TP-Link TD-W9980 / TD-W9980B

The TD-W9980 is a VDSL-capable router launched in 2014. It's identical to the TD-W8980, so check that page out as some information is there and some here. The device works very well with OpenWrt, including the integrated DSL modem. Just the 5 GHz Wifi cannot be used and for VDSL you'll need to use a propriertary binary blob as described in this article.

This page is also for TD-W9980B which is nearly identical, with the exception that you can't flash via the Web UI exploit.

The B is for annex B and cannot be changed. Check if your provider use this annex

OEM source code available at: GPL_TD-W9980.tar.gz

• Switch acts weird (forwarding broadcast frames to all ports) ticket 14439 ticket 15511 can be fixed this way disable SW_ROUTING
• Switch doesn't allow tagged and untagged traffic on the same port, can be fixed with with Martin Schiller's changes
• Failsafe-Mode is not accessible via ethernet when triggered with the WPS button and indicated by led. (fixed for TDW8970)

• Device is not supported/built sysupgrade for yet, possible profile (plus fix for failsafe) can be found here. Seems like the W8980 image can by sysupgraded without an issue.

→ Install OpenWrt (generic explanation)

Please add the installation procedure here.

This installation method works for all firmware versions of all devices that are mentioned on this page. However, it is necessary to open the case and to solder a pin header to prepare the installation.

Note: This may void your warranty

This case is pretty easy to open. First remove the four screws, and then pry the case with a small flat screwdriver, starting from the top (as that's the only non-tight place where you can actually put something) till the eight marked points of the case pop out.

Then you need to detach the U.FL RF connectors and make sure they're not in the way for pulling the board out. On W9980B one of them is hidden between tho components (one of them is a big red one). Gently push away the red one and pull the cable out.

Because there's copper pads on each side of the board which are glued to the plastic case while also being soldered onto the board, you're going to have to keep them attached for convenience and keep them in mind when manipulating with the board.

The UART is not populated, so you're going to have to solder a header on it. Look into the serial console informations at the start of the page for pinout for UART.

The pin header for the serial console is not populated. It has to be soldered onto the board. A usual 2.5mm J7 pin header will do the job.

Press t on the console to interrupt U-Boot autobooting.
Logon through serial by pressing Enter and using: admin/1234.

Before starting the process, it is a good ideal to start a TFTP server on your PC listening on its Ethernet interface on IP 192.168.1.2/24. The default TFTP server IP for the u-boot that will be downloaded in the next step.

Download the 18.06.1 image file (openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin) and save it within the TFTP server's directory.

For ease connect the ethernet cable to the router and PC before starting the boot process.

Firstly download bootloader file: u-boot.asc.

Connect a computer to the router via the UART (be careful not to fry the router with 5 Volts and use a logic converter to drop it down to the router's 3 Volt TX and RX pins). DO NOT CONNECT VCC!

Start 'screen', 'minicom' or similar serial console software.

Note: Make sure it accepts user input by interrupting normal booting by pressing 't' on U-Boot loading. If it doesn't, try another software. (screen recommended)

Left R225 pad, bottom of the board:

You need to keep a left side of R225 shorted to UART GND from boot to finishing of uploading the U-Boot image. A soldered cable will work, but an alligator clip connected to the GND on the UART and a small flathead screw driver or scissors pressed against the pad (shown in the image below) work as well, as long as you can hold them steady for about 30 seconds.

(The image above works for W9980 and W9980B, but is reportedly different for the very similar model w8980)

How the setup you end up with may look like (I opted for the scissors as the R225 pad is really tiny and I didn't have a proper soldering iron for that):

So, short the pin, power on the router and you should see a message similar to this:

ROM VER: 1.1.4
CFG 04
EEPROM Data OK
UART 

Upload the U-Boot Image from another terminal via:

# cat u-boot.asc > /dev/ttyUSB0

Watch the loading progress via the console and wait a few minutes until it boots the U-Boot file.

Interrupt booting by pressing “t” key several times.

Disconnect the R225 pin from GND. Though you can keep it there until the flashing is done.

Now we need to upload the new firmware via tftp and erase the OEM firmware via the following commands:

tftp $(loadaddr) openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin
# Note: If you get timeouts (T) executing this command, you probably did not set up the networking/tftpd correctly or your ethernet cable is bad.
sf erase 0x20000 0x7a0000
sf write $(loadaddr) 0x20000 0x$(filesize)
reset

Allow the router to boot normally by rebooting it. You can now SSH into OpenWrt and start configuring the router. If a release version was flashed, the web configuration should be available now, too.

TD-W9980 only, the B version supposedly uses a different encryption format the StatPOSTer tool can't deal with. Also note that the instructions in this section are written for 15.05 and W8970 image is used, but 18.06 is already out and W8980 may be a better fit.

This hack comes from member ejs on Kitz Forum. In this post, a description and link to required software is given.
The configuration (which is essential) is hidden (you need to become forum member), so I've added it here for ease of use.

• StatPOSTer-20160306.jar (A tool written in Java to create a manipulated router config-file)
• Java 8 (OpenJDK is fine) (Required to run the above file - newer versions don't seem to work)
• 9980-config-public-plus-shell.xml

