bootlog

CFE> Booting from only image (0xbfc10000) ... Code Address: 0x80010000, Entry Address: 0x8021a000 Decompression OK! Entry at 0x8021a000 Closing network. Closing DMA Channels. Starting program at 0x8021a000 Linux version 2.6.21.5 (root@localhost.localdomain) (gcc version 4.2.3) #2 Wed Aug 25 17:14:28 CST 2010 Serial flash device: name S25FL032A, id 0x0115, size 4096KB 96358VW2 prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 01fa0000 @ 00000000 (usable) On node 0 totalpages: 8096 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 31 pages used for memmap Normal zone: 3969 pages, LIFO batch:0 Built 1 zonelists. Total pages: 8033 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 brcm mips: enabling icache and dcache... Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB, 2-way, linesize 16 bytes. Synthesized TLB refill handler (21 instructions). Synthesized TLB load handler fastpath (33 instructions). Synthesized TLB store handler fastpath (33 instructions). Synthesized TLB modify handler fastpath (32 instructions). PID hash table entries: 128 (order: 7, 512 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 29732k/32384k available (1762k kernel code, 2652k reserved, 321k data, 88k init, 0k highmem) KLOB Pool 1 Initialized: 1048576 bytes Calibrating delay loop... 297.98 BogoMIPS (lpj=148992) Mount-cache hash table entries: 512 NET: Registered protocol family 16 Total Flash size: 4096K with 64 sectors File system address: 0xbfc10100 registering PCI controller with io_map_base unset BLOG v1.0 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Time: MIPS clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro io scheduler noop registered (default) PPP generic driver version 2.4.2 NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 brcmboard: brcm_board_init entry SES: Button Interrupt 0x3 is enabled SES: LED GPIO 0x4 is enabled irq.c: reset_fac_irq is set to low_trigger. Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xfffe0100 (irq = 10) is a BCM63XX ttyS1 at MMIO 0xfffe0120 (irq = 11) is a BCM63XX bcmxtmrt: Broadcom BCM6358A1 ATM Network Device v0.1 Aug 25 2010 17:14:19 TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 88k freed init started: BusyBox v1.00 (2010.08.12-01:27+0000) multi-call binary BusyBox v1.00 (2010.08.12-01:27+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... pktflow: module license 'Proprietary' taints kernel. Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Constructed Broadcom Packet Flow Cache v0.1 Feb 26 2009 14:21:08 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug 25 2010 17:14:08 Config Ethernet Switch Through MDIO Pseudo PHY Interface ethsw: found bcm5325e! dgasp: kerSysRegisterDyingGaspHandler: eth0 registered rate ctrl page 0x35, addr 0x02: 0 8021x_1 page 0x0A, addr 0x4C: 0 8021x_2 page 0x0A, addr 0x4E: 0 eth0: MAC Address: 00:23:CD:20:16:FF PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 wl0: Broadcom BCM4351 802.11 Wireless Controller 5.10.85.0.cpe4.402.0 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered ===== Release Version 4.02L.03 (build timestamp 100825_1906) ===== wl_cnt= 1 device eth0 is not a slave of br0 device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state WLmngr Daemon is running optarg=0 shmId=0 device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state BcmAdsl_Initialize=0xC006B1F8, g_pFnNotifyCallback=0xC0088744 AnnexCParam=0x00000000 AnnexAParam=0x00000980 adsl2=0x00000000 KLOB extended to 2 pools pSdramPHY=0xA1FFFFF8, 0xBE9A 0xDEADBEEF AdslCoreSharedMemInit: shareMemAvailable=21712 AdslCoreHwReset: AdslOemDataAddr = 0xA1FEF96C AnnexCParam=0x00000000 AnnexAParam=0x00000980 adsl2=0x00000000 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered KLOB extended to 3 pools