WikiDevi will be going offline 2019-10-31. For historical dumps of the database, see 'WikiDevi' @ the Internet Archive (MW XML, Files, Images).
Final dumps will be made available after the site goes offline.
There is no chance the data will not live on, in some form - even if it isn't 'WikiDevi' anymore. For example, see TechInfoDepot.

TP-LINK TD-W9970 v2

From WikiDevi
Jump to: navigation, search

TP-LINK TD-W9970 (EU) v2.0

(Est.) release date: March 2017
EAN: 6935364092535 (UPC DB, On eBay)
Country of manuf.: China

Amazon image

ASINs
B00YU23DI0 (Flag of France.svg, On Amazon, On CCC)
multiple revisions of this device, use caution

Type: wireless router, dsl modem

FCC ID: none available
PCB ID: 2011500211

Power: 12 VDC, 1 A
Connector type: barrel

CPU1: Broadcom BCM63381U (600 MHz, 2 cores)
FLA1: 8 MiB
8,388,608 B
65,536 Kib
8,192 KiB
64 Mib
0.00781 GiB
(GigaDevice GD25Q64CSIG)
RAM1: 64 MiB
67,108,864 B
524,288 Kib
65,536 KiB
512 Mib
0.0625 GiB
(Brand? Model?)

Expansion IFs: USB 2.0
USB ports: 1
Serial: yes, internal, 4-pin header, 3.3V TTL

WI1 chip1: Broadcom BCM43227T
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: soldered

ETH chip1: Broadcom BCM63381U
LAN speed: 100M
LAN ports: 4
WAN speed: 100M
WAN ports: 1

bgn

Additional chips
VDSL Analog Front End (LD/AFE);Broadcom;BCM6303;;1;

Stock bootloader: CFE 1.0.38 -116.174

Stock FW OS: Linux 3.4.11 -rt19

Flags: ADSL2+, VDSL2

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1173 additional devices
of which 95 are TP-LINK devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1212 additional devices
of which 249 are TP-LINK devices

802dot11 OUI: none specified

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.


300Mbps Wireless N USB VDSL/ADSL Modem Router

"2011500211" is silkscreened on the main board.

  • Antenna: 2x 5dBi (2.4GHz)
  • USB port: 1x USB 2.0

Serial[edit]

Bootloader and OS are at 115200, 8N1

Pinout[edit]

Pin Value
1 (key) Tx (Data Transmit)
2 Rx (Data Receive)
3 GND (Ground)
4 Vcc (+3.3V)

Boot Log[edit]

boot log • >>
HELO
CPUI
L1CI
HELO
CPUI
L1CI
4.1603-1.0.38-116.174
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
300H
SIZ4
SIZ3
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN


Base: 4.16_03
CFE version 1.0.38-116.174 for BCM963381 (32bit,SP,BE)
Build Date: Tue Sep 19 15:46:52 CST 2017 (swd@localhost.localdomain)
Copyright (C) 2000-2013 Broadcom Corporation.

Boot Strap Register:  0x1ffff7f
Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 300MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

HS Serial flash device: GD25Q64, id 0xc817 sector 64KB size 8192KB
Flash not used for Auxillary File System
pmc_init:PMC using DQM mode
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-8)                    : 963381SV  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : e0:05:c5:63:38:10  
PSI Size (1-64) KBytes            : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  

*** Press 't' to stop auto run (0.1 seconds) ***
Code Address: 0x80010000, Entry Address: 0x803277f0
Decompression OK!
Entry at 0x803277f0
Starting program at 0x803277f0
Linux version 3.4.11-rt19 (swd@localhost.localdomain) (gcc version 4.6.2 
 (Buildroot 2011.11) ) #60 SMP PREEMPT Tue Sep 19 15:56:54 CST 2017
HS Serial flash device: GD25Q64, id 0xc817 sector 64KB size 8192KB
963381SV prom init
CPU revision is: 0002a081 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
 memory: 03ece000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00003ece
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00003ece
On node 0 totalpages: 16078
free_area_init_node: node 0, pgdat 80408e30, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11888 pages, LIFO batch:1
PERCPU: Embedded 7 pages/cpu @81083000 s5200 r8192 d15280 u32768
pcpu-alloc: s5200 r8192 d15280 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 15952
Kernel command line: ro noinitrd  irqaffinity=0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 58640k/64312k available (3215k kernel code, 5672k reserved, 854k data, 208k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
CPU revision is: 0002a081 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
pmc_init:PMC using DQM mode
Flash not used for Auxillary File System
registering PCI controller with io_map_base unset
bcm63xx_pcie: setting resistor calibration value to 0x0
bcm63xx_pcie: applying serdes parameters
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff]
pci_bus 0000:00: root bus resource [io  0x11700000-0x1170ffff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:02:00.0: [14e4:a8db] type 00 class 0x028000
pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: BAR 8: assigned [mem 0xa0000000-0xa00fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0xa0000000-0xa0007fff 64bit]
pci 0000:01:00.0: PCI bridge to [bus 02-02]
pci 0000:01:00.0:   bridge window [mem 0xa0000000-0xa00fffff]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
skbFreeTask created successfully
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Sep 19 2017 15:54:43 initialized
Broadcom GBPM v0.1 Sep 19 2017 15:54:43 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
NET: Registered protocol family 1
PCI: CLS 16 bytes, default 16
init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c
bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.18)
msgmni has been set to 114
io scheduler noop registered (default)
bcm963xx_mtd driver
Registered device mtd:rootfs dev0 Address=0xb817c670 Size=6549504
PPP generic driver version 2.4.2
NET: Registered protocol family 24
brcmboard: brcm_board_init entry
WIFI: Button Interrupt 0x1 is enabled
RESET: Button Interrupt 0x0 is enabled
SES: Button Interrupt 0x0 is enabled
SES: LED GPIO 0x8017 is enabled
Register flash device: flash0
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX
ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX
Total # RxBds=1979
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