  <?xml version="1.0"?>
  <DslCpeConfig>
    <InternetGatewayDevice>
      <DeviceSummary val="InternetGatewayDevice:1.1[](Baseline:1, EthernetLAN:1)" />
      <LANDeviceNumberOfEntries val=1 />
      <DeviceInfo>
        <ManufacturerOUI val=C04A00 />
        <Description val="N600 Wireless Dual Band Gigabit VDSL2 Modem Router`telnetd -p 1023 -l login`" />
        <HardwareVersion val="TD-W9980 v1 00000000" />
        <SoftwareVersion val="0.6.0 1.12 v0021.0 Build 150507 Rel.40130n" />
        <UpTime val=9 />
      </DeviceInfo>
      <ManagementServer>
        <PeriodicInformTime val=1970-01-01T00:00:10 />
      </ManagementServer>
      <X_TPLINK_EthSwitch>
        <EnableVirtualPorts val=1 />
        <NumberOfVirtualPorts val=4 />
        <IfName val=eth0 />
      </X_TPLINK_EthSwitch>
      <X_TPLINK_AppCfg>
        <DynDnsCfg>
          <Server val=members.dyndns.org />
        </DynDnsCfg>
        <UPnPCfg>
          <Enable val=1 />
        </UPnPCfg>
        <SnmpCfg>
          <SysName val=,TD-W9980 />
          <SysDescr val="0.6.0 1.12 v0021.0 Build 150507 Rel.40130n" />
        </SnmpCfg>
        <NoipDnsCfg>
          <State val=3 />
          <Server val=dynupdate.no-ip.com />
        </NoipDnsCfg>
        <ACL instance=1 >
          <Enable val=1 />
          <IPStart val=0.0.0.0 />
          <IPEnd val=0.0.0.0 />
          <Service val=Ping />
          <Location val=Local />
        </ACL>
        <ACL nextInstance=2 />
      </X_TPLINK_AppCfg>
      <Time>
        <CurrentLocalTime val=1970-01-01T00:00:40+00:00 />
        <LocalTimeZone val=+00:00 />
      </Time>
      <Layer2Bridging>
        <BridgeNumberOfEntries val=1 />
        <FilterNumberOfEntries val=6 />
        <AvailableInterfaceNumberOfEntries val=6 />
        <Bridge instance=1 >
          <BridgeEnable val=1 />
          <BridgeName val=Default />
        </Bridge>
        <Bridge nextInstance=2 />
        <Filter instance=1 >
          <FilterKey val=1 />
          <FilterEnable val=1 />
          <FilterBridgeReference val=0 />
          <__filterBridgeRefName val=Default />
          <FilterInterface val=eth0.2 />
          <X_TPLINK_IfAliasName val=LAN4 />
        </Filter>
        <Filter instance=2 >
          <FilterKey val=2 />
          <FilterEnable val=1 />
          <FilterBridgeReference val=0 />
          <__filterBridgeRefName val=Default />
          <FilterInterface val=eth0.3 />
          <X_TPLINK_IfAliasName val=LAN3 />
        </Filter>
        <Filter instance=3 >
          <FilterKey val=3 />
          <FilterEnable val=1 />
          <FilterBridgeReference val=0 />
          <__filterBridgeRefName val=Default />
          <FilterInterface val=eth0.4 />
          <X_TPLINK_IfAliasName val=LAN2 />
        </Filter>
        <Filter instance=4 >
          <FilterKey val=4 />
          <FilterEnable val=1 />
          <FilterBridgeReference val=0 />
          <__filterBridgeRefName val=Default />
          <FilterInterface val=eth0.5 />
          <X_TPLINK_IfAliasName val=LAN1 />
        </Filter>
        <Filter instance=5 >
          <FilterKey val=5 />
          <FilterEnable val=1 />
          <FilterBridgeReference val=0 />
          <__filterBridgeRefName val=Default />
          <FilterInterface val=ath0 />
          <X_TPLINK_IfAliasName val=Wi-Fi_2.4G />
        </Filter>
        <Filter nextInstance=6 />
        <AvailableInterface instance=1 >
          <AvailableInterfaceKey val=1 />
          <InterfaceType val=LANInterface />
          <InterfaceReference val=LAN_ETH_INTF#1,1 />
        </AvailableInterface>
        <AvailableInterface instance=2 >
          <AvailableInterfaceKey val=2 />
          <InterfaceType val=LANInterface />
          <InterfaceReference val=LAN_ETH_INTF#1,2 />
        </AvailableInterface>
        <AvailableInterface instance=3 >
          <AvailableInterfaceKey val=3 />
          <InterfaceType val=LANInterface />
          <InterfaceReference val=LAN_ETH_INTF#1,3 />
        </AvailableInterface>
        <AvailableInterface instance=4 >
          <AvailableInterfaceKey val=4 />
          <InterfaceType val=LANInterface />
          <InterfaceReference val=LAN_ETH_INTF#1,4 />
        </AvailableInterface>
        <AvailableInterface instance=5 >
          <AvailableInterfaceKey val=5 />
          <InterfaceType val=LANInterface />
          <InterfaceReference val=LAN_WLAN#1,1 />
        </AvailableInterface>
        <AvailableInterface nextInstance=6 />
      </Layer2Bridging>
      <LANDevice instance=1 >
        <LANEthernetInterfaceNumberOfEntries val=4 />
        <LANWLANConfigurationNumberOfEntries val=2 />
        <LANHostConfigManagement>
          <DHCPServerEnable val=1 />
          <MinAddress val=192.168.1.100 />
          <MaxAddress val=192.168.1.199 />
          <IPRouters val=192.168.1.1 />
          <IPInterfaceNumberOfEntries val=1 />
          <IPInterface instance=1 >
            <Enable val=1 />
            <__ifName val=br0 />
          </IPInterface>
          <IPInterface nextInstance=2 />
        </LANHostConfigManagement>
        <X_TPLINK_LANIPv6HostConfigManagement>
          <__ifName val=br0 />
          <IPv6InterfaceNumberOfEntries val=1 />
          <IPv6Interface instance=1 >
            <Enable val=1 />
            <__ifName val=br0 />
          </IPv6Interface>
          <IPv6Interface nextInstance=2 />
        </X_TPLINK_LANIPv6HostConfigManagement>
        <LANEthernetInterfaceConfig instance=1 >
          <Enable val=1 />
          <Status val=Up />
          <__ifName val=eth0.2 />
        </LANEthernetInterfaceConfig>
        <LANEthernetInterfaceConfig instance=2 >
          <Enable val=1 />
          <Status val=Up />
          <__ifName val=eth0.3 />
        </LANEthernetInterfaceConfig>
        <LANEthernetInterfaceConfig instance=3 >
          <Enable val=1 />
          <Status val=Up />
          <__ifName val=eth0.4 />
