D-Link DSL-2741B
ADSL + Wireless Router
See also D-Link DSL-2740B/DSL-2741B
Hardware
Info
ADSL2+ Chip with CPU MIPS32 | FLASH 4MB | SDRAM 64MB | Switch 10/100MBit | WLAN 802.11b/g/n | WLAN Front-End | ASDL Line driver |
---|---|---|---|---|---|---|
Broadcom BCM63281KFBG | MX25L64 | MIRA P3R12E4JFF | Broadcom BCM6328B0 | Atheros 9287 | Atheros (possible: mac80211 ath9k >= 2.6.32) | Broadcom BCM96328 |
Photos
Serial port pinout
Console port uses 3.3 V signaling with settings 115200 8N1. Pin layout (from left):
1 | 2 | 3 | 4 |
---|---|---|---|
GND | RX | TX | VCC |
Default settings
LAN IP: 192.168.1.1/24 User name: admin Password: admin
Original Firmware Info
The original GPL sourcecode v1.00 can be downloaded here (rev c), | here (rev e), |here (rev f1). It consist on a Linux 2.6.30 kernel with some binary and some opensource Broadcom tools & drivers and sourcecode of the kernel and the rest of tools.
Open source drivers: flash, led, spi, serial, rnd (random number generator), network (smux, atm/ptm)
Binary only: adsl, bcm log, bcm ethernet, bcm wireless, fap, 802.1ag, power management, vlan, xtmcfg
The toolchain is included (rev f1) and it has gcc 4.4.2.
Bootlogs
OEM bootlog
\0x00HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN CFE version 1.0.37-106.5 for BCM96328 (32bit,SP,BE) Build Date: å\0x9b\0x9b 8æ\0x9c\0x88 26 15:29:39 CST 2010 (jason@jason-desktop) Copyright (C) 2000-2009 Broadcom Corporation. HS Serial flash device: name MX25L64, id 0xc217 size 8192KB Total Flash size: 8192K with 128 sectors Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Main Thread: TP0 Memory Test Passed Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-4) : AW4339U Number of MAC Addresses (1-32) : 11 Base MAC Address : 14:d6:4d:f3:cd:5b PSI Size (1-128) KBytes : 128 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 Booting from only image (0xb8010000) ... Code Address: 0x80010000, Entry Address: 0x80014230 Decompression OK! Entry at 0x80014230 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80014230 Linux version 2.6.30 (root@owen-UB) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 Thu Apr 14 09:01:40 CST 2011 HS Serial flash device: name MX25L64, id 0xc217 size 8192KB AW4339U prom init CPU revision is: 0002a075 (Broadcom4350) Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 80282420, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 wait instruction: enabled Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes RCU-based detection of stalled CPUs is enabled. NR_IRQS:128 PID hash table entries: 256 (order: 8, 1024 bytes) console [ttyS0] enabled Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61080k/64512k available (2113k kernel code, 3412k reserved, 396k data, 116k init, 0k highmem) Calibrating delay loop... 319.48 BogoMIPS (lpj=159744) Mount-cache hash table entries: 512 net_namespace: 816 bytes NET: Registered protocol family 16 Total Flash size: 8192K with 128 sectors registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x00ffff] pci 0000:02:00.0: supports D1 pci 0000:02:00.0: PME# supported from D0 D1 D3hot pci 0000:02:00.0: PME# disabled pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: 0x10f00000-0x10ffffff pci 0000:01:00.0: PREFETCH window: disabled PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher squashfs: version 4.0 with LZMA457 ported by BRCM msgmni has been set to 119 io scheduler noop registered (default) pcieport-driver 0000:01:00.0: device [14e4:6328] has invalid IRQ; check vendor BIOS PCI: Setting latency timer of device 0000:01:00.0 to 64 PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 File system address: 0xb8010100 brcmboard: brcm_board_init entry SES: Button Interrupt 0x8018 is enabled SES: LED GPIO 0x8009 is enabled Invalid External Interrupt