pppox_fastpath_init!
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (916 buckets, 5120 max)
gre: GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
ebt_ftos registered
ebt_wmm_mark registered
8021q: 802.1Q VLAN Support v1.8
SQUASHFS error: Xattrs in filesystem, these will be ignored
SQUASHFS error: unable to read xattr id index table
VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
Freeing unused kernel memory: 208k freed
starting pid 202, tty '': '/etc/init.d/rcS'
L2TP core: blog_l2tp_rcv_check 
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
pppol2tp_fastpath_init!
bcmxtmrtdrv: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
bcmxtmrt: Broadcom BCM3381B0 ATM/PTM Network Device v0.6 Sep 19 2017 16:00:40
Broadcom Ingress QoS Module  Char Driver v0.1 Sep 19 2017 15:58:37 Registered<243>

Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=67108864B (64MB), buf_mem_size <10%> =6710880B (6MB), num of buffers=3328, buf size=2016
Broadcom BPM Module Char Driver v0.1 Sep 19 2017 15:58:36 Registered<244>
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Sep 19 2017 15:58:37 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
flwStatsThread created
Constructed Broadcom Packet Flow Cache v2.2 Sep 19 2017 15:58:37
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63381B0 Ethernet Network Device v0.1 Sep 19 2017 16:00:33
ETH Init: Ch:0 - 200 tx BDs at 0xa3b14000
ETH Init: Ch:0 - 1331 rx BDs at 0xa39d8000
eth0.2: <Int sw port: 0> <Logical : 00> PHY_ID <0x00000001 : 0x01> MAC : 50:C7:BF:DB:3E:86
eth0.3: <Int sw port: 1> <Logical : 01> PHY_ID <0x00000002 : 0x02> MAC : 50:C7:BF:DB:3E:86
eth0.4: <Int sw port: 2> <Logical : 02> PHY_ID <0x00000003 : 0x03> MAC : 50:C7:BF:DB:3E:86
eth0.5: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 50:C7:BF:DB:3E:86
  Chip WAN Only Port 00000000, Defined WAN Only Port 00000000, WAN Only Port Result: 0x00000000
<4>  Chip WAN Preffered Port 00000000, Defined WAN Preffered Port 00000000, WAN Preffered Port Result: 0x00000000
  Chip LAN Only Port 00000000, Defined LAN Only Port 00000000, LAN Only Port Result: 0x00000000
Energy Efficient Ethernet: Disabled
insmod: can't insert '/lib/modules/kmdir/extra/nciTMSkmod.ko': No such file or directory
Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Sep 19 2017 15:58:36 Registered <245>
Broadcom 802.1Q VLAN Interface, v0.1
Initializing WLCSM Module
WLCSM Module loaded successfully 
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: setting latency timer to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 113, io mem 0x1000c300
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: setting latency timer to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 112, io mem 0x1000c400
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
dns_init
PPP MPPE Compression module registered
PPTP driver version 0.8.5
pptp fastpath module init ... 

Please press Enter to activate this console. [ dm_readFile ] 2061:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/rel
[ initKernelMonitmonitor task is initialized pid= 416 
orFd ] 428:  kernelMonitorFd=8

[ initKernelMonitorFd ] 446:  registered fd 8 with kernel monitor

sh: pwrctl: not found
ioctl: No such device
ADDRCONF(NETDEV_UP): eth0.2: link is not ready
device eth0.2 entered promiscuous mode
Success 
ADDRCONF(NETDEV_UP): eth0.3: link is not ready
device eth0.3 entered promiscuous mode
Success 
ADDRCONF(NETDEV_UP): eth0.4: link is not ready
device eth0.4 entered promiscuous mode
Success 
ADDRCONF(NETDEV_UP): eth0.5: link is not ready
device eth0.5 entered promiscuous mode
Success 
[DBG:700] ADSL dr*** dslThread dslPid=470
BcmAdsl_Initialize=0xC013A090, g_pFnNotifyCallback=0xC01743E0
iver returns error