        </LANEthernetInterfaceConfig>
        <LANEthernetInterfaceConfig instance=4 >
          <Enable val=1 />
          <Status val=Up />
          <__ifName val=eth0.5 />
        </LANEthernetInterfaceConfig>
        <LANEthernetInterfaceConfig nextInstance=5 />
        <WLANConfiguration instance=1 >
          <Enable val=1 />
          <Name val=wlan0 />
          <Channel val=6 />
          <AutoChannelEnable val=1 />
          <X_TPLINK_PreSSID val=TP-LINK_2.4GHz />
          <BeaconType val=11i />
          <X_TPLINK_MACAddressControlRule val=deny />
          <X_TPLINK_Band val=2.4GHz />
          <X_TPLINK_Bandwidth val=Auto />
          <Standard val=n />
          <WEPKeyIndex val=1 />
          <BasicEncryptionModes val=None />
          <BasicAuthenticationMode val=None />
          <WPAEncryptionModes val=TKIPandAESEncryption />
          <WPAAuthenticationMode val=PSKAuthentication />
          <IEEE11iEncryptionModes val=AESEncryption />
          <IEEE11iAuthenticationMode val=PSKAuthentication />
          <SSIDAdvertisementEnabled val=1 />
          <TransmitPower val=100 />
          <RegulatoryDomain val="GB " />
          <DeviceOperationMode val=InfrastructureAccessPoint />
          <WMMEnable val=1 />
          <X_TPLINK_ShortGIEnable val=1 />
          <WPS>
            <Enable val=1 />
            <ConfigurationState val="Not configured" />
          </WPS>
          <WEPKey instance=1 >
          </WEPKey>
          <WEPKey instance=2 >
          </WEPKey>
          <WEPKey instance=3 >
          </WEPKey>
          <WEPKey instance=4 >
          </WEPKey>
          <WEPKey nextInstance=5 />
          <X_TPLINK_WDSBridge>
            <BridgeName val=wds0 />
            <BridgeAuthMode val=Open />
            <BridgeEncryptMode val=None />
            <BridgeWepKeyIndex val=1 />
          </X_TPLINK_WDSBridge>
          <X_TPLINK_MultiSSID>
            <MultiSSIDEnable val=1 />
            <MultiSSIDEntry instance=1 >
              <Name val=wlan1 />
              <SSID val=TP-LINK_Guest_2.4GHz />
              <SSIDAdvertisementEnable val=1 />
              <BeaconType val=Basic />
              <WEPKeyIndex val=1 />
              <BasicEncryptionModes val=None />
              <BasicAuthenticationMode val=None />
              <WPAEncryptionModes val=TKIPandAESEncryption />
              <WPAAuthenticationMode val=PSKAuthentication />
              <IEEE11iEncryptionModes val=TKIPandAESEncryption />
              <IEEE11iAuthenticationMode val=PSKAuthentication />
              <RadiusServerPort val=1812 />
              <WEPKey instance=1 >
              </WEPKey>
              <WEPKey instance=2 >
              </WEPKey>
              <WEPKey instance=3 >
              </WEPKey>
              <WEPKey instance=4 >
              </WEPKey>
              <WEPKey nextInstance=5 />
            </MultiSSIDEntry>
            <MultiSSIDEntry nextInstance=2 />
          </X_TPLINK_MultiSSID>
          <X_TPLINK_WlBrName instance=1 >
            <IfName val=ath0 />
            <BridgeName val=br0 />
          </X_TPLINK_WlBrName>
          <X_TPLINK_WlBrName nextInstance=2 />
          <X_TPLINK_GuestNetwork>
            <Name val=wlan1 />
            <PreSSID val=TP-LINK_Guest_2.4GHz />
            <TCMaxUpBW val=200 />
            <TCMinUpBW val=100 />
            <TCMaxDownBW val=200 />
            <TCMinDownBW val=100 />
          </X_TPLINK_GuestNetwork>
        </WLANConfiguration>
        <WLANConfiguration instance=2 >
          <Enable val=1 />
          <Name val=wlan5 />
          <Channel val=36 />
          <AutoChannelEnable val=1 />
          <X_TPLINK_PreSSID val=TP-LINK_5GHz />
          <BeaconType val=11i />
          <X_TPLINK_MACAddressControlRule val=deny />
          <X_TPLINK_Band val=5GHz />
          <X_TPLINK_Bandwidth val=Auto />
          <Standard val=n />
          <WEPKeyIndex val=1 />
          <BasicEncryptionModes val=None />
          <BasicAuthenticationMode val=None />
          <WPAEncryptionModes val=TKIPandAESEncryption />
          <WPAAuthenticationMode val=PSKAuthentication />
          <IEEE11iEncryptionModes val=AESEncryption />
          <IEEE11iAuthenticationMode val=PSKAuthentication />
          <SSIDAdvertisementEnabled val=1 />
          <TransmitPower val=100 />
          <RegulatoryDomain val="GB " />
          <DeviceOperationMode val=InfrastructureAccessPoint />
          <WMMEnable val=1 />
          <X_TPLINK_ShortGIEnable val=1 />
          <WPS>
            <Enable val=1 />
            <ConfigurationState val="Not configured" />
          </WPS>
          <WEPKey instance=1 >
          </WEPKey>
          <WEPKey instance=2 >
          </WEPKey>
          <WEPKey instance=3 >
          </WEPKey>
          <WEPKey instance=4 >
          </WEPKey>
          <WEPKey nextInstance=5 />
          <X_TPLINK_WDSBridge>
            <BridgeName val=wds1 />
            <BridgeAuthMode val=Open />
            <BridgeEncryptMode val=None />
            <BridgeWepKeyIndex val=1 />
          </X_TPLINK_WDSBridge>
          <X_TPLINK_MultiSSID>
            <MultiSSIDEnable val=1 />
            <MultiSSIDEntry instance=1 >
              <Name val=wlan6 />
              <SSID val=TP-LINK_Guest_5GHz />
              <SSIDAdvertisementEnable val=1 />
              <BeaconType val=Basic />
              <WEPKeyIndex val=1 />
              <BasicEncryptionModes val=None />
              <BasicAuthenticationMode val=None />
              <WPAEncryptionModes val=TKIPandAESEncryption />
              <WPAAuthenticationMode val=PSKAuthentication />
              <IEEE11iEncryptionModes val=TKIPandAESEncryption />
              <IEEE11iAuthenticationMode val=PSKAuthentication />
              <RadiusServerPort val=1812 />
              <WEPKey instance=1 >
              </WEPKey>
              <WEPKey instance=2 >
              </WEPKey>