definition Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xb0000100 (irq = 36) is a BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 36) is a BCM63XX bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.3 Apr 14 2011 08:59:20 Broadcom Logger v0.1 Apr 14 2011 08:59:04 Mirror/redirect action on u32 classifier input device check on Actions configured TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 17 NET: Registered protocol family 15 Bridge firewalling registered Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly on device 31:0. Freeing unused kernel memory: 116k freed init started: BusyBox v1.00 (2011.04.14-01:02+0000) multi-call binary mount: Mounting sysfs on /sys failed: No such devi BusyBox v1.00 (2011.04.14-01:02+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... cp: /bin/CP850.so: No such file or directory bcmxtmcfg: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM6328B0 Ethernet Network Device v0.1 Apr 14 2011 08:59:12 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: MAC Address: 14:D6:4D:F3:CD:5B eth1: MAC Address: 14:D6:4D:F3:CD:5B eth2: MAC Address: 14:D6:4D:F3:CD:5B eth3: MAC Address: 14:D6:4D:F3:CD:5B ath_hal: 0.9.17.1 (AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2316, RF2317, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_dfs: Version 2.0.0 Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved wlan: 0.8.4.2 (Atheros/multi-bss) ath_rate_atheros: Version 2.0.1 Copyright (c) 2001-2004 Atheros Communications, Inc, All Rights Reserved ath_pci: 0.9.4.5 (Atheros/multi-bss) ath_pci: CR-LSDK-1.4.0.112 PCI: Enabling device 0000:02:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:02:00.0 to 64 string = 0xa5 ar5416EepromAttach: Read calibration data from FLASH successfully Chan Freq RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 27 HT40 1 0 1 N 1 2412n 27 HT20 1 0 0 N 2 2417n 27 HT20 1 0 0 N 2 2417n 27 HT40 1 0 1 N 3 2422n 27 HT40 1 0 1 N 3 2422n 27 HT20 1 0 0 N 4 2427n 27 HT40 1 0 1 N 4 2427n 27 HT20 1 0 0 N 5 2432n 27 HT40 1 1 0 N 5 2432n 27 HT40 1 0 1 N 5 2432n 27 HT20 1 0 0 N 6 2437n 27 HT40 1 1 0 N 6 2437n 27 HT40 1 0 1 N 6 2437n 27 HT20 1 0 0 N 7 2442n 27 HT40 1 0 1 N 7 2442n 27 HT20 1 0 0 N 7 2442n 27 HT40 1 1 0 N 8 2447n 27 HT40 1 1 0 N 8 2447n 27 HT20 1 0 0 N 9 2452n 27 HT40 1 1 0 N 9 2452n 27 HT20 1 0 0 N 10 2457n 27 HT40 1 1 0 N 10 2457n 27 HT20 1 0 0 N 11 2462n 27 HT40 1 1 0 N 11 2462n 27 HT20 1 0 0 N dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0 DFS min filter rssiThresh = 18 DFS max pulse dur = 131 ticks wifi0: 11nght20 rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11nght20 MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: 11nght40plus rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11nght40plus MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: 11nght40minus rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11nght40minus MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: mac 384.2 phy 15.15 radio 12.0 wifi0: Use hw queue 1 for WME_AC_BE traffic wifi0: Use hw queue 0 for WME_AC_BK traffic wifi0: Use hw queue 2 for WME_AC_VI traffic wifi0: Use hw queue 3 for WME_AC_VO traffic wifi0: Use hw queue 8 for CAB traffic wifi0: Use hw queue 9 for beacons wifi0: Use hw queue 7 for UAPSD wifi0: Atheros 9287: mem=0x10f00000, irq=31 hw_base=0xb0f00000 wlan: mac acl policy registered p8021ag: p8021ag_init entry Broadcom 802.1Q VLAN Interface, v0.1 ===== Release Version EU_1.00 (build timestamp 2011.04.14-09:02:20) ===== device eth0 entered promiscuous mode device eth1 entered promiscuous mode device eth2 entered promiscuous mode device eth3 entered promiscuous mode interface ath0 does not exist! SIOCGIFFLAGS: No such device SIOCSIFADDR: No such device WLmngr Daemon is running Atheros WLmngr Daemon is