TP-LINK Archer VR900v (v1.0)

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

TP-LINK Archer VR900 v (v1.0)
Availability: now

(Est.) release date: August 2015
(Est.) initial retail price (in USD): $200
EAN: 6935364092795 (UPC DB, On eBay)
Country of manuf.: China

Amazon image

B0142YTBE0 (Flag of Germany.svg, On Amazon, On CCC)
multiple revisions of this device, use caution

Type: wireless router, dsl modem

Power: 12 VDC, 3.3 A
Connector type: barrel

CPU1: Broadcom BCM4709A0 (1 GHz, 2 cores)
CPU2: Broadcom BCM63168 (400 MHz, 2 cores)
FLA1: 16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (Spansion S25FL128SAGMFI00)
FLA2: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Winbond W25Q64FVSSIG)
RAM1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (SK hynix H5TQ1G63EFR-PBC)
RAM2: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (Zentel A3R12E40CBF-8E)

Expansion IFs: USB 2.0, USB 3.0
USB ports: 2
Serial: yes, 4-pin header, unpopulated, J4, 3.3V TTL, (115200,8,N,1)

WI1 chip1: Broadcom BCM4360
WI1 802dot11 protocols: bgn
WI1 MIMO config: 3x3:3
WI1 antenna connector: RP-SMA
WI2 chip1: Broadcom BCM4360
WI2 802dot11 protocols: an+ac
WI2 MIMO config: 3x3:3
WI2 antenna connector: RP-SMA

ETH chip1: Broadcom BCM4709A0
Switch: Broadcom BCM4709A0
LAN speed: 1G
LAN ports: 3
WAN speed: 1G
WAN ports: 1


Additional chips
xDSL (VDSL2/ADSL2+) AFE;Broadcom;BCM6306;BCM6306KMLG, P31, CN1523, 515297, 3B W;1;
DECT SoC;DSP Group;DCX81;DCX81AC0CFAE3FNC, DSPG, PM1M36.0C, TMCI29D0003A 1435, TMCT10D;1;
VoIP Chip;Microsemi;ZL88601;ZL88601, Z D (e3), 1426MAE;1;;64-pin QFN;9x9;
DECT Flash;Winbond;W25Q80BVSSIG;Winbond, 25Q80BVSIG, 1444;1;;SOIC-8;208-mil;

Stock bootloader: CFE 1.0.38 -116.15

Stock FW OS: Linux 3.4.11 -rt19

Flags: G.Vector, VDSL2, ADSL2+, DECT, VoIP, TAE

Default SSID: TP-LINK_XXXX (38 addl. devices)
Default IP address:
the IP is used by 1189 additional devices
of which 95 are TP-LINK devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1220 additional devices
of which 250 are TP-LINK devices

802dot11 OUI: F4:F2:6D (5 E, 5 W)
Ethernet OUI: F4:F2:6D (5 E, 5 W)

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

AC1900 VoIP WLAN DSL Router

Product page (DE) (Annex B/J) Product page  • Support page

All-In-One Box Telefonie WLAN-AC Modem Router

Note: This model is not the VR900, but the VR900v.

Both differ quite substancially in both hardware and pricing.
Be careful not to mix up "VR900v (v1.0)" and "VR900 (v1.0)"!


The device runs on 2 entirely different SoCs:


  • Broadcom BCM4709 (2x 1GHz ARM Cortex-A9) with RAM 128MB and flash 16MB.
  • Broadcom BCM63168 (2x 400MHz MIPS) with RAM 64MB and flash 8MB.


Spansion S25FL128SAGMFI00 16MB (FL128SAIF00, 439QQ0009 A, SPANSION)
Winbond W25Q64FVSSIG 8MB (Winbind, 25Q64FVSIG, 1532)
Winbond W25Q80BVSSIG 1MB (Winbond, 25Q80BVSIG, 1444) (DECT)


SK hynix H5TQ1G63EFR-PBC 128MB (H5TQ1G63EFR, PBC 444V, NWLC2479XH3)
Zentel A3R12E40CBF-8E 64MB (A3R12E40CBF, -8E, 527ZENV6, 57025694G-F)
  • For wired ethernet connectivity, the integrated NICs of the BCM4709 are used.
That SoC supposedly also features some hardware offloading capabilities
as well as hardware accelerated routing.
  • Wi-fi is provided by 2 BCM4360 with an unknown number of antennas.
The device has 3 external RP-SMA connectors for wifi, yet the exact
wiring/mapping is unknown.
(root@localhost.localdomain) (gcc version 4.6.2 (Buildroot 2011.11)) 
#1 SMP PREEMPT Mon Aug 24 10:08:45 HKT 2015;unknown OS on BCM4709


The device has at least 2, possibly 3 serial interfaces

on the unpopulated 4 pin headers J4, J7 and J8.
  • J4 (unpopulated 3.3V TTL, RX-TX-GND-VCC, 115200,8,N,1)
  • J7 (unpopulated, 3.3V TTL, ?-?-GND-VCC)
  • J8 (unpopulated, 3.3V TTL, RX-TX-GND-VCC, 115200,8,N,1)
All operate at 3.3V TTL, J4 and J8 run at 115200,8,N,1,
whilst the exact function of J7 is yet unknown.
The pinout of all headers is RX-TX-GND-VCC, whilst the exact
function of the RX and TX pins on J7 is yet to be found.
At least on my board, it was virtually impossible to solder the GND pins
on all 3 headers (the other pins could be soldered without any problem).
You probably need to brass-brush them prior to soldering (do not brush
them after soldering or you will spread fine-ground solder over the PCB,
causing possible shortages!).


  • 2 separate VoIP ports are offered through which POTS telephones can be used for VoIP
telephony. Both ports feature a German TAE socket and a classical RJ11 socket.
I have not tested if you can connect 2 phones simultanously to the same VoIP port.
  • DECT is provided by a DSP DCX81 with a small separated antenna PCB which is integrated
into the router's plastic case and is not visible or accessible from the outside.

See also