              <WEPKey instance=3 >
              </WEPKey>
              <WEPKey instance=4 >
              </WEPKey>
              <WEPKey nextInstance=5 />
            </MultiSSIDEntry>
            <MultiSSIDEntry nextInstance=2 />
          </X_TPLINK_MultiSSID>
          <X_TPLINK_GuestNetwork>
            <Name val=wlan6 />
            <PreSSID val=TP-LINK_Guest_5GHz />
            <TCMaxUpBW val=200 />
            <TCMinUpBW val=100 />
            <TCMaxDownBW val=200 />
            <TCMinDownBW val=100 />
          </X_TPLINK_GuestNetwork>
        </WLANConfiguration>
        <WLANConfiguration nextInstance=3 />
      </LANDevice>
      <LANDevice nextInstance=2 />
      <WANDevice instance=1 >
        <WANCommonInterfaceConfig>
          <EnabledForInternet val=1 />
          <WANAccessType val=DSL />
        </WANCommonInterfaceConfig>
        <WANDSLInterfaceConfig>
          <Enable val=1 />
        </WANDSLInterfaceConfig>
      </WANDevice>
      <WANDevice instance=2 >
        <WANCommonInterfaceConfig>
          <EnabledForInternet val=1 />
          <WANAccessType val=Ethernet />
        </WANCommonInterfaceConfig>
        <WANConnectionDevice instance=1 >
          <WANIPConnectionNumberOfEntries val=2 />
          <WANPPPConnectionNumberOfEntries val=1 />
          <WANIPConnection instance=1 >
            <ConnectionType val=IP_Routed />
            <Name val=ipoe_eth1_s />
            <NATEnabled val=1 />
            <ExternalIPAddress val=0.0.0.0 />
            <SubnetMask val=0.0.0.0 />
            <DefaultGateway val=0.0.0.0 />
          </WANIPConnection>
          <WANIPConnection instance=2 >
            <ConnectionType val=IP_Routed />
            <Name val=ipoe_eth1_d />
            <NATEnabled val=1 />
            <X_TPLINK_Hostname val=,TD-W9980 />
            <AddressingType val=DHCP />
            <ExternalIPAddress val=0.0.0.0 />
            <SubnetMask val=0.0.0.0 />
            <DefaultGateway val=0.0.0.0 />
            <DNSServers val=0.0.0.0,0.0.0.0 />
          </WANIPConnection>
          <WANIPConnection nextInstance=3 />
          <X_TPLINK_WANIPv6Connection instance=1 >
            <ConnectionType val=IP_Routed />
            <Name val=ipoe_eth1_d />
            <AddressingType val=DHCP />
            <DefaultGateway val=:: />
          </X_TPLINK_WANIPv6Connection>
          <X_TPLINK_WANIPv6Connection nextInstance=2 />
          <WANPPPConnection instance=1 >
          </WANPPPConnection>
          <WANPPPConnection nextInstance=2 />
        </WANConnectionDevice>
        <WANConnectionDevice nextInstance=2 />
      </WANDevice>
      <WANDevice instance=3 >
        <WANCommonInterfaceConfig>
          <EnabledForInternet val=1 />
          <WANAccessType val=USB_3G />
        </WANCommonInterfaceConfig>
        <WANConnectionDevice instance=1 >
          <WANPPPConnection instance=1 >
            <Username val=WAP@CINGULAR.COM />
            <Password val=CINGULAR1 />
            <DNSEnabled val=1 />
            <TransportType val=PPP3G />
          </WANPPPConnection>
          <WANPPPConnection nextInstance=2 />
        </WANConnectionDevice>
        <WANConnectionDevice nextInstance=2 />
      </WANDevice>
      <WANDevice nextInstance=4 />
      <X_TPLINK_Firewall>
        <InternalHost instance=1 >
          <RefCnt val=1 />
          <Type val=1 />
          <EntryName val=childMac1 />
          <IsParentCtrl val=1 />
        </InternalHost>
        <InternalHost instance=2 >
          <RefCnt val=1 />
          <Type val=1 />
          <EntryName val=childMac2 />
          <IsParentCtrl val=1 />
        </InternalHost>
        <InternalHost instance=3 >
          <RefCnt val=1 />
          <Type val=1 />
          <EntryName val=childMac3 />
          <IsParentCtrl val=1 />
        </InternalHost>
        <InternalHost instance=4 >
          <RefCnt val=1 />
          <Type val=1 />
          <EntryName val=childMac4 />
          <IsParentCtrl val=1 />
        </InternalHost>
        <InternalHost nextInstance=5 />
        <ExternalHost instance=1 >
          <RefCnt val=4 />
          <Type val=2 />
          <EntryName val=childUrl1 />
          <IsParentCtrl val=1 />
          <PortStart val=80 />
        </ExternalHost>
        <ExternalHost nextInstance=2 />
        <TaskSchedule instance=1 >
          <RefCnt val=4 />
          <IsParentCtrl val=1 />
          <EntryName val=childSchedule1 />
        </TaskSchedule>
        <TaskSchedule nextInstance=2 />
        <Rule instance=1 >
          <Enable val=1 />
          <RuleName val=parentCtrl1 />
          <IsParentCtrl val=1 />
          <Direction val=1 />
          <InternalHostRef val=childMac1 />
          <ExternalHostRef val=childUrl1 />
          <ScheduleRef val=childSchedule1 />
        </Rule>
        <Rule instance=2 >
          <Enable val=1 />
          <RuleName val=parentCtrl2 />
          <IsParentCtrl val=1 />
          <Direction val=1 />
          <InternalHostRef val=childMac2 />
          <ExternalHostRef val=childUrl1 />
          <ScheduleRef val=childSchedule1 />
        </Rule>
        <Rule instance=3 >
          <Enable val=1 />
          <RuleName val=parentCtrl3 />
          <IsParentCtrl val=1 />
          <Direction val=1 />
          <InternalHostRef val=childMac3 />
          <ExternalHostRef val=childUrl1 />
          <ScheduleRef val=childSchedule1 />
        </Rule>
        <Rule instance=4 >
          <Enable val=1 />
          <RuleName val=parentCtrl4 />
          <IsParentCtrl val=1 />
          <Direction val=1 />
          <InternalHostRef val=childMac4 />
          <ExternalHostRef val=childUrl1 />
          <ScheduleRef val=childSchedule1 />
        </Rule>
        <Rule nextInstance=5 />
        <UrlList>
          <UrlCfg instance=1 >
          </UrlCfg>
          <UrlCfg instance=2 >
          </UrlCfg>
          <UrlCfg instance=3 >
          </UrlCfg>
