D-Link DSL-5xxT and DSL-G6xxT - ADAM2 Installation Guide

The 5xxT/G6xxT family uses an ADAM2 bootloader. That means that the installation is slighly more complex than the common one used for Broadcom (and PSPBoot-based AR7) devices. There is in-depth technical documentation on the Seatte Wireless ADAM2 page.

There are multiple safeguards that make the risk of bricking the router pretty low. The bootloader starts an FTP (FTP, not TFTP!) server on each boot, and can be accessed directly with a FTP client. It will also accept the original firmware image.

If something goes wrong, the tiupgrade.exe Windows tool can be used to restore the original firmware. For more advanced users, CICLaMaB (and its wizard) might also be useful. If things go *really* wrong, the board has a JTAG port (not tested), which should be enough to recover a completely bricked device.

The easiest way to upgrade the firmware is directly from OpenWrt using the mtd-tool because generic.sysupgrade is not supported yet.


Please do read:


Installation

Finding the bootloader address

When booting, the bootloader waits a few seconds for incoming connections to its FTP server. The address the bootloader listens to can be (and probably is) different from the one used by the device once the boot is completed. The easiest way to find it is to connect to the router with telnet, once the original firmware has completed booting.

User and passwords are both set by default to "admin".

# cat /proc/ticfg/env | grep my_ipaddress

If the IP is set it will be shown like this:

my_ipaddress    10.8.8.8

Usually, most devices use either 5.8.8.8 or 10.8.8.8. If you're upgraded the firmware in the past using tiupgrade.exe, it might have changed your IP to the one you specified in the web interface.

If it's not displayed, or to change it, it can be set with the command:

# echo "my_ipaddress 192.168.1.1" > /proc/sys/dev/adam2/environment

Partitioning

The flash on the device is divided into partitions. To get Openwrt to boot, we have to change some offsets.

The original firmware uses these partitions (in physical order):

Bootloader name start end size use
mtd2 0x90000000 0x90010000 64 KiB Bootloader
mtd1 0x90010090 0x90091000 ~516 KiB Kernel
mtd0 0x90091000 0x903f0000 3452 KiB Root filesystem
mtd3 0x903f0000 0x90400000 64 KiB Configuration

and another "virtual" partition" that covers both mtd1 and mtd0

Bootloader name start end size use
mtd4 0x90010000 0x903f0000 3968 KiB Kernel + FS

The mtd2 partition contains the bootloader. Never touch it. If the bootloader gets corrupted, the router won't boot anymore (in that case reprogramming the entire flash with the JTAG should bring it back to life). Just to be safe, during normal usage the kernel won't allow you to overwrite it even if explicitly requested.

The mtd3 partition contains both the bootloader configuration and the original firmware settings. OpenWrt will ignore anything written in here. Don't touch it as well, or ADAM2 might get confused and unable to boot anymore.

To use OpenWrt on this unit the the partition layout need to be modified as follows (changes are in bold):

Partitions: (again, in physical ordering):

Bootloader name Kernel name Start End Use
mtd2 loader 0x90000000 0x90010000 Bootloader (ADAM2)
mtd1 linux 0x90010000 0x903f0000 Linux kernel (only the start address is used)
mtd0 rootfs 0x90010000 0x903f0000 r/o squashfs + r/w jffs2 filesystems (only the end address is used)
mtd3 config 0x903f0000 0x90400000 Original firmware configuration

the "virtual" partition remains unchanged as

Bootloader name Kernel name Start End Use
mtd4 rootfs_data 0x90010000 0x903f0000 Kernel + FS

To be more precise, the kernel, once booted, will map another "virtual" partiton as /dev/mtdblock4 that will point to the newly created jffs2 partition located inside mtd3. Just ignore it for this discussion.

NOTE: the end of mtd1 and the start of mtd0 are dummy addresses; OpenWrt auto-detects the boundary between the kernel and the file system. The extra addresses are only used by firmwares based on 2.4.x kernels.

Flashing

As an example, we'll use the openwrt-ar7-squashfs.bin image from the "ar7" OpenWrt port.

NOTE: The TCP/IP implementation in the bootloader is very basic and not completely standards compliant. There are some issues with recent Linux kernels that make the flashing process hang.
If your FTP client seems stuck, wait a few minutes and power off the router, the flash won't be damaged. If you're having problems, try to run your FTP client as root (so it can set different timeout parameters on the TCP socket). Windows (at least XP) and its built-in FTP command-line client is reported to work.

To reach the router during bootup, configure your computer using a static IP address on the same subnet as the bootloader (10.8.8.1/8 or 5.8.8.1/8 should be fine).

Apply power to the router. There will be a few second window where a connection can established with FTP to the address you've found before. The time window is very small, so if it doesn't work try again. It should start listening when the 4 switch lights turn off.

Username and Password are "adam2"

The commands needed to fix the partition table are:

quote "SETENV mtd1,0x90010000,0x903f0000"
quote "GETENV mtd1"

Check each partition before continuing, an error here might brick the device.

When this has been completed the image can be flashed to the Kernel+FS partition mtd4

quote "MEDIA FLSH"
binary
debug
hash
put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd4"
quote REBOOT
quit

The router will reboot and set itself up, do not remove power as this could break it. Leave it until the status light has a steady heartbeat, then it is safe to power down.

Upgrading

you can not use sysupgrade to update this router, so you can use mtd:

scp openwrt-ar7-squashfs.bin 192.168.1.1:/tmp
ssh 192.168.1.1
mtd -r write  /tmp/openwrt-ar7-squashfs.bin linux

in case you load a non-working you can still use the FTP method to reflash with a working one

Tags

Back to top

toh/d-link/dsl-5xxt-6xxt-adam2.txt · Last modified: 2014/02/13 07:35 by hhm