running BcmAdsl_Initialize=0xC00B5FEC, g_pFnNotifyCallback=0xC00D9DF4 pSdramPHY=0xA3FFFFF8, 0xE916A 0xDEADBEEF ath0 I am before: 0 before ieee80211_check_mode_consistency after ieee80211_check_mode_consistency After RUN check after radar check: Scan device ath0 entered promiscuous mode *** PhySdramSize got adjusted: 0x73038 => 0x88D78 *** AdslCoreSharedMemInit: shareMemAvailable=488032 AdslCoreHwReset: AdslOemDataAddr = 0xA3F69710 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: ath_chan_set: Changing to channel 2437, Flags 40080, PF 40 ath_newstate: ieee80211_newstate: br0: port 5(ath0) entering forwarding state ath_newstate: ieee80211_newstate: br0: port 5(ath0) entering disabled state iptables v1.4.0: can't initialize iptables table `nat': iptables who? (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. monitor task is initialized pid= 205 Switch MDK: num_switches = 1 Switch MDK: unit = 0; phy_pbmp = 0xf; config_pbmp = 0xf Switch MDK link poll thread: unit=0; phypbmp=0xf tr69c:error:10.847:updateTr69cCfgInfo:687:acsState.connReqURL (null), acsCfg->connectionRequestURL (null) tr69c:error:10.847:updateTr69cCfgInfo:710:connReqURLchanged 0 tr69c:error:10.848:readMessageFromSmd:890:got SYSTEM_BOOT, adding eIEBoot to informEvList ath1 I am before: 0 before ieee80211_check_mode_consistency after ieee80211_check_mode_consistency After RUN check after radar check: Scan ath2 I am before: 0 before ieee80211_check_mode_consistency after ieee80211_check_mode_consistency After RUN check after radar check: Scan ath3 I am before: 0 before ieee80211_check_mode_consistency after ieee80211_check_mode_consistency After RUN check after radar check: Scan optarg=0 shmId=0 wlevt_init@107: opened loopback socket 4 wlevt is ready for new msg... killall: wpa_supplicant: no process killed ath_newstate: ieee80211_newstate: device ath0 left promiscuous mode br0: port 5(ath0) entering disabled state ath_newstate: ieee80211_newstate: ath_newstate: ieee80211_newstate: ath_newstate: ieee80211_newstate: wlanconfig: ioctl: No such device There is no Predefined DevicePin in CFE WPS Device PIN = 73159247 interface ath0 does not exist! interface ath0 does not exist! SIOCGIFFLAGS: No such device SIOCSIFADDR: No such device ath0 device ath0 entered promiscuous mode ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: *****Channel 6 noiseFlr -120 intRssi -3 ath_chan_set: Changing to channel 2432, Flags 40080, PF 40 br0: port 5(ath0) entering forwarding state ath_newstate: ieee80211_newstate: *****Channel 5 noiseFlr -120 intRssi -1 ath_chan_set: Changing to channel 2437, Flags 40080, PF 40 br0: port 5(ath0) entering disabled state ath1 ath2 ath3 WPS Mode = [] ath_ioctl: set countrycode:826 Chan Freq RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 20 HT20 1 0 0 N 1 2412n 20 HT40 1 0 1 N 2 2417n 20 HT40 1 0 1 N 2 2417n 20 HT20 1 0 0 N 3 2422n 20 HT20 1 0 0 N 3 2422n 20 HT40 1 0 1 N 4 2427n 20 HT40 1 0 1 N 4 2427n 20 HT20 1 0 0 N 5 2432n 20 HT40 1 1 0 N 5 2432n 20 HT40 1 0 1 N 5 2432n 20 HT20 1 0 0 N 6 2437n 20 HT40 1 1 0 N 6 2437n 20 HT40 1 0 1 N 6 2437n 20 HT20 1 0 0 N 7 2442n 20 HT40 1 0 1 N 7 2442n 20 HT20 1 0 0 N 7 2442n 20 HT40 1 1 0 N 8 2447n 20 HT40 1 1 0 N 8 2447n 20 HT40 1 0 1 N 8 2447n 20 HT20 1 0 0 N 9 2452n 20 HT40 1 1 0 N 9 2452n 20 HT40 1 0 1 N 9 2452n 20 HT20 1 0 0 N 10 2457n 20 HT40 1 1 0 N 10 2457n 20 HT20 1 0 0 N 11 2462n 20 HT40 1 1 0 N 11 2462n 20 HT20 1 0 0 N 12 2467n 20 HT40 1 1 0 N 12 2467n 20 HT20 1 0 0 N 13 2472n 20 HT40 1 1 0 N 13 2472n 20 HT20 1 0 0 N dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0 DFS min filter rssiThresh = 21 DFS max pulse dur = 131 ticks Chan Freq RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 20 HT20 1 0 0 N 1 2412n 20 HT40 1 0 1 N 2 2417n 20 HT40 1 0 1 N 2 2417n 20 HT20 1 