How to use TFTP to restore the firmware of a broken Yealink T21P phone

Under certain circumstances a Yealink T21P phone might not have the latest firmware or might have crashed:

1. You’ve bricked the the phone due to a firmware upgrade that happened in the middle of an electrical fault.
2. Some phones simply don’t want to accept the new firmware even after trying many times.

How you’ll know there’s problems, your phone will be stuck on:

Welcome

Initializing... please wait

Fortunately most phones devices have a recovery mode. On a T21P this recovery mode is accessed by holding in the speakerphone button, bottom right, for  TEN seconds. You also have very specific firmware that’s need, named:

• T2XD.bin
• T2CD.rfs
• T21D.rom

You’ll also need a Linux computer to fix the problem with TFTP or you may want to try PumpKIN for Windows.

This software required to close the loop is called TFTP. Trivial File Transfer Protocol. This is a very basic version of server software and the way to go is to simply load the correct .ROM file into a specific directory. This is a lot trickery than I make it sounds.

When we tried this the first time, a user on Linux Mint’s forum suggested using atftpd . Unfortunately we couldn’t get it working with this software and instead opted for tftpd-hpa

After having finally getting a working TFTP server, the files still didn’t download. It turns out on tftpd-hpa you need a special flag to get booting working.

On the Linux Computer

Here are the steps required, on the Linux computer:

apt install tftpd-ha

The service will be running by default. Let’s stick with the default configuration file:

cat /etc/default/tftpd-hpa
# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/srv/tftp"
TFTP_ADDRESS=":69"
#TFTP_OPTIONS="--secure"
# Line below needed!
TFTP_OPTIONS="-s"

On the above information the /srv/tftp directory is important to note because you’ll be copying a .rom file there.

On the Internet

Download the latest firmware from Yealink support site. The URL for the support site is

https://support.yealink.com/en/portal/home

On there you can search and then you’ll find for a search on t21p this link:

https://support.yealink.com/en/portal/docList?archiveType=document&productCode=9ad4ca656dd04821

Click the Firmware tab. We downloaded and extracted T21P-34.72.193.20.zip which through their convoluted system of what’s the newest took a big of digging.

After going through this entire mission, we eventually troubleshooted using tcpdump. Yep, extreme measures to get something to work.

This is the joy of TCP dump:

tcpdump -i enp0s25 -nl port 69 and udp

13:32:51.434339 IP 192.168.0.100.1147 > 192.168.0.23.69: TFTP, length 40, RRQ "T2XD.bin" octet timeout 5 blksize 1468
13:32:52.825447 IP 192.168.0.100.2538 > 192.168.0.23.69: TFTP, length 40, RRQ "T2XD.rfs" octet timeout 5 blksize 1468
13:33:04.764231 IP 192.168.0.100.53361 > 192.168.0.23.69: TFTP, length 17, RRQ "T21D.rom" octet

On the first second, it wants to load T2XD.bin and continue.
On the second second, it wants to load T2XD.rfs and continue.
On the 8th second, it wants to load T21D.rom and continue.

Light on, T21D.rom is actually your ROM file, but renamed. Ah, the joys of tcpdump troubleshooting.

The rest of the files can be found here:

http://yealink.provu.co.uk/fw/recovery/T2X/?C=M;O=A

Progress can be observed on the phone’s console.

On the phone

When you hold the speakerphone button for 10 seconds, eventually you’ll be presented with the following defaults about the network:

IP Address: 192.168.0.100
Subnet Address: 255.255.0.0
Default Gateway: 192.168.0.1
TFTP Server Address: 192.168.0.23

Next you’ll be staring at a screen that says “Start Updating…” for around 15 minutes. Something is wrong, progress are measured in minutes not quarters. Start to troubleshoot.

Screenshots

Here is a hypothetical screenshot of how you would configure the network on a Windows PC, once again confirming that your actual TFTP server needs to be 192.168.0.23.

Issues

If you see “Network failed” on the phone the whole time, it’s not communicating with your TFTP server. Check settings and if the files was put in the correct directory. Remember that -s flag? This wasted around 45 minutes.

Please ensure the phone’s cable is plugged into the “INTERNET” and not “PHONE” socket.

Use TCP Dump.

Where is `tftpd-hpa` log file? There is none we could find, so we used tcpdump.

http://yealink.provu.co.uk/fw/recovery/T2X/?C=M;O=A

You’ll need

	T2XD.bin	2021-08-11 16:18	1.4M
	T2XD.rfs	2021-08-11 16:18	8.0M

Good luck.