[ oal_dsl_isAtmConnection ] 3940:  Failed to freshAdslMibInfo
pSdramPHY=0xA3FFFFF8, 0x8D02E 0xDEADBEEF
*** XfaceOffset: 0x4FF90 => 0x4FF90 ***
*** PhySdramSize got adjusted: 0xF5FB4 => 0x129AB8 ***
AdslCoreSharedMemInit: shareMemSize=34080(34080)
AdslCoreHwReset:  pLocSbSta=82a48000 bkupThreshold=3072
AdslCoreHwReset:  AdslOemDataAddr = 0xA3FB59A4
VersionInfo: A2pvI042j1.d26h
***BcmDiagsMgrRegisterClient: 0 ***
bcmxtmcfg: DS xDSL G.inp Mode = DISABLED 
bcmxtmcfg: xDSL G.Fast Mode = DISABLED 
XTM Init: Ch:0 - 332 rx BDs at 0xa3ac0000
XTM Init: Ch:1 - 16 rx BDs at 0xa2fe4e80
bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system
bcmxtmcfg: Out of sequence call to XTM_ASM_HANDLER::Uninitialize().  Recovering.
bcmxtmcfg: ATM Bonding configured in system. Fallback mode = Enabled 
bcmxtmcfg: Bonding State is DATA_IDLE 
bcmxtmcfg: SID MODE SET to 12 BIT MODE 
bcmxtmcfg: ATM Bonding Mgmt Log Area = 83a0fd08 
open DNS error: No such file or directory
[ oal_sys_getOldTZInfo ] 523:  Open TZ file error!
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: norm_wmark_tot=876, pktc_wmark_tot=876
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
wl: passivemode=1
wl0: creating kthread wl0-kthrd
wl: napimode=0
initvars_cis_pci: Not CIS format
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=pci/2/0/
wl: ID=pci/2/0/
wl: loading /etc/wlan/bcm43217_map.bin
wl: updating srom from flash...
wl: updating srom from flash...
srom rev:8
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32
wl0: allocskbmode=1 currallocskbsz=512
wl0: Broadcom BCM43227 802.11 Wireless Controller 7.14.89.14.cpe4.16L03.0-kdb
Chanspec set to 0x1806
wlctl: Unsupported
wlctl: Bad Argument
wlctl: Unsupported
device wl0 entered promiscuous mode
brctl: iface wl0.1: No such device
brctl: iface wl0.3: No such device
brctl: iface wl0.4: No such device
brctl: iface wl0.2: No such device
send 2030 error No such file or directory ,pid 317
send 2004 error No such file or directory ,pid 317
[ rsl_getManagementServerObj ] 488:  cannot set connectionRequestURL yet because no WAN intf is up
[ rsl_getManagementServerObj ] 488:  cannot set connectionRequestURL yet because no WAN intf is up
[ rsl_getManagementServerObj ] 488:  cannot set connectionRequestURL yet because no WAN intf is up
iptables: Bad rule (does a matching rule exist in that chain?).
radvd starting
[Jan 01 01:00:17] radvd: interface br0 is not RUNNING
[Jan 01 01:00:17] radvd: interface br0 does not exist
[Jan 01 01:00:17] radvd: error parsing or activating the config file: /var/tmp/dconf/radvd_br0.conf
ifconfig: ioctl 0x8913 failed: No such device
[ getPidFromPidFile ] 112:  Cann't open file: /var/run/zebra.pid.
[ getPidFromPidFile ] 112:  Cann't open file: /var/run/ripd.pid.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
[ rsl_initDslIptvCfgObj ] 2180:  DSL IPTV not enable or not firstInit.
[ rsl_setStorageServiceObj ] 1252:  mountFlag is 3,We start usb server

killall: ushare: no process killed
[ getMacFromIfName ] 461: error, SIOCGIFHWADDR failed on nas1_1!
[ init_clients_cfg ] 223: error, reset  client_info_t !
uShare (version 1.1a), a lightweight UPnP A/V and DLNA Media Server.
Benjamin Zores (C) 2005-2007, for GeeXboX Team.
See http://ushare.geexbox.org/ for updates.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
kcg 333 :GPL NetUSB up!
kc   90 : run_telnetDBGDServer start 
kc  227 : init_DebugD end
INFO182B: NetUSB 1.02.80, 0003040B : Mar  4 2016 10:07:24
INFO182D: 7437: TD-W9970 :TD-W9970 
INFO182E:  AUTH ISOC
INFO182F:  filterAudio
usbcore: registered new interface driver KC NetUSB General Driver
INFO188C: Reset device when disconnect
INFO01ED:  init proc : PAGE_SIZE 4096
INFO171F:  infomap c0d7e1a4 
INFO1722:  sleep to wait br0 to wake up
INFO15D9: tcpConnector() started... : br0 
INFO1589: Bind to br0
open DNS error: No such file or directory

Images[edit]