D-Link DSL-5xxT and DSL-G6xxT - ADAM2 Installation Guide
The 5xxT/G6xxT family uses an ADAM2 bootloader. That means that the installation is slighly more complex than the common one used for Broadcom (and PSPBoot-based AR7) devices. There is in-depth technical documentation on the Seatte Wireless ADAM2 page.
There are multiple safeguards that make the risk of bricking the router pretty low. The bootloader starts an FTP (FTP, not TFTP!) server on each boot, and can be accessed directly with a FTP client. It will also accept the original firmware image.
If something goes wrong, the tiupgrade.exe Windows tool can be used to restore the original firmware. For more advanced users, CICLaMaB (and its wizard) might also be useful. If things go *really* wrong, the board has a JTAG port (not tested), which should be enough to recover a completely bricked device.
The easiest way to upgrade the firmware is directly from OpenWrt using the mtd-tool because generic.sysupgrade is not supported yet.
Please do read:
Installation
Choosing the right OpenWRT image to flash
(as of July 2016)
IMPORTANT: It fails to boot with an 15.05.1 image (tested 3 times with different images)!
It boots fine with 14.07.
IMPORTANT: If you use the stock, generic TI-AR7 OpenWRT image, including LUCI and other common things, you will be able to boot, but there is not enough space left on the device for persistence, so all your configuration will be lost after a reboot.
Consequently, we have to build our own image with the OpenWRT image builder:
cd cd Downloads wget https://downloads.openwrt.org/barrier_breaker/14.07/ar7/generic/OpenWrt-ImageBuilder-ar7_generic-for-linux-x86_64.tar.bz2 tar xf OpenWrt-ImageBuilder-ar7_generic-for-linux-x86_64.tar.bz2 cd OpenWrt-ImageBuilder-ar7_generic-for-linux-x86_64/ make image PROFILE="Annex-B" |
After that, the image we would flash to the device is under “bin/ar7/openwrt-ar7-generic-squashfs.bin”.
Finding the bootloader address
When booting, the bootloader waits a few seconds for incoming connections to its FTP server. The address the bootloader listens to can be (and probably is) different from the one used by the device once the boot is completed. The easiest way to find it is to connect to the router with telnet, once the original firmware has completed booting.
User and passwords are both set by default to “admin”.
# cat /proc/ticfg/env | grep my_ipaddress |
If the IP is set it will be shown like this:
my_ipaddress 10.8.8.8 |
Usually, most devices use either 5.8.8.8 or 10.8.8.8. If you're upgraded the firmware in the past using tiupgrade.exe, it might have changed your IP to the one you specified in the web interface.
If it's not displayed, or to change it, it can be set with the command:
# echo "my_ipaddress 192.168.1.1" > /proc/sys/dev/adam2/environment |
Partitioning
The flash on the device is divided into partitions. To get Openwrt to boot, we have to change some offsets.
The original firmware uses these partitions (in physical order):
| Bootloader name | start | end | size | use |
|---|---|---|---|---|
| mtd2 | 0x90000000 | 0x90010000 | 64 KiB | Bootloader |
| mtd1 | 0x90010090 | 0x90091000 | ~516 KiB | Kernel |
| mtd0 | 0x90091000 | 0x903f0000 | 3452 KiB | Root filesystem |
| mtd3 | 0x903f0000 | 0x90400000 | 64 KiB | Configuration |
and another “virtual” partition“ that covers both mtd1 and mtd0
| Bootloader name | start | end | size | use |
|---|---|---|---|---|
| mtd4 | 0x90010000 | 0x903f0000 | 3968 KiB | Kernel + FS |
The mtd2 partition contains the bootloader. Never touch it. If the bootloader gets corrupted, the router won't boot anymore (in that case reprogramming the entire flash with the JTAG should bring it back to life). Just to be safe, during normal usage the kernel won't allow you to overwrite it even if explicitly requested.
The mtd3 partition contains both the bootloader configuration and the original firmware settings. OpenWrt will ignore anything written in here. Don't touch it as well, or ADAM2 might get confused and unable to boot anymore.
To use OpenWrt on this unit the the partition layout need to be modified as follows (changes are in bold):
Partitions: (again, in physical ordering):
| Bootloader name | Kernel name | Start | End | Use |
|---|---|---|---|---|
| mtd2 | loader | 0x90000000 | 0x90010000 | Bootloader (ADAM2) |
| mtd1 | linux | 0x90010000 | 0x903f0000 | Linux kernel (only the start address is used) |
| mtd0 | rootfs | 0x90010000 | 0x903f0000 | r/o squashfs + r/w jffs2 filesystems (only the end address is used) |
| mtd3 | config | 0x903f0000 | 0x90400000 | Original firmware configuration |
the “virtual” partition remains unchanged as
| Bootloader name | Kernel name | Start | End | Use |
|---|---|---|---|---|
| mtd4 | rootfs_data | 0x90010000 | 0x903f0000 | Kernel + FS |
To be more precise, the kernel, once booted, will map another “virtual” partiton as /dev/mtdblock4 that will point to the newly created jffs2 partition located inside mtd3. Just ignore it for this discussion.
NOTE: the end of mtd1 and the start of mtd0 are dummy addresses; OpenWrt auto-detects the boundary between the kernel and the file system. The extra addresses are only used by firmwares based on 2.4.x kernels.
Flashing
As an example, we'll use the openwrt-ar7-squashfs.bin image from the ”ar7“ OpenWrt port.
NOTE: The TCP/IP implementation in the bootloader is very basic and not completely standards compliant. There are some issues with recent Linux kernels that make the flashing process hang.
If your FTP client seems stuck, wait a few minutes and power off the router, the flash won't be damaged. If you're having problems, try to run your FTP client as root (so it can set different timeout parameters on the TCP socket). Windows (at least XP) and its built-in FTP command-line client is reported to work.
If you still have FTP problems when connecting from Linux, try to turn off some advanced error correction algorithm, which seems to cause problems with this (and other) device (as root):
echo 0 > /proc/sys/net/ipv4/tcp_frto
To reach the router during bootup, configure your computer using a static IP address on the same subnet as the bootloader (10.8.8.1/8 or 5.8.8.1/8 should be fine).
Apply power to the router. There will be a few second window where a connection can established with FTP to the address you've found before. The time window is very small, so if it doesn't work try again. It should start listening when the 4 switch lights turn off.
ftp -n 192.168.1.1 |
Username and Password are “adam2”:
quote "USER adam2" quote "PASS adam2" |
The commands needed to fix the partition table are:
quote "SETENV mtd1,0x90010000,0x903f0000" quote "GETENV mtd1" |
Check each partition before continuing, an error here might brick the device.
When this has been completed the image can be flashed to the Kernel+FS partition mtd4
quote "MEDIA FLSH" binary debug hash put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd4" quote REBOOT quit |
The router will reboot and set itself up, do not remove power as this could break it. Leave it until the status light has a steady heartbeat, then it is safe to power down.
Setup
If you flashed 14.07, you can connect to your device at IP 192.168.1.1 through telnet, and then set a password for your root account, to be used with future ssh logins. Configuration can be done with “uci”, if “luci” was not installed.
Upgrading
you can not use sysupgrade to update this router, so you can use mtd:
scp openwrt-ar7-squashfs.bin 192.168.1.1:/tmp ssh 192.168.1.1 mtd -r write /tmp/openwrt-ar7-squashfs.bin linux |
in case you load a non-working you can still use the FTP method to reflash with a working one