          <UrlCfg instance=4 >
          </UrlCfg>
          <UrlCfg instance=5 >
          </UrlCfg>
          <UrlCfg instance=6 >
          </UrlCfg>
          <UrlCfg instance=7 >
          </UrlCfg>
          <UrlCfg instance=8 >
          </UrlCfg>
          <UrlCfg instance=9 >
          </UrlCfg>
          <UrlCfg instance=10 >
          </UrlCfg>
          <UrlCfg instance=11 >
          </UrlCfg>
          <UrlCfg instance=12 >
          </UrlCfg>
          <UrlCfg instance=13 >
          </UrlCfg>
          <UrlCfg instance=14 >
          </UrlCfg>
          <UrlCfg instance=15 >
          </UrlCfg>
          <UrlCfg instance=16 >
          </UrlCfg>
          <UrlCfg instance=17 >
          </UrlCfg>
          <UrlCfg instance=18 >
          </UrlCfg>
          <UrlCfg instance=19 >
          </UrlCfg>
          <UrlCfg instance=20 >
          </UrlCfg>
          <UrlCfg instance=21 >
          </UrlCfg>
          <UrlCfg instance=22 >
          </UrlCfg>
          <UrlCfg instance=23 >
          </UrlCfg>
          <UrlCfg instance=24 >
          </UrlCfg>
          <UrlCfg instance=25 >
          </UrlCfg>
          <UrlCfg instance=26 >
          </UrlCfg>
          <UrlCfg instance=27 >
          </UrlCfg>
          <UrlCfg instance=28 >
          </UrlCfg>
          <UrlCfg instance=29 >
          </UrlCfg>
          <UrlCfg instance=30 >
          </UrlCfg>
          <UrlCfg instance=31 >
          </UrlCfg>
          <UrlCfg instance=32 >
          </UrlCfg>
          <UrlCfg instance=33 >
          </UrlCfg>
          <UrlCfg instance=34 >
          </UrlCfg>
          <UrlCfg instance=35 >
          </UrlCfg>
          <UrlCfg instance=36 >
          </UrlCfg>
          <UrlCfg instance=37 >
          </UrlCfg>
          <UrlCfg instance=38 >
          </UrlCfg>
          <UrlCfg instance=39 >
          </UrlCfg>
          <UrlCfg instance=40 >
          </UrlCfg>
          <UrlCfg instance=41 >
          </UrlCfg>
          <UrlCfg instance=42 >
          </UrlCfg>
          <UrlCfg instance=43 >
          </UrlCfg>
          <UrlCfg instance=44 >
          </UrlCfg>
          <UrlCfg instance=45 >
          </UrlCfg>
          <UrlCfg instance=46 >
          </UrlCfg>
          <UrlCfg instance=47 >
          </UrlCfg>
          <UrlCfg instance=48 >
          </UrlCfg>
          <UrlCfg instance=49 >
          </UrlCfg>
          <UrlCfg instance=50 >
          </UrlCfg>
          <UrlCfg instance=51 >
          </UrlCfg>
          <UrlCfg instance=52 >
          </UrlCfg>
          <UrlCfg instance=53 >
          </UrlCfg>
          <UrlCfg instance=54 >
          </UrlCfg>
          <UrlCfg instance=55 >
          </UrlCfg>
          <UrlCfg instance=56 >
          </UrlCfg>
          <UrlCfg instance=57 >
          </UrlCfg>
          <UrlCfg instance=58 >
          </UrlCfg>
          <UrlCfg instance=59 >
          </UrlCfg>
          <UrlCfg instance=60 >
          </UrlCfg>
          <UrlCfg instance=61 >
          </UrlCfg>
          <UrlCfg instance=62 >
          </UrlCfg>
          <UrlCfg instance=63 >
          </UrlCfg>
          <UrlCfg instance=64 >
          </UrlCfg>
          <UrlCfg instance=65 >
          </UrlCfg>
          <UrlCfg instance=66 >
          </UrlCfg>
          <UrlCfg instance=67 >
          </UrlCfg>
          <UrlCfg instance=68 >
          </UrlCfg>
          <UrlCfg instance=69 >
          </UrlCfg>
          <UrlCfg instance=70 >
          </UrlCfg>
          <UrlCfg instance=71 >
          </UrlCfg>
          <UrlCfg instance=72 >
          </UrlCfg>
          <UrlCfg instance=73 >
          </UrlCfg>
          <UrlCfg instance=74 >
          </UrlCfg>
          <UrlCfg instance=75 >
          </UrlCfg>
          <UrlCfg instance=76 >
          </UrlCfg>
          <UrlCfg instance=77 >
          </UrlCfg>
          <UrlCfg instance=78 >
          </UrlCfg>
          <UrlCfg instance=79 >
          </UrlCfg>
          <UrlCfg instance=80 >
          </UrlCfg>
          <UrlCfg instance=81 >
          </UrlCfg>
          <UrlCfg instance=82 >
          </UrlCfg>
          <UrlCfg instance=83 >
          </UrlCfg>
          <UrlCfg instance=84 >
          </UrlCfg>
          <UrlCfg instance=85 >
          </UrlCfg>
          <UrlCfg instance=86 >
          </UrlCfg>
          <UrlCfg instance=87 >
          </UrlCfg>
          <UrlCfg instance=88 >
          </UrlCfg>
          <UrlCfg instance=89 >
          </UrlCfg>
          <UrlCfg instance=90 >
          </UrlCfg>
          <UrlCfg instance=91 >
          </UrlCfg>
          <UrlCfg instance=92 >
          </UrlCfg>
          <UrlCfg instance=93 >
          </UrlCfg>
          <UrlCfg instance=94 >
          </UrlCfg>
          <UrlCfg instance=95 >
          </UrlCfg>
          <UrlCfg instance=96 >
          </UrlCfg>
          <UrlCfg instance=97 >
          </UrlCfg>
          <UrlCfg instance=98 >
          </UrlCfg>
          <UrlCfg instance=99 >
          </UrlCfg>
          <UrlCfg instance=100 >
          </UrlCfg>
          <UrlCfg instance=101 >
          </UrlCfg>
          <UrlCfg instance=102 >
          </UrlCfg>
          <UrlCfg instance=103 >
          </UrlCfg>
          <UrlCfg instance=104 >
          </UrlCfg>
          <UrlCfg instance=105 >
          </UrlCfg>
          <UrlCfg instance=106 >
          </UrlCfg>
          <UrlCfg instance=107 >
          </UrlCfg>
          <UrlCfg instance=108 >
          </UrlCfg>
          <UrlCfg instance=109 >
          </UrlCfg>
          <UrlCfg instance=110 >
          </UrlCfg>
          <UrlCfg instance=111 >
          </UrlCfg>
          <UrlCfg instance=112 >
          </UrlCfg>
          <UrlCfg instance=113 >
          </UrlCfg>
          <UrlCfg instance=114 >
          </UrlCfg>
          <UrlCfg instance=115 >
          </UrlCfg>
          <UrlCfg instance=116 >
          </UrlCfg>
          <UrlCfg instance=117 >
