Table of Contents

TP-Link TD-W9980

The TD-W9980 is a VDSL-capable router launched in 2014. It's identical to the TD-W8980, so as the other wiki page is filled, please click here. :-D

Supported Versions

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1.0 2014 - 15.05 (TD-W8970), trunk (TD-W8980) -

Hardware Highlights

Version SoC Ram Flash Network Wireless NIC Wireless Standard USB Serial JTag ADSL2+ Modem VDSL2 Modem
v1.0 Lantiq XWay @500MHz 64 MiB 8 MiB 4x 1000mbps Atheros AR9287 (2.54GHz)
+ Lantiq WAVE 300 (5GHz)
a/b/g/n (300Mbps @2.54GHz
+ 300Mbps @ 5GHz)
2 x 2.0 YES YES YES YES

Manufacturer's site: http://www.tp-link.com/en/products/details/?categoryid=3788&model=TD-W9980

Serial

Serial console info:

Connector J7
Pins (from top to bottom) Tx, Rx, GND, VCC (3.3V) (not same order than td-w8980)
Pins for TD-W9980B (from top to bottom) Rx, Tx, GND, VCC (3.3V) (different order than shown in picture above)
Speed 115200 8N1

Press t on the console to interrupt U-Boot autobooting.
Logon through serial by pressing Enter and using: admin/1234.

Known Issues

How to open the case

Note: This will void your warranty :!:

This case is pretty easy to open. First remove the four screws and then lift the case with a small flat screwdriver on the eight marked points of the case.

orlohct.jpg

Flashing

How To Flash the W9980 with Openwrt 15.05.1

Firstly download uboot file

Branch Type Download link
external tree UART u-boot (allows booting via serial console) u-boot.asc

Now put the device into "Boot from UART mode".

Before starting this process it is a good ideal to start a tftp server on your PC listening on its Ethernet interface on ip 192.168.1.2/24 (the default tftp server ip for the above uboot image)

Download the 15.05.1 image file and save it within the tftp server's directory https://downloads.openwrt.org/chaos_calmer/15.05.1/lantiq/xrx200/openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image

For ease connect the Ethernet cable to the router and PC before starting the boot process.

UART Boot

Connect a computer to the router via the JTAG (be careful not to fry the router with 5 Volts and use a logic converter to drop it down to the router's 3 Volt TX and RX pins)

Start a minicom or similar serial console software

Before turning on the router you will need to connect an additional cable throughout the whole period of the flash process. A soldered cable will work but an alligator clip connected to the GND on the JTAG and a small flathead screw driver with the other end of the cable stripped on the pad (shown in the image below) works well.

Temporarily connect the left side of R225 to GND (confirmed working; the red circled pad in the image above is confirmed working correctly for the W9980 - reportedly different for the very similar model w8980, to get into UART boot mode.

Power on the router

If successful you should see a message similar to this:

ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART 

Upload the U-Boot Image via:

cat u-boot.asc > /dev/ttyUSB0

Watch the loading progress via the minicom console and wait a few minutes until it boots the uboot file

Interrupt booting by pressing "t" key several times

Now we need to upload the new firmware via tftp and erase the OEM firmware via the following commands :

tftp $(loadaddr) openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image

sf erase 0x20000 0x7a0000

sf write $(loadaddr) 0x20000 0x$(filesize)

reset

quickly disconnect UART boot cable and allow the router to boot normally.

You can now ssh into OpenWrt and start configuring the router.

Web Interface Hack (Install OpenWrt without opening the case)

This hack comes from member ejs on Kitz Forum. In this post, a description and link to required software is given.
The configuration (which is essential) is hidden (you need to become forum member), so I've added it here for ease of use.

Requirements
Prerequisites
Gain shell access to the router
  1. Make sure your router is connected to your machine, and is reachable through 192.168.1.1 (default)
  2. Launch the StatPOSTer-20160306.jar tool:
    java -jar StatPOSTer-20160306.jar
    1. At the bottom select TD-W9980 from the dropdown menu.
    2. Fill the Password field ("admin" if you haven't changed it) and make sure the fields IP address and User name are properly filled.
  3. Click the Encrypt button, the interface will prompt for a .xml file (9980-config-public-plus-shell.xml) and then to store a .bin file (9980-config-public-plus-shell.bin)
  4. Log into the router via the web-interface http://192.168.1.1 and login as admin/admin
    1. Navigate to System Tools → Backup & Restore, press browse, select 9980-config-public-plus-shell.bin and press the Restore button.
      The router will reboot afterwards.
  5. Once the router comes back, the login page should show something like 'telnetd -l login 1023' on top, this is expected.
  6. Telnet into the router via port 1023. Be patient, it may take some time to get a prompt.
    telnet 192.168.1.1 1023
  7. Use admin/1234 to login (e.g. NOT admin/admin), you'll be dropped in a root shell afterwards.

