TP-LINK TD-W9970 v1

multiple revisions of this device, use caution

bgn (N300)
300Mbps Wireless N USB VDSL/ADSL Modem Router
Homepage	Product page (AU)
Support	Support page
Wikipedia	TP-Link
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Status Unknown
Platform
Brand • Model • Rev	TP-LINK TD-W9970 v1
FCC ID	TE7TDW9970V1
Board ID	14121929970-1.0
Type	wireless router, dsl modem
CPU1	Broadcom BCM63381U
CPU1 Type	MIPS BMIPS4350
CPU1 Speed	600 MHz ( 2 cores )
Flash1 Chip	Winbond W25Q64FVSIG
Flash1 Size	8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size	64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
RAM1 Chip	EtronTech EM6AB160TSC-5G
ETH chip1	Broadcom BCM63381U
Switch	Broadcom BCM63381U
Ethernet Port Count	1-WAN 4-100MbE-LAN
Wired Standard	IEEE 802.3i/3u
802dot11 OUI: E0:05:C5 (1 E, 1 W) Ethernet OUI: E0:05:C5 (1 E, 1 W)
Stock bootloader	CFE
Stock FW OS	Linux
Expansion IF types	USB 2.0
USB ports	1
USB Hub Compatible	Untested
Power	12 VDC, 1 A
Connector type	barrel
Serial Port (UART)	yes, internal, 4-pin header, 3.3V TTL, J1
Flags: ADSL2+, VDSL
Other
Default IP address: 192.168.1.1 the IP 192.168.1.1 is used by 1326 additional devices of which 111 are TP-LINK devices Default login user: admin Default login password: admin admin:admin credentials used by 1343 additional devices of which 280 are TP-LINK devices
Manuf/OEM/ODM	Proware
Retail
FCC approval date	15 July 2015
EAN	6935364092535 (UPC DB, On eBay) 6935364092542 (UPC DB, On eBay)
ASIN	B013OXVA6M
Country of manuf	China
Radio 1
Chip1	Broadcom BCM43217T
Wireless interface OUI	E0:05:C5
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
CPU1 brand Radio1 chip1 brand Radio1 chip2 brand TP-LINK TD-W9970 v1 Broadcom Broadcom TP-LINK TD-W9970 v2 Broadcom Broadcom

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented TP-LINK device with specifications, see TP-LINK.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

"14121929970-1.0" and "Rev:1.0sp4" is silkscreened on the board.

Antenna: 2x 5dBi @2.4GHz

USB port: 1x USB 2.0

Links of Interest

Forum threads

• On HWupgrade (IT)

Tools

• Utility to convert TP-Link TD-W9970 modem router backup config files from binary to XML and back.

JTAG-Serial Info

Serial

Serial Pinouts

Pin	Value (J1)
1 (key)	Tx (Data Transmit)
2	Rx (Data Receive)
3	GND (Ground)
4	Vcc (+3.3V)