0 0 N 3 2422n 20 HT20 1 0 0 N 3 2422n 20 HT40 1 0 1 N 4 2427n 20 HT40 1 0 1 N 4 2427n 20 HT20 1 0 0 N 5 2432n 20 HT40 1 1 0 N 5 2432n 20 HT40 1 0 1 N 5 2432n 20 HT20 1 0 0 N 6 2437n 20 HT40 1 1 0 N 6 2437n 20 HT40 1 0 1 N 6 2437n 20 HT20 1 0 0 N 7 2442n 20 HT40 1 0 1 N 7 2442n 20 HT20 1 0 0 N 7 2442n 20 HT40 1 1 0 N 8 2447n 20 HT40 1 1 0 N 8 2447n 20 HT40 1 0 1 N 8 2447n 20 HT20 1 0 0 N 9 2452n 20 HT40 1 1 0 N 9 2452n 20 HT40 1 0 1 N 9 2452n 20 HT20 1 0 0 N 10 2457n 20 HT40 1 1 0 N 10 2457n 20 HT20 1 0 0 N 11 2462n 20 HT40 1 1 0 N 11 2462n 20 HT20 1 0 0 N 12 2467n 20 HT40 1 1 0 N 12 2467n 20 HT20 1 0 0 N 13 2472n 20 HT40 1 1 0 N 13 2472n 20 HT20 1 0 0 N I am before: 0 I am before: 0 device ath0 left promiscuous mode br0: port 5(ath0) entering disabled state device ath0 entered promiscuous mode ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: *****Channel 6 noiseFlr -120 intRssi -3 ath_chan_set: Changing to channel 2412, Flags 20080, PF 40 br0: port 5(ath0) entering forwarding state *****Channel 1 noiseFlr -120 intRssi 2050 ath_chan_set: Changing to channel 2417, Flags 20080, PF 40 *****Channel 2 noiseFlr -120 intRssi -3 ath_chan_set: Changing to channel 2422, Flags 20080, PF 0 *****Channel 3 noiseFlr -119 intRssi 32762 ath_chan_set: Changing to channel 2427, Flags 20080, PF 0 Reaped 1188 *****Channel 4 noiseFlr -121 intRssi 0 ath_chan_set: Changing to channel 2432, Flags 20080, PF 0 *****Channel 5 noiseFlr -120 intRssi -1 ath_chan_set: Changing to channel 2437, Flags 20080, PF 0 *****Channel 6 noiseFlr -120 intRssi -3 ath_chan_set: Changing to channel 2442, Flags 20080, PF 0 *****Channel 7 noiseFlr -120 intRssi 0 ath_chan_set: Changing to channel 2447, Flags 20080, PF 40 *****Channel 8 noiseFlr -120 intRssi 0 ath_chan_set: Changing to channel 2452, Flags 20080, PF 40 UPnP daemon is ready to run *****Channel 9 noiseFlr -120 intRssi -28664 ath_chan_set: Changing to channel 2437, Flags 40080, PF 40 ******* channel 1 average rssi 32 noise floor -120 final average rssi -208 ******* channel 6 average rssi 15 noise floor -120 final average rssi -225 find_best_11ng_centerchan: found best center chan: 6 ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: ath_chan_set: Changing to channel 2437, Flags 20080, PF 0 ath_newstate: ieee80211_newstate: /bin/eapd: not found /bin/nas: not found Reading topology file /var/topology_ap.conf ... ath_newstate: ieee80211_newstate: br0: port 5(ath0) entering disabled state Could not connect to kernel driver. Using interface ath0 with hwaddr 14:d6:4d:f3:cd:5c and ssid 'D-Link DSL-2741B' ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: ******* channel 1 average rssi 32 noise floor -120 final average rssi -208 Ignore the current channel 6 find_best_11ng_centerchan: found best center chan: 1 ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 0 ath_newstate: Resetting (ath_newstate); Code: 04 ieee80211_newstate: ath_chan_set: Changing to channel 2412, Flags 20080, PF 40 ath_newstate: ieee80211_newstate: br0: port 5(ath0) entering forwarding state l2_packet_receive - recvfrom: Network is down wpatalk: INFO: Connection (re)established to daemon=hostapd interface=ath0 wpatalk: INFO: ... using socket-file=/var/run/hostapd/ath0 wpatalk: INFO: SEND-RAW: CONFIGSTOP wpatalk: INFO: GOT-RESPONSE: OK killall: wpatalk: no process killed wpatalk: INFO: Connection (re)established to daemon=hostapd interface=ath0 wpatalk: INFO: ... using socket-file=/var/run/hostapd/ath0 wpatalk: INFO: SEND-RAW: CONFIGME pin=73159247 timeout=120 wpatalk: INFO: GOT(cb): <2>CTRL-REQ-WPS-JOB-READY:[new start]-AP button pushed or PIN entered wpatalk: INFO: GOT-RESPONSE: OK BCM96328 Broadband Router Login: admin Password: > sh BusyBox v1.00 (2011.04.14-01:02+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. #