Resurrecting a dead DSL-500 or DSL-504 (Generation I or II hardware)
====================================================================================
V1.00 - 19 February 2003.
V1.01 - 15 March 2003 - Added MAC Resetting info.
V1.02 - 4 July 2003 - Added xmodem (and xmodem fast) and .BIN file info.
V1.03 - 9 July 2003 - Fully documented the xmodem fast method after trying it :)
V1.04 - 14 July 2003 - Added note about how to obtain an ATMOS prompt in some cases
V1.05 - 19 February 2004 - Added warning about correct generation firmware
V1.06 - 21 June 2004 - Added warning about correct model router
====================================================================================
CAUTION: Please make very certain that you upload the firmware for the correct
Generation of hardware. Go to my website (www.sentry.org) and verify
the generation of your router, then use the corresponding firmware
version. Failure to use the correct firmware version has been known
kill the router.
The DSL-500 (Gen-I and Gen-II) and the DSL-504 (Gen-I and Gen-II) are
completely different from the new DSL-500G and DSL-504G models. None
of these instructions apply to the DSL-500G and DSL-504G.
====================================================================================
I had upgraded my ever-reliable DSL-500's firmware to T23 in an effort to save it
from a failed upload of a beta version which I had been sent to test. The beta had
failed to upload the boot.bin file, thereby truncating the existing one to zero bytes.
Not good.
Without rebooting or restarting the router (never reboot/power off after a failed
firmware upgrade - you can usully attempt to upgrade as many times as you want, and
generally save a failed firmware upgrade), I upgraded to T23, the router reboooted and
all was well. Except of course, T23 stops me browsing web sites like www.smh.com.au
because it thinks it is being 'attacked' (see my web site at http://www.sentry.org) for
more details on this.
So, I tried downgrading from T23 to T8 as I had done many times in the past without any
problems. And this time seemed no different. The new firmware was transferred. The upgrade
utility gave me the 'success' dialog box and the router automatically rebooted ... to the
console output below:
----------------------------------------------------------------------------------------
NBfs1Z
PP Boot 8.2.0.16 (25 June 2002)
Copyright (c) 2002 D-Link Corp.
SDRAM size = 0x1000000
NPn
i 100%
*** INCOMPATIBLE PP CODE AND NP CODE!
*** SHARED STRUCTURE VERSIONS: PP 38, NP 37
*** SHARED STRUCTURE SIZES: PP 604, NP 600
*** CHECK CONSISTENCY OF PP AND NP IMAGES
Found valid boot information block
No, or invalid, configuration information in EEPROM - trying FLASH
Valid configuration (size 256)
*** INCOMPATIBLE PP CODE AND NP CODE!
*** SHARED STRUCTURE VERSIONS: PP 38, NP 37
*** SHARED STRUCTURE SIZES: PP 604, NP 600
*** CHECK CONSISTENCY OF PP AND NP IMAGES
DSL-500 version 7.1.0.30 Anne
*** INCOMPATIBLE NP AND PP VERSIONS OF ATM DRIVER: NP 9, PP 11
x-A (Dec 25 2002) R2.21.002.03.b2t23au
BSP: BD3000 BSP v1.0 (ISOS 7.1)
CSP: Helium CSP v1.0 (ISOS 7.1)
NP software version is 0x00000701 (reply took 14us)
Copyright (c) 2001 D-Link Corp.
password: TRAPDprocess_profile_file: unknown pfno 0
***** NP has crashed: abort code -2147483425
r0 ea00006c r1 ea00006d r2 ea00006e r3 ea00006f
r4 ea000070 r5 ea000071 r6 00010008 r7 e3a0004e
r8 00000000 r9 10fe6e98 r10 10000120 r11 00000280
r12 30000000 r13 0000038c r14 ea000076 r15 00000000 psr 02320080
npmsg: NP not responding
192.168.0.1> _
-----------------------------------------------------------------------------------------
NOT HAPPY JAN!
The router now no longer responded to its ethernet interface at all; it could not ping or
be pinged; TFTP was out of the question.
Casting all caution to the wind, and having absolutely nothing to lose, I changed to
the 'flashfs' file system and typed 'wipe' thus:
------------------------------------------------------------------------------------------
192.168.0.1>flashfs
192.168.0.1 flashfs>wipe
------------------------------------------------------------------------------------------
This completely erases the flashfs file system of every last byte of boot image and
configuration file. Irrevocably. No going back now. This process takes about two minutes
after which you should get the prompt back. If you do not get the prompt back, it does not
matter because the next thing you are going to do it pull the power. Wait a few seconds,
then repower the router after which the following console output should be presented:
------------------------------------------------------------------------------------------
NBfs1Z
PP Boot 8.2.0.16 (25 June 2002)
Copyright (c) 2002 D-Link Corp.
SDRAM size = 0x1000000
'NPimage' not found
Flash boot failed.
Entered console ... No, or bad, ATMOS images.