          </UrlCfg>
          <UrlCfg instance=118 >
          </UrlCfg>
          <UrlCfg instance=119 >
          </UrlCfg>
          <UrlCfg instance=120 >
          </UrlCfg>
          <UrlCfg instance=121 >
          </UrlCfg>
          <UrlCfg instance=122 >
          </UrlCfg>
          <UrlCfg instance=123 >
          </UrlCfg>
          <UrlCfg instance=124 >
          </UrlCfg>
          <UrlCfg instance=125 >
          </UrlCfg>
          <UrlCfg instance=126 >
          </UrlCfg>
          <UrlCfg instance=127 >
          </UrlCfg>
          <UrlCfg instance=128 >
          </UrlCfg>
          <UrlCfg instance=129 >
          </UrlCfg>
          <UrlCfg instance=130 >
          </UrlCfg>
          <UrlCfg instance=131 >
          </UrlCfg>
          <UrlCfg instance=132 >
          </UrlCfg>
          <UrlCfg instance=133 >
          </UrlCfg>
          <UrlCfg instance=134 >
          </UrlCfg>
          <UrlCfg instance=135 >
          </UrlCfg>
          <UrlCfg instance=136 >
          </UrlCfg>
          <UrlCfg instance=137 >
          </UrlCfg>
          <UrlCfg instance=138 >
          </UrlCfg>
          <UrlCfg instance=139 >
          </UrlCfg>
          <UrlCfg instance=140 >
          </UrlCfg>
          <UrlCfg instance=141 >
          </UrlCfg>
          <UrlCfg instance=142 >
          </UrlCfg>
          <UrlCfg instance=143 >
          </UrlCfg>
          <UrlCfg instance=144 >
          </UrlCfg>
          <UrlCfg instance=145 >
          </UrlCfg>
          <UrlCfg instance=146 >
          </UrlCfg>
          <UrlCfg instance=147 >
          </UrlCfg>
          <UrlCfg instance=148 >
          </UrlCfg>
          <UrlCfg instance=149 >
          </UrlCfg>
          <UrlCfg instance=150 >
          </UrlCfg>
          <UrlCfg instance=151 >
          </UrlCfg>
          <UrlCfg instance=152 >
          </UrlCfg>
          <UrlCfg instance=153 >
          </UrlCfg>
          <UrlCfg instance=154 >
          </UrlCfg>
          <UrlCfg instance=155 >
          </UrlCfg>
          <UrlCfg instance=156 >
          </UrlCfg>
          <UrlCfg instance=157 >
          </UrlCfg>
          <UrlCfg instance=158 >
          </UrlCfg>
          <UrlCfg instance=159 >
          </UrlCfg>
          <UrlCfg instance=160 >
          </UrlCfg>
          <UrlCfg instance=161 >
          </UrlCfg>
          <UrlCfg instance=162 >
          </UrlCfg>
          <UrlCfg instance=163 >
          </UrlCfg>
          <UrlCfg instance=164 >
          </UrlCfg>
          <UrlCfg instance=165 >
          </UrlCfg>
          <UrlCfg instance=166 >
          </UrlCfg>
          <UrlCfg instance=167 >
          </UrlCfg>
          <UrlCfg instance=168 >
          </UrlCfg>
          <UrlCfg instance=169 >
          </UrlCfg>
          <UrlCfg instance=170 >
          </UrlCfg>
          <UrlCfg instance=171 >
          </UrlCfg>
          <UrlCfg instance=172 >
          </UrlCfg>
          <UrlCfg instance=173 >
          </UrlCfg>
          <UrlCfg instance=174 >
          </UrlCfg>
          <UrlCfg instance=175 >
          </UrlCfg>
          <UrlCfg instance=176 >
          </UrlCfg>
          <UrlCfg instance=177 >
          </UrlCfg>
          <UrlCfg instance=178 >
          </UrlCfg>
          <UrlCfg instance=179 >
          </UrlCfg>
          <UrlCfg instance=180 >
          </UrlCfg>
          <UrlCfg instance=181 >
          </UrlCfg>
          <UrlCfg instance=182 >
          </UrlCfg>
          <UrlCfg instance=183 >
          </UrlCfg>
          <UrlCfg instance=184 >
          </UrlCfg>
          <UrlCfg instance=185 >
          </UrlCfg>
          <UrlCfg instance=186 >
          </UrlCfg>
          <UrlCfg instance=187 >
          </UrlCfg>
          <UrlCfg instance=188 >
          </UrlCfg>
          <UrlCfg instance=189 >
          </UrlCfg>
          <UrlCfg instance=190 >
          </UrlCfg>
          <UrlCfg instance=191 >
          </UrlCfg>
          <UrlCfg instance=192 >
          </UrlCfg>
          <UrlCfg instance=193 >
          </UrlCfg>
          <UrlCfg instance=194 >
          </UrlCfg>
          <UrlCfg instance=195 >
          </UrlCfg>
          <UrlCfg instance=196 >
          </UrlCfg>
          <UrlCfg instance=197 >
          </UrlCfg>
          <UrlCfg instance=198 >
          </UrlCfg>
          <UrlCfg instance=199 >
          </UrlCfg>
          <UrlCfg instance=200 >
          </UrlCfg>
          <UrlCfg nextInstance=201 />
        </UrlList>
      </X_TPLINK_Firewall>
      <X_TPLINK_IPv6Tunnel>
        <AssociatedLanIfName val=br0 />
        <DSLite>
          <Enabled val=1 />
        </DSLite>
      </X_TPLINK_IPv6Tunnel>
      <Services>
        <StorageService>
          <UserAccount instance=1 >
            <Enable val=1 />
            <Username val=admin />
            <Password val=admin />
            <X_TPLINK_SupperUser val=1 />
          </UserAccount>
          <UserAccount instance=2 >
          </UserAccount>
          <UserAccount instance=3 >
          </UserAccount>
          <UserAccount instance=4 >
          </UserAccount>
          <UserAccount instance=5 >
          </UserAccount>
          <UserAccount nextInstance=6 />
          <X_TPLINK_SMBService>
            <Anonymous val=1 />
            <SMB_FOLDER instance=1 >
              <Alias val=volume />
              <Name val=/ />
              <Enable val=1 />
            </SMB_FOLDER>
            <SMB_FOLDER nextInstance=2 />
          </X_TPLINK_SMBService>
          <FTPServer>
            <FTP_FOLDER instance=1 >
              <Alias val=volume />
              <Name val=/ />
              <Enable val=1 />
            </FTP_FOLDER>
            <FTP_FOLDER nextInstance=2 />
          </FTPServer>
        </StorageService>
        <X_TPLINK_PrintService>
          <Enable val=0 />
        </X_TPLINK_PrintService>
      </Services>
    </InternetGatewayDevice>
  </DslCpeConfig>
   

