TP-Link TD-W8970 v3.0

TD-W8970 v3.0 is a Broadcom 300Mbps Wireless N Gigabit ADSL2+ Modem Router.

Previous versions are Lantiq based; use the TD-W8970 v1.x page as a reference.

TD-W8970 v3.0


None at this time.

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
TD-W8970v3.0Broadcom BCM63624001664Broadcom BCM6362b/g/n--ADSL2+1x 2.0

Please check out the article Flash layout. It contains an example and a couple of explanations.

FIXME Find out flash layout, then add the flash layout table here (copy, paste, modify the example). Remove this fixme afterwards.

Specific values needed for tftp


Bootloader tftp server IPv4 address FILL-IN
Bootloader MAC address (special) FILL-IN
Firmware tftp image Latest OpenWrt release (NOTE: Name must contain “tftp”)
TFTP transfer window FILL-IN seconds
TFTP window start approximately FILL-IN seconds after power on
TFTP client required IP address FILL-IN
Brand TP-Link
Model TD-W8970
Versions v3.0
Device Type WiFi Router
Availability Discontinued
Comments - general
OpenWrt Support
Supported Since Commit
Supported Since Release
Supported Current Release
Bootloader ¿
Target brcm63xx
CPU MHz 400
Flash MB 16
Ethernet 100M ports -
Ethernet 1Gbit ports
Ethernet 2.5Gbit ports
Switch Broadcom BCM53125
Modem ADSL2+
Comments - network ports
WLAN 2.4GHz b/g/n
WLAN 5.0GHz -
WLAN Hardware
Detachable Antennas 2
Comments - WLAN 2x2
USB ports 1x 2.0
SATA ports -
Serial Yes
Comments - USB & SATA ports
LED count ¿
Button count ¿
Power supply
Forum Topic URL
WikiDevi URL
OEM device homepage URL
Firmware OEM Stock URL
Firmware OpenWrt Install URL
Firmware OpenWrt Upgrade URL
Edit the underlying data View/Edit data

Insert photo of front of the casing

Insert photo of back of the casing

Backside label:
Insert photo of backside label

Note: This will void your warranty!

To remove the cover and open the device:

  • remove four screw
  • gently and carefully detach upper cover by releasing the plastic clips/hooks (there are 8 of them: 3 in front, 2 right, 2 left and 1 in back)

Main PCB:
**photo of PCB**

port.serial general information about the serial port, serial port cable, etc.

Serial pinout is the J3 connector and is not the same as previous version (e.g. TD-W8970 v1.x)

it's actually opposite.

How to connect to the Serial Port of this specific device:

Serial connection parameters
for TP-Link TD-W8970 v3.0
FIXME 115200, 8N1
Connector J3
Pins (from top to bottom) (1)Tx, (2)Rx, (3)GND, (4)VCC (3.3V)


(Hint: If you are soldering headers to the board, you have to short two missing resistors beside Tx & Rx as shown in fcc photos of refernce board.)

port.jtag general information about the JTAG port, JTAG cable, etc.