]help <--- Heh, it's my first time here
Commands to the console are:
configeeprom display EEPROM configuration information
configflash display FLASH configuration information
copyimages {yes | no} copy network booted image files
flashfs {auto | emergency} use automatic FLASHFS selection or
force boot from emergency FLASHFS
initialise initialise configuration information
listenv list environment variables
mac
set MAC address
serialboot yes boot from EEPROM
serialboot no boot from FLASH
setenv set environment variable
unsetenv unset environment variable
The following boot modes are supported by serial EEPROM v3.0+ only:
serialboot {yes | auto} boot via EEPROM, auto-select Ethernet or USB
serialboot ethernet boot via EEPROM from Ethernet only
serialboot usb boot via EEPROM from USB only
serialboot no boot from FLASH
dw [] dump words (hex/ascii)
enter enter an image
erw read a single word from EEPROM
eww write a single word to EEPROM
fdw [] dump flash words (hex/ascii)
flash config print flash configuration
help print this text
quit leave the console
reset reset system
rw read a single word
tftp download image using tftp
why reason for console entry
ww write a single word
xmodem [fast] download mkflash image using X-Modem
]why <--- I've always wanted to ask this of a computer :-)
Entered console because of: No, or bad, ATMOS images.
]configflash
Valid configuration information found
MAC: 00:50:ba:98:05:c7 <--- If this is not valid/set see the MAC Resetting note at the end
serialboot: yes / auto
copyimages: yes
flashfs: auto
netboot: no
]flash config
Flash configuration: 2 chips
Chip 0 size 1048576 @ 0x41000000
Chip 0 ID is 45b: (FUJITSU 29LV800BA 1024k bytes), unlocked (0)
Chip 1 size 1048576 @ 0x41100000
Chip 1 ID is 45b: (FUJITSU 29LV800BA 1024k bytes), unlocked (0)
Flash start offset: 0x00020000
Space for all FLASHFS partitions: 0x001e0000
]configeeprom
No or invalid configuration information
]configflash
Valid configuration information found
MAC: 00:50:ba:98:05:c7
serialboot: yes / auto
copyimages: yes
flashfs: auto
netboot: no
]xmodem
-------------------------------------------------------------------------------------------
NOTE 1: If you do not get the ATMOS ']' prompt, but just "<<< atmos_exit >>> Press 'R' to reboot"
turn off the router, while holding down your space-bar, turn on the router. It should now drop
you into the ATMOS ']' prompt.
NOTE 2: If you do not have an xmodem command then your boot blocks are too old and you cannot
resurrect your router using this method. You will have to return it to D-Link. Sorry :(
NOTE 3: You can choose the 'xmodem fast' command, but you will then need to change your terminal
baud rate from 9600 to 38400 which will give you a much faster transfer!
At this point, I started the Hyperterminal upload of the beta DSL-504 firmware file (these are
the files occasionally found in ZIP files which end in '.BIN' - I think they're meant for
upgrading the router via the web interface - No it does not matter that I had a DSL-500 and
not DSL-504 - it only affects the web interface where it refers to the model here and there in
the menus).
The last time I saw one of these special .BIN files was in a T20 beta release ZIP file.
There are copies of the DSL-500 (Generation I) T20 .BIN version and DSL-504 (Generation II)
B6 .BIN files on my web site if anyone needs them.
To start the xmodem transfer using Hyperterminal, choose the Transfer menu item, Send file,
select the BIN file to upload, choose the xmodem protocol and then press OK.
The non-fast xmodem transfer took around 33 minutes, after which it prompts you to type quit
to boot. The fast xmodem transfer took just under 10 minutes - much better!
-------------------------------------------------------------------------------------------
Image relocated - type quit to boot
]quit
NPn
i 0%
i 4%
i 9%
i 13%
i 18%
i 22%
i 27%
i 31%
i 36%
i 41%
i 45%
i 50%
i 55%
i 59%
i 64%
i 69%
i 74%
i 82%
i 92%
i 94%
i 100%
Found valid boot information block
No, or invalid, configuration information in EEPROM - trying FLASH
Valid configuration (size 256)
NP software version is 0x00000820 (reply took 15us)
DSL-504 version 7.1.0.30 Annex-A (Feb 18 2003) R2.21.002.05.b6au
BSP: BD3000 BSP v1.0 (ISOS 7.1)
CSP: Helium CSP v1.0 (ISOS 7.1)
Copyright (c) 2001 D-Link Corp.
password:
192.168.0.1> _
--------------------------------------------------------------------------------------------
Once you type quit, the router will reboot. Note: If you changed your terminal baud rate to
38400 earlier, you will now have to change it back to 9600.
At which point the router was now back in the land of the living and could be reconfigured.
You should do a 'config save' and 'flashfs update' to make sure that all the settings and files
which have just been uploaded are retained permanently or you may have to go back and do another
xmodem transfer :) Wait for these commands to complete - they take a minute or two each.
--------------------------------------------------------------------------------------------
192.168.0.1> config save
Saving configuration...
flashfs rewrite boot.bin finished
Delete boot.bin
Configuration saved.
192.168.0.1>flashfs update
Updating Flash filing system ...
done
192.168.0.1>
--------------------------------------------------------------------------------------------
If you need to configure the terminal for console access, I used Hyperterminal with the
following settings: 9600 baud (38400 for xmodem fast), 8 bit data word, 1 stop bit, No parity
and Hardware (CTS/RTS) handshaking.
MAC Resetting: In some cases the router will have lost it's MAC address. You can find your router's
MAC address on a barcode label at the back of the router. Type it in the format of
XX:XX:XX:XX:XX:XX. To reset the MAC address, type CONFIGFLASH MAC XX:XX:XX:XX:XX at the console.
Any questions, feel free to email me. My email address is on my web site (www.sentry.org).
I will help if I can. Much more D-Link DSL-50X information is available at www.sentry.org.
Copyright 2003-2004 Trevor B Roydhouse