  (Save as file, needed by StatPOSTer-20160306.jar to create the .bin config-file)

• OpenWrt TD-W8970 firmware for CC 15.05.1 (because there is nothing better matching available)
• OpenWrt TD-W8980 firmware, 18.06.5 (Newer version, also works fine)
• A Unix-like OS, capable of the dd command (the bash of Windows 10 Linux subsystem is fine also)
• An USB stick

• Get the USB stick formatted as msDOS/vFAT
• Copy the firmware (openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image) to the USB stick.
• Create a 1310720 bytes block-size slice of the firmware file using dd (this one needs to be on the USB stick as well).
  This command creates the file openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade-1.image:

  dd if=openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image of=openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade-1.image bs=1310720 skip=1

1. Make sure your router is connected to your machine, and is reachable through 192.168.1.1 (default)
2. Launch the StatPOSTer-20160306.jar tool:

   java -jar StatPOSTer-20160306.jar

   1. Make sure to use OpenJDK 8 to prevent a crash.
   2. At the bottom select TD-W9980 from the dropdown menu.
   3. Fill the Password field (“admin” if you haven't changed it) and make sure the fields IP address and User name are properly filled.
3. Click the Encrypt button, the interface will prompt for a .xml file (9980-config-public-plus-shell.xml) and then to store a .bin file (9980-config-public-plus-shell.bin)
4. Log into the router via the web-interface http://192.168.1.1 and login as admin/admin
   1. Navigate to System Tools → Backup & Restore, press browse, select 9980-config-public-plus-shell.bin and press the Restore button.
      The router will reboot afterwards.
5. Once the router comes back, the login page should show something like 'telnetd -l login 1023' on top, this is expected.
6. Telnet into the router via port 1023. Be patient, it may take some time to get a prompt.

   telnet 192.168.1.1 1023

7. Use admin/1234 to login (e.g. NOT admin/admin), you'll be dropped in a root shell afterwards.

From here, I followed the flash instructions for TD-W8970 by s7mx1 in the forum.

1. Insert the USB stick in the router (any port will do)
2. Backup the /dev/mtd0 → /dev/mtd6 to the USB stick:

   cat /dev/mtd0 > /var/usbdisk/sda1/mtd0
   cat /dev/mtd1 > /var/usbdisk/sda1/mtd1
   cat /dev/mtd2 > /var/usbdisk/sda1/mtd2
   cat /dev/mtd3 > /var/usbdisk/sda1/mtd3
   cat /dev/mtd4 > /var/usbdisk/sda1/mtd4
   cat /dev/mtd5 > /var/usbdisk/sda1/mtd5
   cat /dev/mtd6 > /var/usbdisk/sda1/mtd6

3. Verify that the size of mtd1 (kernel partition) on the USB stick is 1310720 bytes.

   ls -la /var/usbdisk/sda1/mtd1

1. If you haven't aleady, insert the USB stick in the router (any port will do)
2. Copy the two .image files from the USB stick to the router. Note that the first cat command terminates with “no such space left on device”.
   This is expected behaviour. The remainder is in the slice which is written.

   cat /var/usbdisk/sda1/openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade.image > /dev/mtdblock1
   cat /var/usbdisk/sda1/openwrt-15.05.1-lantiq-xrx200-TDW8970-sysupgrade-1.image > /dev/mtdblock2

3. Reboot the router by power-cycling (do not issue the reboot command so that the running firmware doesn't overwrite your changes); it will come up as OpenWrt.

1. scp the .bin file over to the router.

   scp /path/to/openwrt-<version>-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin root@192.168.1.1:/tmp

2. Log in through ssh:

   ssh root@192.168.1.1

3. Follow the upgrade instructions at Upgrading OpenWrt firmware via CLI
4. Note that the process may appear to hang for a long time when upgrading (several minutes), but it does work.