Bootloader and OS are at 115200,8N1

Boot log

boot log v2

HELO CPUI L1CI HELO CPUI L1CI 4.1603-1.0.38-116.174 PMCI PMCM DRAM ---- PHYS PHYE DDR1 300H SIZ4 SIZ3 LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN Base: 4.16_03 CFE version 1.0.38-116.174 for BCM963381 (32bit,SP,BE) Build Date: Tue Sep 19 15:46:52 CST 2017 (swd@localhost.localdomain) Copyright (C) 2000-2013 Broadcom Corporation. Boot Strap Register: 0x1ffff7f Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 300MHz, Bus: 300MHz Main Thread: TP0 Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 HS Serial flash device: GD25Q64, id 0xc817 sector 64KB size 8192KB Flash not used for Auxillary File System pmc_init:PMC using DQM mode Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Default host ramdisk file name : Default ramdisk store address : Board Id (0-8) : 963381SV Number of MAC Addresses (1-32) : 10 Base MAC Address : e0:05:c5:63:38:10 PSI Size (1-64) KBytes : 64 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 WLan Feature : 0x00 *** Press 't' to stop auto run (0.1 seconds) *** Code Address: 0x80010000, Entry Address: 0x803277f0 Decompression OK! Entry at 0x803277f0 Starting program at 0x803277f0 Linux version 3.4.11-rt19 (swd@localhost.localdomain) (gcc version 4.6.2 (Buildroot 2011.11) ) #60 SMP PREEMPT Tue Sep 19 15:56:54 CST 2017 HS Serial flash device: GD25Q64, id 0xc817 sector 64KB size 8192KB 963381SV prom init CPU revision is: 0002a081 (Broadcom BMIPS4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 03ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003ece Movable zone start PFN for each node Early memory PFN ranges 0: 0x00000000 -> 0x00003ece On node 0 totalpages: 16078 free_area_init_node: node 0, pgdat 80408e30, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11888 pages, LIFO batch:1 PERCPU: Embedded 7 pages/cpu @81083000 s5200 r8192 d15280 u32768 pcpu-alloc: s5200 r8192 d15280 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 15952 Kernel command line: ro noinitrd irqaffinity=0 PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Memory: 58640k/64312k available (3215k kernel code, 5672k reserved, 854k data, 208k init, 0k highmem) Preemptible hierarchical RCU implementation. NR_IRQS:128 console [ttyS0] enabled Calibrating delay loop... 598.01 BogoMIPS (lpj=299008) pid_max: default: 4096 minimum: 301 Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 CPU revision is: 0002a081 (Broadcom BMIPS4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Brought up 2 CPUs NET: Registered protocol family 16 pmc_init:PMC using DQM mode Flash not used for Auxillary File System registering PCI controller with io_map_base unset bcm63xx_pcie: setting resistor calibration value to 0x0 bcm63xx_pcie: applying serdes parameters registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff] pci_bus 0000:00: root bus resource [io 0x11700000-0x1170ffff] pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310 pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff] pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320 pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff] PCI host bridge to bus 0000:01 pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0] pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:02:00.0: [14e4:a8db] type 00 class 0x028000 pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit] pci 0000:02:00.0: supports D1 D2 pci 0000:01:00.0: BAR 8: assigned [mem 0xa0000000-0xa00fffff] pci 0000:02:00.0: BAR 0: assigned [mem 0xa0000000-0xa0007fff 64bit] pci 0000:01:00.0: PCI bridge to [bus 02-02] pci 0000:01:00.0: bridge window [mem 0xa0000000-0xa00fffff] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Sep 19 2017 15:54:43 initialized Broadcom GBPM v0.1 Sep 19 2017 15:54:43 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 2, 16384 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP: reno registered NET: Registered protocol family 1 PCI: CLS 16 bytes, default 16 init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0) squashfs: version 4.0 (2009/01/31) Phillip Lougher fuse init (API version 7.18) msgmni has been set to 114 io scheduler noop registered (default) bcm963xx_mtd driver Registered device mtd:rootfs dev0 Address=0xb817c670 Size=6549504 PPP generic driver version 2.4.2 NET: Registered protocol family 24 brcmboard: brcm_board_init entry WIFI: Button Interrupt 0x1 is enabled RESET: Button Interrupt 0x0 is enabled SES: Button Interrupt 0x0 is enabled SES: LED GPIO 0x8017 is enabled Register flash device: flash0 Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX Total # RxBds=1979 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized pppox_fastpath_init! Mirror/redirect action on u32 classifier Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (916 buckets, 5120 max) gre: GRE over IPv4 demultiplexor driver ip_tables: (C) 2000-2006 Netfilter Core Team TCP: cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered ebt_ftos registered ebt_wmm_mark registered 8021q: 802.1Q VLAN Support v1.8 SQUASHFS error: Xattrs in filesystem, these will be ignored SQUASHFS error: unable to read xattr id index table VFS: Mounted root (squashfs filesystem) readonly on device 31:0. Freeing unused kernel memory: 208k freed starting pid 202, tty '': '/etc/init.d/rcS' L2TP core: blog_l2tp_rcv_check L2TP core driver, V2.0 PPPoL2TP kernel driver, V2.0 pppol2tp_fastpath_init! bcmxtmrtdrv: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint bcmxtmrt: Broadcom BCM3381B0 ATM/PTM Network Device v0.6 Sep 19 2017 16:00:40 Broadcom Ingress QoS Module Char Driver v0.1 Sep 19 2017 15:58:37 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=67108864B (64MB), buf_mem_size <10%> =6710880B (6MB), num of buffers=3328, buf size=2016 Broadcom BPM Module Char Driver v0.1 Sep 19 2017 15:58:36 Registered<244> NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Sep 19 2017 15:58:37 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. flwStatsThread created Constructed Broadcom Packet Flow Cache v2.2 Sep 19 2017 15:58:37 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63381B0 Ethernet Network Device v0.1 Sep 19 2017 16:00:33 ETH Init: Ch:0 - 200 tx BDs at 0xa3b14000 ETH Init: Ch:0 - 1331 rx BDs at 0xa39d8000 eth0.2: <Int sw port: 0> <Logical : 00> PHY_ID <0x00000001 : 0x01> MAC : 50:C7:BF:DB:3E:86 eth0.3: <Int sw port: 1> <Logical : 01> PHY_ID <0x00000002 : 0x02> MAC : 50:C7:BF:DB:3E:86 eth0.4: <Int sw port: 2> <Logical : 02> PHY_ID <0x00000003 : 0x03> MAC : 50:C7:BF:DB:3E:86 eth0.5: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 50:C7:BF:DB:3E:86 Chip WAN Only Port 00000000, Defined WAN Only Port 00000000, WAN Only Port Result: 0x00000000 <4> Chip WAN Preffered Port 00000000, Defined WAN Preffered Port 00000000, WAN Preffered Port Result: 0x00000000 Chip LAN Only Port 00000000, Defined LAN Only Port 00000000, LAN Only Port Result: 0x00000000 Energy Efficient Ethernet: Disabled insmod: can't insert '/lib/modules/kmdir/extra/nciTMSkmod.ko': No such file or directory Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Sep 19 2017 15:58:36 Registered <245> Broadcom 802.1Q VLAN Interface, v0.1 Initializing WLCSM Module WLCSM Module loaded successfully ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: setting latency timer to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM ehci_hcd 0000:00:0a.0: irq 113, io mem 0x1000c300 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: setting latency timer to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 112, io mem 0x1000c400 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. dns_init PPP MPPE Compression module registered PPTP driver version 0.8.5 pptp fastpath module init ... Please press Enter to activate this console. [ dm_readFile ] 2061: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/rel [ initKernelMonitmonitor task is initialized pid= 416 orFd ] 428: kernelMonitorFd=8 [ initKernelMonitorFd ] 446: registered fd 8 with kernel monitor sh: pwrctl: not found ioctl: No such device ADDRCONF(NETDEV_UP): eth0.2: link is not ready device eth0.2 entered promiscuous mode Success ADDRCONF(NETDEV_UP): eth0.3: link is not ready device eth0.3 entered promiscuous mode Success ADDRCONF(NETDEV_UP): eth0.4: link is not ready device eth0.4 entered promiscuous mode Success ADDRCONF(NETDEV_UP): eth0.5: link is not ready device eth0.5 entered promiscuous mode Success [DBG:700] ADSL dr*** dslThread dslPid=470 BcmAdsl_Initialize=0xC013A090, g_pFnNotifyCallback=0xC01743E0 iver returns error [ oal_dsl_isAtmConnection ] 3940: Failed to freshAdslMibInfo pSdramPHY=0xA3FFFFF8, 0x8D02E 0xDEADBEEF *** XfaceOffset: 0x4FF90 => 0x4FF90 *** *** PhySdramSize got adjusted: 0xF5FB4 => 0x129AB8 *** AdslCoreSharedMemInit: shareMemSize=34080(34080) AdslCoreHwReset: pLocSbSta=82a48000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA3FB59A4 VersionInfo: A2pvI042j1.d26h ***BcmDiagsMgrRegisterClient: 0 *** bcmxtmcfg: DS xDSL G.inp Mode = DISABLED bcmxtmcfg: xDSL G.Fast Mode = DISABLED XTM Init: Ch:0 - 332 rx BDs at 0xa3ac0000 XTM Init: Ch:1 - 16 rx BDs at 0xa2fe4e80 bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system bcmxtmcfg: Out of sequence call to XTM_ASM_HANDLER::Uninitialize(). Recovering. bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled bcmxtmcfg: Bonding State is DATA_IDLE bcmxtmcfg: SID MODE SET to 12 BIT MODE bcmxtmcfg: ATM Bonding Mgmt Log Area = 83a0fd08 open DNS error: No such file or directory [ oal_sys_getOldTZInfo ] 523: Open TZ file error! --SMP support wl: dsl_tx_pkt_flush_len=338 wl: norm_wmark_tot=876, pktc_wmark_tot=876 PCI: Enabling device 0000:02:00.0 (0000 -> 0002) wl: passivemode=1 wl0: creating kthread wl0-kthrd wl: napimode=0 initvars_cis_pci: Not CIS format Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl: ID=pci/2/0/ wl: ID=pci/2/0/ wl: loading /etc/wlan/bcm43217_map.bin wl: updating srom from flash... wl: updating srom from flash... srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32 wl0: allocskbmode=1 currallocskbsz=512 wl0: Broadcom BCM43227 802.11 Wireless Controller 7.14.89.14.cpe4.16L03.0-kdb Chanspec set to 0x1806 wlctl: Unsupported wlctl: Bad Argument wlctl: Unsupported device wl0 entered promiscuous mode brctl: iface wl0.1: No such device brctl: iface wl0.3: No such device brctl: iface wl0.4: No such device brctl: iface wl0.2: No such device send 2030 error No such file or directory ,pid 317 send 2004 error No such file or directory ,pid 317 [ rsl_getManagementServerObj ] 488: cannot set connectionRequestURL yet because no WAN intf is up [ rsl_getManagementServerObj ] 488: cannot set connectionRequestURL yet because no WAN intf is up [ rsl_getManagementServerObj ] 488: cannot set connectionRequestURL yet because no WAN intf is up iptables: Bad rule (does a matching rule exist in that chain?). radvd starting [Jan 01 01:00:17] radvd: interface br0 is not RUNNING [Jan 01 01:00:17] radvd: interface br0 does not exist [Jan 01 01:00:17] radvd: error parsing or activating the config file: /var/tmp/dconf/radvd_br0.conf ifconfig: ioctl 0x8913 failed: No such device [ getPidFromPidFile ] 112: Cann't open file: /var/run/zebra.pid. [ getPidFromPidFile ] 112: Cann't open file: /var/run/ripd.pid. iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). ip6tables: Bad rule (does a matching rule exist in that chain?). [ rsl_initDslIptvCfgObj ] 2180: DSL IPTV not enable or not firstInit. [ rsl_setStorageServiceObj ] 1252: mountFlag is 3,We start usb server killall: ushare: no process killed [ getMacFromIfName ] 461: error, SIOCGIFHWADDR failed on nas1_1! [ init_clients_cfg ] 223: error, reset client_info_t ! uShare (version 1.1a), a lightweight UPnP A/V and DLNA Media Server. Benjamin Zores (C) 2005-2007, for GeeXboX Team. See http://ushare.geexbox.org/ for updates. iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). ip6tables: Bad rule (does a matching rule exist in that chain?). kcg 333 :GPL NetUSB up! kc 90 : run_telnetDBGDServer start kc 227 : init_DebugD end INFO182B: NetUSB 1.02.80, 0003040B : Mar 4 2016 10:07:24 INFO182D: 7437: TD-W9970 :TD-W9970 INFO182E: AUTH ISOC INFO182F: filterAudio usbcore: registered new interface driver KC NetUSB General Driver INFO188C: Reset device when disconnect INFO01ED: init proc : PAGE_SIZE 4096 INFO171F: infomap c0d7e1a4 INFO1722: sleep to wait br0 to wake up INFO15D9: tcpConnector() started... : br0 INFO1589: Bind to br0 open DNS error: No such file or directory

Pictures

User Images

• 

  PCB TD-W9970 v2