FIXME How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS ZQDN 300H PHYE DINT LASY USYN MSYN LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN CFE version 1.0.38-114.185 for BCM96362 (32bit,SP,BE) Build Date: Fri Apr 24 09:43:48 CST 2015 (lmc@localhost.localdomain) Copyright (C) 2000-2011 Broadcom Corporation. HS Serial flash device: name ID_W25X64, id 0xef17 size 8192KB Total Flash size: 8192K with 128 sectors Flash not used for Auxillary File System External switch id = 53125 Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz Main Thread: TP0 Memory Test Passed Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 Board IP address : Host IP address : Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-13) : 96361I2 Number of MAC Addresses (1-32) : 11 Base MAC Address : 02:10:18:01:00:01 PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 *** Press 't' to stop auto run (0.1 seconds) *** Code Address: 0x80010000, Entry Address: 0x802e0020 Decompression OK! Entry at 0x802e0020 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x802e0020 Linux version 2.6.30 (lmc@localhost.localdomain) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #368 SMP PREEMPT Fri Apr 24 09:44:37 CST 2015 HS Serial flash device: name ID_W25X64, id 0xef17 size 8192KB 96361I2 prom init CPU revision is: 0002a070 (Broadcom4350) DSL SDRAM reserved: 0x100000 Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 80396d90, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 wait instruction: enabled Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:128 PID hash table entries: 256 (order: 8, 1024 bytes) console [ttyS0] enabled Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 59252k/64512k available (2911k kernel code, 5240k reserved, 718k data, 156k init, 0k highmem) Calibrating delay loop... 399.36 BogoMIPS (lpj=199680) Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Jul 15 2014 10:54:21 CPU revision is: 0002a070 (Broadcom4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Calibrating delay loop... 402.43 BogoMIPS (lpj=201216) Brought up 2 CPUs net_namespace: 1120 bytes NET: Registered protocol family 16 Total Flash size: 8192K with 128 sectors Flash not used for Auxillary File System registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:00.0: PME# supported from D0 D3hot D3cold pci 0000:00:00.0: PME# disabled pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: disabled pci 0000:01:00.0: PREFETCH window: disabled PCI: Setting latency timer of device 0000:01:00.0 to 64 skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Jul 21 2014 17:47:07 initialized Broadcom GBPM v0.1 Jul 21 2014 17:54:37 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 2, 16384 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher squashfs: version 4.0 with LZMA457 ported by BRCM fuse init (API version 7.11) msgmni has been set to 115 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:01:00.0 to 64 Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 NET: Registered protocol family 24 bcm963xx_mtd driver v2.0 Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xb814d8e0,6807552] brcmboard: brcm_board_init entry kerSysScreenPciDevices: 0x14e4:0x435f:(slot 0) detected kerSysScreenPciDevices: 0x14e4:0x6300:(slot 9) detected kerSysScreenPciDevices: 0x14e4:0x6300:(slot 10) detected kerSysScreenPciDevices: 0x14e4:0x6362:(slot 0) detected SES: Button Interrupt 0x1 is enabled sesBtn_mapIntr: is_sesBtn_irq_shared=0, sesBtn_irq=1 SES: LED GPIO 0x8004 is enabled WIFI: Button Interrupt 0x2 is enabled wifiBtn_mapIntr: wifiBtn_irq=2 PCIe: No device found - Powering down brcm_board_init: isShared=0, rstToDflt_irq=0 Register flash device: flash0 Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000100 (irq = 11) is a BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 12) is a BCM63XX Total # RxBds=1592 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmxtmrt: Broadcom BCM6362B0 ATM/PTM Network Device v0.3 Apr 3 2015 15:26:21 GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1008 buckets, 5120 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> pppox_fastpath_init! VFS: Mounted root (squashfs filesystem) readonly on device 31:0. Freeing unused kernel memory: 156k freed starting pid 193, tty '': '/etc/init.d/rcS' ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. chipinfo: module license 