KLOB extended to 4 pools KLOB extended to 5 pools KLOB extended to 6 pools KLOB extended to 7 pools KLOB extended to 8 pools wlctl -i wl0 phytype > /var/wl0 wlctl -i wl0 revinfo > /var/wl0 wlctl -i wl0 bands > /var/wl0bands wlctl ver > /var/wlver wlctl -i wl0 cap > /var/wl0cap device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state interface wl0.1 does not exist! interface wl0.2 does not exist! interface wl0.3 does not exist! Scratch pad is not initialized. br0: port 2(wl0) entering disabled state WPS Device PIN = 23402034 wlctl -i wl0 phy_watchdog 0 wlctl -i wl0 wds none wlctl -i wl0 up wlctl -i wl0 down wlctl -i wl0 mbss 0 wlctl -i wl0 bss -C 0 down wlctl -i wl0 bss -C 1 down wlctl -i wl0 bss -C 2 down wlctl -i wl0 bss -C 3 down wlctl -i wl0 ssid -C 0 's''k''y' Setting SSID "sky" wlctl -i wl0 ssid -C 1 'w''l''0''_''G''u''e''s''t''1' Setting SSID "wl0_Guest1" wlctl -i wl0 ssid -C 2 'w''l''0''_''G''u''e''s''t''2' Setting SSID "wl0_Guest2" wlctl -i wl0 ssid -C 3 'w''l''0''_''G''u''e''s''t''3' Setting SSID "wl0_Guest3" wlctl -i wl0 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.1 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.2 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0.3 cur_etheraddr 00:23:CD:20:16:FF 2>/dev/null wlctl -i wl0 ap 1 wlctl -i wl0 infra 1 wlctl -i wl0 closed 0 wlctl -i wl0 country PL wlctl -i wl0 band b wlctl -i wl0 regulatory 0 wlctl -i wl0 radar 0 2>/dev/null wlctl -i wl0 spect 0 2>/dev/null wlctl -i wl0 nmode -1 wlctl -i wl0 mimo_bw_cap 1 wlctl -i wl0 chanspec -c 7 -b 2 -w 40 -s -1 Chanspec set to 0x2d07 wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 0 0 2>/dev/null wlctl -i wl0 wpa_cap -C 1 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 1 0 2>/dev/null wlctl -i wl0 wpa_cap -C 2 > /var/wpa_cap0 wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null wlctl -i wl0 wpa_cap -C 3 > /var/wpa_cap0 wlctl: Unsupported wlctl -i wl0 wpa_cap -C 3 0 2>/dev/null wlctl -i wl0 maxassoc 50 wlctl -i wl0 bss_maxassoc 50 wlctl -i wl0 gmode Auto wlctl -i wl0 gmode_protection_override -1 wlctl -i wl0 gmode_protection_control 2 wlctl -i wl0 nmode_protection_override -1 wlctl -i wl0 protection_control 2 wlctl -i wl0 nreqd 0 wlctl -i wl0 wme 0 2>/dev/null wlctl -i wl0 afterburner_override 0 2>/dev/null wlctl -i wl0 ampdu 1 wlctl -i wl0 amsdu 1 wlctl -i wl0 afterburner_override 0 wlctl -i wl0 wme 1 2>/dev/null wlctl -i wl0 wme_noack 0 2>/dev/null wlctl -i wl0 wme_apsd 1 2>/dev/null wlctl -i wl0 wme_bss_disable 0 wlctl -i wl0 rate 0 wlctl -i wl0 bg_rate 0 wlctl -i wl0 leddc 0 2>/dev/null wlctl -i wl0 mrate -1 wlctl -i wl0 bg_mrate -1 wlctl -i wl0 rateset default wlctl -i wl0 rtsthresh 2347 wlctl -i wl0 fragthresh 2346 wlctl -i wl0 dtim 1 wlctl -i wl0 bi 100 wlctl -i wl0 frameburst 1 wlctl -i wl0 ap_isolate 0 wlctl -i wl0 pwr_percent 100 wlctl -i wl0 wmf_bss_enable 0 wlctl -i wl0.1 wmf_bss_enable 0 wlctl -i wl0.2 wmf_bss_enable 0 wlctl -i wl0.3 wmf_bss_enable 0 wlctl -i wl0 mac none wlctl -i wl0 macmode 0 wlctl -i wl0 up wlctl -i wl0 csscantimer 0 wlctl -i wl0 chanspec > /var/curchaspec0 br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0 left promiscuous mode br0: port 2(wl0) entering disabled state device wl0 is not a slave of br0 device wl0 entered promiscuous mode br0: port 2(wl0) entering learning state br0: topology change detected, propagating br0: port 2(wl0) entering forwarding state device wl0.1 is not a slave of br0 device wl0.2 is not a slave of br0 device wl0.3 is not a slave of br0 Reaped 415 UPnP::upnp_init:UPnP daemon is ready to run UPnP::upnp_request_handler:UPNP_CMD_DEV_ADD UPnP::upnp_device_attach:br0: attach WFADevice.xml UPnP::upnp_request_handler:Device command.

Tags

toh/tp-link/td-w8960n.txt · Last modified: 2013/05/23 11:53 by danitool