User Tools

Site Tools


D-Link DSL-2640U/BRU/C

Unit marked D-Link DSL-2640U/BRU/C (or just D-Link DSL-2640U HW rev C1), based on on Broadcom 6338 CPU and Broadcom 4312 WLAN. OpenWRT partially works - device function as wired router, but without ADSL and WiFi. Problems: since CPU BCM 6338 doesnt have PCI bus, WLAN module seems to be connected over SDIO = no drivers for such solution yet. ADSL part of device probably will never be supported, since Broadcom doesnt release proprietary drivers sources.

Hardware info

ADSL2+ Chip with CPU MIPS32 FLASH 4MB SDRAM 16MB Switch 10/100MBit WLAN 802.11b/g WLAN Front-End ASDL Line driver
Broadcom BCM6338KFBG Macronix KH29LV320CBTC-70G (CFE reports MX29LV320AB) Nanya NT5DV8M16FS-75B (or Winbond W9812G6IH-6) Broadcom BCM5325EKQMG Broadcom BCM4312KFBG Skyworks SKY65249-11 Broadcom BCM6301KSG
datasheet datasheet datasheet datasheet product brief datasheet

Board images

D-Link DSL-2640U/BRU/C Ver. C1 PCB Board (top side)

D-Link DSL-2640U/BRU/C Ver. C1 PCB Board (bottom side)

Serial port pinout

Serial port is marked as "J5" and uses this pinout:


Port uses 3.3 V signaling at speed 115200.

CFE startup output

CFE version 1.0.37-12.1 for BCM96338 (32bit,SP,BE)
Build Date: Mon Jun  9 01:35:26 CST 2008 (root@localhost.localdomain)
Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
CPU type 0x29010: 240MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80528710 (1210128)
Initialized Data:          0x8041D740 - 0x8041FF30 (10224)
BSS Area:                  0x8041FF30 - 0x80426710 (26592)
Local Heap:                0x80426710 - 0x80526710 (1048576)
Stack Area:                0x80526710 - 0x80528710 (8192)
Text (code) segment:       0x80401000 - 0x8041D734 (116532)
Boot area (physical):      0x00529000 - 0x00569000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  :
Host IP address                   :
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : 308nfs6358
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Board Id (0-14)                   : 96338W2_E7T
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : 00:22:b0:c1:16:17
PSI Size (1-64) KBytes            : 24

OpenWRT boot log

Booting from only image (0xbfc10000) ... Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 Linux version (riptor@riptor-desktop) (gcc version 4.3.3 (GCC) ) #1 Sat Jun 26 02:02:46 MSD 2010 Detected Broadcom 0x6338 CPU revision a2 CPU frequency is 240 MHz 16MB of RAM installed registering 8 GPIOs board_bcm963xx: CFE version: 1.0.37-12.1 bootconsole [early0] enabled CPU revision is: 00029010 (Broadcom BCM6338) board_bcm963xx: board name: 96338W2_E7T Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 PID hash table entries: 64 (order: -4, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes Memory: 13484k/16384k available (2050k kernel code, 2900k reserved, 363k data, 136k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 Calibrating delay loop... 238.59 BogoMIPS (lpj=477184) Mount-cache hash table entries: 512 NET: Registered protocol family 16 bio: create slab at 0 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(0.235:1): initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 26 io scheduler noop registered io scheduler deadline registered (default) gpiodev: gpio device registered with major 254 gpiodev: gpio platform device registered with access mask FFFFFFFF bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96338W2_E7T bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00 bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000 bcm963xx_flash: Spare partition is 2a0000 offset and length 150000 Creating 5 MTD partitions on "bcm963xx": 0x000000000000-0x000000010000 : "CFE" 0x000000010100-0x0000000f0000 : "kernel" mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only 0x0000000f0000-0x0000003f0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=2A0000, len=150000 0x0000002a0000-0x0000003f0000 : "rootfs_data" 0x0000003f0000-0x000000400000 : "nvram" 0x000000010000-0x0000003f0000 : "linux" bcm63xx_enet MII bus: probed bcm63xx_wdt started, timer margin: 30 sec Registered led device: ppp Registered led device: ppp-fail Registered led device: power TCP westwood registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 136k freed Please be patient, while OpenWrt loads ... - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - jffs2 not ready yet; using ramdisk mini_fo: using base directory: / mini_fo: using storage directory: /tmp/root - init - Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] CPU 0 Unable to handle kernel paging request at virtual address 000000e4, epc == 8017e958, ra == 80181280 Oops[#1]: Cpu 0 $ 0 : 00000000 10008400 ffffffa7 00000003 $ 4 : 00000000 80260124 80c01120 00000000 $ 8 : 00000000 800141b0 80828660 00000000 $12 : 00000000 00000000 00000000 00000000 $16 : 80cfc000 80cfc2c0 80220010 8025c068 $20 : 8025c060 ffffffa7 80cfc000 7fe2b9f0 $24 : 00000010 8017f710 $28 : 80b36000 80b37d28 00000100 80181280 Hi : 00000000 Lo : 00000000 epc : 8017e958 0x8017e958 Not tainted ra : 80181280 0x80181280 Status: 10008403 KERNEL EXL IE Cause : 00800008 BadVA : 000000e4 PrId : 00029010 (Broadcom BCM6338) Modules linked in: Process ifconfig (pid: 367, threadinfo=80b36000, task=80a1fa38, tls=00000000) Stack : 8025c060 00008914 80cfc000 7fe2b9f0 80cfc000 80181280 00000000 00000000 fffffff5 00000000 80cfc000 80cfc000 00008914 8004a5d8 7fe2b500 8018bcb8 00000000 00000001 80cfc000 80cfc030 80220010 00001043 00000000 80cfc000 80cfc030 80220010 00001043 00000000 00008914 7fe2b8f0 7fe2b9f0 8019e36c 00000041 8019b0a8 00000000 80ae5280 80cfc000 00000000 00001002 8019d720 ... Call Trace:[<80181280>] 0x80181280 [<8004a5d8>] 0x8004a5d8 [<8018bcb8>] 0x8018bcb8 [<8019e36c>] 0x8019e36c [<8019b0a8>] 0x8019b0a8 [<8019d720>] 0x8019d720 [<8019e408>] 0x8019e408 [<801ec098>] 0x801ec098 [<8019ef2c>] 0x8019ef2c [<8018ada0>] 0x8018ada0 [<800a3b98>] 0x800a3b98 [<8018c248>] 0x8018c248 [<800a4298>] 0x800a4298 [<8018c2dc>] 0x8018c2dc [<80097064>] 0x80097064 [<800a433c>] 0x800a433c [<800864bc>] 0x800864bc [<80012210>] 0x80012210 Code: 27bdffe8 afb00010 afbf0014 <8c8200e4> 18400003 00808021 0c05f459 00000000 0c05f4e4 Disabling lock debugging due to kernel taint BusyBox v1.15.3 (2010-06-26 01:46:38 MSD) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M Backfire (10.03, r21847) -------------------------- * 1/3 shot Kahlua In a shot glass, layer Kahlua * 1/3 shot Bailey's on the bottom, then Bailey's, * 1/3 shot Vodka then Vodka. --------------------------------------------------- root@OpenWrt:/#

JTAG connector


Original Firmware Info

The original GPL sourcecode v1.00 can be downloaded Here Here. It consist on a Linux 2.? kernel with binary Broadcom tools&drivers and sourcecode of the kernel and the rest of tools.


toh/d-link/dsl-2640u-bru-c.txt · Last modified: 2012/09/19 09:39 (external edit)