From here, I followed the flash instructions for TD-W8970 by s7mx1 in the forum.

  1. Insert the USB stick in the router (any port will do)
  2. Backup the /dev/mtd0 → /dev/mtd6 to the USB stick:
    cat /dev/mtd0 > /var/usbdisk/sda1/mtd0
    cat /dev/mtd1 > /var/usbdisk/sda1/mtd1
    cat /dev/mtd2 > /var/usbdisk/sda1/mtd2
    cat /dev/mtd3 > /var/usbdisk/sda1/mtd3
    cat /dev/mtd4 > /var/usbdisk/sda1/mtd4
    cat /dev/mtd5 > /var/usbdisk/sda1/mtd5
    cat /dev/mtd6 > /var/usbdisk/sda1/mtd6
  3. Verify that the size of mtd1 (kernel partition) on the USB stick is 1310720 bytes.
    ls -la /var/usbdisk/sda1/mtd1
Install the OpenWrt firmware
  1. If you haven't aleady, insert the USB stick in the router (any port will do)
  2. Copy the two .image files from the USB stick to the router. Note that the first cat command terminates with "no such space left on device".
    This is expected behaviour. The remainder is in the slice which is written.
    cat /var/usbdisk/sda1/openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image > /dev/mtdblock1
    cat /var/usbdisk/sda1/openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade-1.image > /dev/mtdblock2
  3. Reboot the router, it will come up as OpenWrt.
Install DSL drivers

From here I decided to use the webinterface to upgrade to trunk with openwrt-lantiq-xrx200-TDW8980-squashfs-sysupgrade.bin, because it has dsl drivers on-board.
:!: However, be aware that after the upgrade to trunk no web-interface is available any more (this is normal).
Otherwise check out the VDSL.BIN section for TP-Link TD-W8970.

The TD-W9980, is advertised to support at most ITU G.993.2. This excludes VDSL vectoring support. The DSL drivers in trunk actually are the drivers from TP-Link, and do not include vectoring support either. However, I've got this router to run with full vectoring support using a 5.7.6 (77f69e99cd0e0d4d58454880a21438543f1571dc) firmware from http://xdarklight.github.io/lantiq-xdsl-firmware-info/ on my line (NL/XS4ALL):

ATU-C Vendor ID:                          Broadcom 176.199
ATU-C System Vendor ID:                   Broadcom
Chipset:                                  Lantiq-VRX200 Unknown
Firmware Version:                         5.7.6.10.0.7
API Version:                              4.16.6.3
XTSE Capabilities:                        0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2
Annex:                                    B
Line Mode:                                G.993.5 (VDSL2 with down- and upstream vectoring)
Profile:                                  17a
Line State:                               UP [0x801: showtime_tc_sync]
Forward Error Correction Seconds (FECS):  Near: 0 / Far: 31928
Errored seconds (ES):                     Near: 0 / Far: 11
Severely Errored Seconds (SES):           Near: 0 / Far: 0
Loss of Signal Seconds (LOSS):            Near: 0 / Far: 0
Unavailable Seconds (UAS):                Near: 116 / Far: 116
Header Error Code Errors (HEC):           Near: 0 / Far: 0
Non Pre-emtive CRC errors (CRC_P):        Near: 0 / Far: 0
Pre-emtive CRC errors (CRCP_P):           Near: 0 / Far: 0
Power Management Mode:                    L0 - Synchronized
Latency / Interleave Delay:               Down: Fast (0.15 ms) / Up: Interleave (8.0 ms)
Data Rate:                                Down: 77.848 Mb/s / Up: 32.253 Mb/s
Line Attenuation (LATN):                  Down: 9.2dB / Up: 7.7dB
Signal Attenuation (SATN):                Down: 9.2dB / Up: 7.6dB
Noise Margin (SNR):                       Down: 4.1dB / Up: 5.0dB
Aggregate Transmit Power (ACTATP):        Down: -5.1dB / Up: 13.7dB
Max. Attainable Data Rate (ATTNDR):       Down: 85.842 Mb/s / Up: 35.400 Mb/s
Line Uptime Seconds:                      613
Line Uptime:                              10m 13s

One awesome thing to mention (at least with trunk) is that the reset button resets the configuration, which is very nice. I couldn't find any notion of this, but because of the dsl port, the failsafe mode of openwrt (nicely triggered with the wps button on the back) doesn't make the device accessible. Probably because of something like this https://lists.openwrt.org/pipermail/openwrt-devel/2015-February/031071.html. Anyway, when I made some network changes which were totally wrong, holding the reset button saved the day, restoring the device back into standard openwrt configuration, allowing me to access it again.