Please note that the web updater also works just fine on this model (updated from 18.06 to 19.07.04 using it)

The TD-W9980, is advertised to support at most ITU G.993.2. This excludes VDSL vectoring support. The DSL drivers in trunk actually are the drivers from TP-Link, and do not include vectoring support either. However, I've got this router to run with full vectoring support using a 5.7.6 (77f69e99cd0e0d4d58454880a21438543f1571dc) firmware from http://xdarklight.github.io/lantiq-xdsl-firmware-info/ on my line (NL/XS4ALL):

ATU-C Vendor ID:                          Broadcom 176.199
ATU-C System Vendor ID:                   Broadcom
Chipset:                                  Lantiq-VRX200 Unknown
Firmware Version:                         5.7.6.10.0.7
API Version:                              4.16.6.3
XTSE Capabilities:                        0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2
Annex:                                    B
Line Mode:                                G.993.5 (VDSL2 with down- and upstream vectoring)
Profile:                                  17a
Line State:                               UP [0x801: showtime_tc_sync]
Forward Error Correction Seconds (FECS):  Near: 0 / Far: 31928
Errored seconds (ES):                     Near: 0 / Far: 11
Severely Errored Seconds (SES):           Near: 0 / Far: 0
Loss of Signal Seconds (LOSS):            Near: 0 / Far: 0
Unavailable Seconds (UAS):                Near: 116 / Far: 116
Header Error Code Errors (HEC):           Near: 0 / Far: 0
Non Pre-emtive CRC errors (CRC_P):        Near: 0 / Far: 0
Pre-emtive CRC errors (CRCP_P):           Near: 0 / Far: 0
Power Management Mode:                    L0 - Synchronized
Latency / Interleave Delay:               Down: Fast (0.15 ms) / Up: Interleave (8.0 ms)
Data Rate:                                Down: 77.848 Mb/s / Up: 32.253 Mb/s
Line Attenuation (LATN):                  Down: 9.2dB / Up: 7.7dB
Signal Attenuation (SATN):                Down: 9.2dB / Up: 7.6dB
Noise Margin (SNR):                       Down: 4.1dB / Up: 5.0dB
Aggregate Transmit Power (ACTATP):        Down: -5.1dB / Up: 13.7dB
Max. Attainable Data Rate (ATTNDR):       Down: 85.842 Mb/s / Up: 35.400 Mb/s
Line Uptime Seconds:                      613
Line Uptime:                              10m 13s

Download a proprietary firmware blob from http://xdarklight.github.io/lantiq-xdsl-firmware-info/. The firmware version 5.7.6 with the sha1sum 77f69e99cd0e0d4d58454880a21438543f1571dc works well for German DSL lines, for example. If you'll need something different than Annex B for your provider, then just select an appropriate firmware. Make sure to follow the instructions on the download page to extract the firmware blob from the downloaded file. For 77f69e99cd0e0d4d58454880a21438543f1571dc, that means to use a recent 7zip version (15.09 or newer) and run it as follows:

7z e DM200_V1.0.0.34.zip
7z e DM200-V1.0.0.34.img dsl_vr9_firmware_xdsl-05.07.06.0A.00.07_05.07.01.0C.00.02.bin

Copy the resulting dsl_vr9_firmware_xdsl-05.07.06.0A.00.07_05.07.01.0C.00.02.bin file onto the router device (using scp on Linux or WinSCP on windows). The full path of the .bin file has to be put into the firmware field of the DSL configuration in OpenWrt.

One awesome thing to mention (at least with trunk) is that the reset button resets the configuration, which is very nice. I couldn't find any notion of this, but because of the DSL port, the failsafe mode of OpenWrt (nicely triggered with the WPS button on the back) doesn't make the device accessible. Probably because of something like this https://lists.openwrt.org/pipermail/openwrt-devel/2015-February/031071.html. Anyway, when I made some network changes which were totally wrong, holding the reset button saved the day, restoring the device back into standard OpenWrt configuration, allowing me to access it again.

Successfully tested on TD-W9980 Ver 1.0, adapted from TD-W8970 page.

The router's EEPROM size is 8MiB (8 388 608 bytes). Firsts 128KiB (131 072 bytes) are for bootloader, and the lasts 256KiB (262 144 bytes) aren't contained in any firmware download. If you loose it, only a previous firmware backup of this EEPROM part can be used to restore it. Between them, you should reflash the “midle” space (from 0x20000 to 0x7c0000, so it's 0x7a0000 sized, 7 995 392 bytes), it's the rootfs.

Obtain the firmware from TP-Link website. You need to care about model version v1. If the name of your TP-Link original firmware contains “boot”, it means that it's likely to contains bootloader, 512 blank bytes, and the rootfs (you should see that the file is 512 bytes too big to be just bootloader + rootfs). Looking at it with an hexadecimal editor, with 512 bytes pages, you will see that if bootloader is taking the 256 first pages (0 to 255), but then the firmware doesn't start at the following page (256) but in page 257.

Here's the Linux command to cut the firsts 257 * 512 bytes :

dd if=orig.bin of=tplink.bin skip=257 bs=512

Then the “tplink.bin” file should be exactly 7 995 392 bytes. It can be used to reflash the space from 0x20000, for 7a0000 bytes. I suppose that the space from 0 to 0x20000 can also re-programmed using the first 131 072 bytes of the TP-Link firmware files but I didn't tested it.

1. Read this completely before to actually do it
2. Prepare your Image, as explained before if the the file contains boot you need to strip the header off with “dd if=orig.bin of=tplink.bin skip=257 bs=512” like I did for “TD-W9980v1_0.6.0_1.13_up_boot(160125)_2016-01-25_15.45.32.bin”
3. Host the file on a computer using 192.168.1.2 as IP address, with “tftpd-hta” server for example (on Debian, default home directory of this tftp server is /srv/tftp/), connected to the router
4. Switch on the device with UART Boot (see previous section about that, using u-boot.asc and then “t” key to interrupt booting)
5. Enter the following commands :
   1. Set the device's IP if you don't want the default 192.168.1.1: (so you don't have to move your TFTP server onto a different subnet)

      setenv ipaddr 192.168.1.1

   2. Set the address of your TFTP server:

      setenv serverip 192.168.1.2

   3. Set the board type (not sure if this is necessary, work on W9980 anyway, copied from W8970 procedure):

      setenv bootargs 'board=WD8970'

   4. Download the image into RAM (*not* flash):

      tftpboot 0x80800000 tplink.bin

   5. Erase the rootfs flash area:

      sf erase 0x20000 0x7a0000

   6. Write image to flash:

      sf write 0x80800000 0x20000 0x7a0000

   7. Reboot:

      reset

The rootfs area is from 0x20000 to 0x7c0000 (0x7a0000 sized), erase command is from 0x20000, during 0x7a0000, and write is also from 0x20000, during 0x7a0000. You can double check the image size in after the tftpboot command. Be careful when erasing/writing the flash the radio is required for WLAN and should not be overwritten or erased. A backup is nice to have if something went wrong, it stores also the MAC address for your WLAN (ART Partition).

This is the result of cat /proc/mtd

How to add tags