'proprietary' taints kernel. Disabling lock debugging due to kernel taint brcmchipinfo: brcm_chipinfo_init entry Broadcom Ingress QoS Module Char Driver v0.1 Apr 3 2015 17:03:23 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=67108864B (64MB), buf_mem_size=6710880B (6MB), num of buffers=3153, buf size=2128 Broadcom BPM Module Char Driver v0.1 Apr 3 2015 17:03:22 Registered<244> [NTC bpm] bpm_set_status: BPM status : enabled NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Apr 3 2015 17:03:24 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Apr 3 2015 17:03:24 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM6362B0 Ethernet Network Device v0.1 Apr 3 2015 17:48:40 ETH Init: Ch:0 - 200 tx BDs at 0xa3add000 ETH Init: Ch:0 - 1261 rx BDs at 0xa3a10000 eth0.2: MAC Address: C4:E9:84:6A:F6:8C eth0.3: MAC Address: C4:E9:84:6A:F6:8C eth0.4: MAC Address: C4:E9:84:6A:F6:8C eth0.5: MAC Address: C4:E9:84:6A:F6:8C Broadcom 802.1Q VLAN Interface, v0.1 dns_init PPP MPPE Compression module registered PPTP driver version 0.8.5 pptp fastpath module init ... PPPoL2TP kernel driver, V1.0 pppol2tp_fastpath_init! Please press Enter to activate this console. [ dm_readFile ] 2061: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml [ initKernelMonitmonitor task is initialized pid= 391 orFd ] 468: kernelMonitorFd=6 [ initKernelMonitorFd ] 486: registered fd 6 with kernel monitor [ oal_sys_getOldTZInfo ] 431: Open TZ file error! Success ioctl: No such device ADDRCONF(NETDEV_UP): eth0.2: link is not ready device eth0.2 entered promiscuous mode ADDRCONF(NETDEV_UP): eth0.3: link is not ready device eth0.3 entered promiscuous mode ADDRCONF(NETDEV_UP): eth0.4: link is not ready device eth0.4 entered promiscuous mode Note: Loading 6300 MDK (default) driver for 6362 chip Note: Forcing 53115 driver for 53125 Switch MDK: num_switches = 2 Switch MDK: unit = 0; phy_pbmp = 0x0ADDRCONF(NETDEV_UP): eth0.5: link is not ready ; config_pbmp = 0x10 device eth0.5 entered promiscuous mode Switch MDK link poll thread: unit=1; phypbmp=0x1e Initializing unitBcmAdsl_Initialize=0xC01AFB90, g_pFnNotifyCallback=0xC01E1C94 0 in unmanaged request_irq failed for irq=23 (brcm_23) retval=-16 mode pSdramPHY=0xA3FFFFF8, 0xABCB1 0xDEADBEEF *** XfaceOffset: 0x21F90 => 0x21F90 *** *** PhySdramSize got adjusted: 0x90870 => 0xA693C *** AdslCoreSharedMemInit: shareMemSize=366237(366240) AdslCoreHwReset: pLocSbSta=829f8000 bkupThreshold=1600 AdslCoreHwReset: AdslOemDataAddr = 0xA3F8526C ***BcmDiagsMgrRegisterClient: 0 *** XTM Init: 315 rx BDs at 0xa3b0b000 XTM Init: 16 rx BDs at 0xa3b23880 --SMP support wl: dsl_tx_pkt_flush_len=338 wl: high_wmark_tot=2049 PCI: Setting latency timer of device 0000:00:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl0: allocskbmode=1 currallocskbsz=256 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_map.bin wl: updating srom from flash... wl: updating srom from flash... srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=16 wl0: Broadcom BCM435f 802.11 Wireless Controller dgasp: kerSysRegisterDyingGaspHandler: wl0 registered Chanspec set to 0x1806 wlctl: Unsupported wlctl: Bad Argument wl0: WLC_SET_VAR(bsscfg:join_pref): Invalid argument wl0: WLC_GET_VAR(psta_if): Invalid argument device wl0 entered promiscuous mode brctl: iface wl0.1: No such device brctl: iface wl0.3: No such device brctl: iface wl0.4: No such device brctl: iface wl0.2: No such device iptables: Bad rule (does a matching rule exist in that chain?). radvd starting ifconfig: ioctl 0x8913 failed: No such device [ wan_conn_pppoeConn ] 089: L2 interface not exist(up), don't start pppd! [ getPidFromPidFile ] 112: Cann't open file: /var/run/ [ getPidFromPidFile ] 112: Cann't open file: /var/run/ iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). iptables: Bad rule (does a matching rule exist in that chain?). ip6tables: Bad rule (does a matching rule exist in that chain?). [ rsl_initDslIptvCfgObj ] 2014: DSL IPTV not enable or not firstInit. [ rsl_setStorageServiceObj ] 1251: mountFlag is 3,We start usb server killall: ushare: no process killed uShare (version 1.1a), a lightweight UPnP A/V and DLNA Media Server. Benjamin Zores (C) 2005-2007, for GeeXboX Team. See for updates.

Space for additional notes, links to forum threads or other ressources, ...

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/08/31 12:07
  • by tmomas