Successfully tested on TD-W9980 Ver 1.0, adapted from TD-W8970 page.

Prepare the file

The router's EEPROM size is 8MiB (8 388 608 bytes). Firsts 128KiB (131 072 bytes) are for bootloader, and the lasts 256KiB (262 144 bytes) aren't contained in any firmware download. If you loose it, only a previous firmware backup of this EEPROM part can be used to restore it. Between them, you should reflash the "midle" space (from 0x20000 to 0x7c0000, so it's 0x7a0000 sized, 7 995 392 bytes), it's the rootfs.

Obtain the firmware from TP-Link website. You need to care about model version v1. If the name of your TP-Link original firmware contains "boot", it means that it's likely to contains bootloader, 512 blank bytes, and the rootfs (you should see that the file is 512 bytes too big to be just bootloader + rootfs). Looking at it with an hexadecimal editor, with 512 bytes pages, you will see that if bootloader is taking the 256 first pages (0 to 255), but then the firmware doesn't start at the following page (256) but in page 257.

Here's the Linux command to cut the firsts 257 * 512 bytes :

dd if=orig.bin of=tplink.bin skip=257 bs=512

Then the "tplink.bin" file should be exactly 7 995 392 bytes. It can be used to reflash the space from 0x20000, for 7a0000 bytes. I suppose that the space from 0 to 0x20000 can also re-programmed using the first 131 072 bytes of the TP-Link firmware files but I didn't tested it.

Restore the file

  1. Read this completely before to actually do it
  2. Prepare your Image, as explained before if the the file contains boot you need to strip the header off with "dd if=orig.bin of=tplink.bin skip=257 bs=512" like I did for "TD-W9980v1_0.6.0_1.13_up_boot(160125)_2016-01-25_15.45.32.bin"
  3. Host the file on a computer using 192.168.1.2 as IP address, with "tftpd-hta" server for example (on Debian, default home directory of this tftp server is /srv/tftp/), connected to the router
  4. Switch on the device with UART Boot (see previous section about that, using u-boot.asc and then "t" key to interrupt booting)
  5. Enter the following commands :
    1. Set the device's IP if you don't want the default 192.168.1.1: (so you don't have to move your TFTP server onto a different subnet)
      setenv ipaddr 192.168.1.1
    2. Set the address of your TFTP server:
      setenv serverip 192.168.1.2
    3. Set the board type (not sure if this is necessary, work on W9980 anyway, copied from W8970 procedure):
      setenv bootargs 'board=WD8970'
    4. Download the image into RAM (*not* flash):
      tftpboot 0x80800000 tplink.bin
    5. Erase the rootfs flash area:
      sf erase 0x20000 0x7a0000
    6. Write image to flash:
      sf write 0x80800000 0x20000 0x7a0000
    7. Reboot:
      reset

The rootfs area is from 0x20000 to 0x7c0000 (0x7a0000 sized), erase command is from 0x20000, during 0x7a0000, and write is also from 0x20000, during 0x7a0000. You can double check the image size in after the tftpboot command. Be careful when erasing/writing the flash the radio is required for WLAN and should not be overwritten or erased. A backup is nice to have if something went wrong, it stores also the MAC address for your WLAN (ART Partition).

Partition Table

This is the result of cat /proc/mtd

dev: size erasesize name
mtd0: 00020000 00010000 "boot"
mtd1: 00140000 00010000 "kernel"
mtd2: 00660000 00010000 "rootfs"
mtd3: 00010000 00010000 "config"
mtd4: 00010000 00010000 "romfile"
mtd5: 00010000 00010000 "rom"
mtd6: 00010000 00010000 "radio"

Specific configuration

Switch ports

Port Switch port
LAN1 5
LAN2 0
LAN3 2
LAN4/WAN 4
GMII 6 (marked as CPU)

Tags

How to add tags